Edit tour

Windows Analysis Report
rXTqHar5Ud.exe

Overview

General Information

Sample name:	rXTqHar5Ud.exe
Analysis ID:	1516120
MD5:	f403202fb853377ceb67200005ef95b8
SHA1:	1840e1495486209e92e5230cf1406f31a02699e7
SHA256:	3eebf917efa82ea7b81f37e9f8c98a702254c5f0a487667a72e78d53a61ce363
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

rXTqHar5Ud.exe (PID: 2532 cmdline: "C:\Users\user\Desktop\rXTqHar5Ud.exe" MD5: F403202FB853377CEB67200005EF95B8)

cmd.exe (PID: 3892 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkajlqvv\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2144 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe" C:\Windows\SysWOW64\dkajlqvv\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6036 cmdline: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 6320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6492 cmdline: "C:\Windows\System32\sc.exe" description dkajlqvv "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4412 cmdline: "C:\Windows\System32\sc.exe" start dkajlqvv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 4176 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 2056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1200 MD5: C31336C1EFC2CCB44B4326EA793040F2)

dpbgdjiw.exe (PID: 4892 cmdline: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d"C:\Users\user\Desktop\rXTqHar5Ud.exe" MD5: E30808D178C5406E7E08BAE69EC89233)

svchost.exe (PID: 5236 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 564 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 5164 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 3196 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2144 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4892 -ip 4892 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1036b:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10a13:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: rXTqHar5Ud.exe PID: 2532	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: dpbgdjiw.exe PID: 4892	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 5236	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.dpbgdjiw.exe.2c80e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.2c80e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.dpbgdjiw.exe.2ca0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.dpbgdjiw.exe.2ca0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.rXTqHar5Ud.exe.40c0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.rXTqHar5Ud.exe.40c0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
16.2.svchost.exe.3220000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.svchost.exe.3220000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.svchost.exe.3220000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rXTqHar5Ud.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rXTqHar5Ud.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rXTqHar5Ud.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rXTqHar5Ud.exe.40a0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rXTqHar5Ud.exe.40a0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
16.2.svchost.exe.3220000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.rXTqHar5Ud.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.2.svchost.exe.3220000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.rXTqHar5Ud.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
16.2.svchost.exe.3220000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.rXTqHar5Ud.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.dpbgdjiw.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.dpbgdjiw.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.dpbgdjiw.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.dpbgdjiw.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.dpbgdjiw.exe.2ce0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.dpbgdjiw.exe.2ce0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.2ce0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d"C:\Users\user\Desktop\rXTqHar5Ud.exe", ParentImage: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, ParentProcessId: 4892, ParentProcessName: dpbgdjiw.exe, ProcessCommandLine: svchost.exe, ProcessId: 5236, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rXTqHar5Ud.exe", ParentImage: C:\Users\user\Desktop\rXTqHar5Ud.exe, ParentProcessId: 2532, ParentProcessName: rXTqHar5Ud.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 6036, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 5236, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d"C:\Users\user\Desktop\rXTqHar5Ud.exe", ParentImage: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, ParentProcessId: 4892, ParentProcessName: dpbgdjiw.exe, ProcessCommandLine: svchost.exe, ProcessId: 5236, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 5236, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dkajlqvv

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rXTqHar5Ud.exe", ParentImage: C:\Users\user\Desktop\rXTqHar5Ud.exe, ParentProcessId: 2532, ParentProcessName: rXTqHar5Ud.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 6036, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 5164, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: rXTqHar5Ud.exe

Avira: detected

Antivirus detection for URL or domain

Source: vanaheim.cn:443	Avira URL Cloud: Label: phishing
Source: jotunheim.name:443	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Found malware configuration

Source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for submitted file

Source: rXTqHar5Ud.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: rXTqHar5Ud.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Unpacked PE file: 0.2.rXTqHar5Ud.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Unpacked PE file: 12.2.dpbgdjiw.exe.400000.0.unpack

Source: rXTqHar5Ud.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\dkajlqvv

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.110.27 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150
Source: Joe Sandbox View	IP Address: 98.136.96.74 98.136.96.74

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: URALTRANSCOM-ASUA URALTRANSCOM-ASUA
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU
Source: Joe Sandbox View	ASN Name: YAHOO-NE1US YAHOO-NE1US

Source: global traffic	TCP traffic: 192.168.2.6:49715 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 98.136.96.74:25
Source: global traffic	TCP traffic: 192.168.2.6:49724 -> 142.250.110.27:25
Source: global traffic	TCP traffic: 192.168.2.6:49728 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXTqHar5Ud.exe PID: 2532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dpbgdjiw.exe PID: 4892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5236, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.dpbgdjiw.exe.2c80e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.2c80e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.dpbgdjiw.exe.2ca0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.dpbgdjiw.exe.2ca0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\dkajlqvv\

Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_0322C913	16_2_0322C913

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: String function: 040A27AB appears 35 times
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532

Source: rXTqHar5Ud.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.dpbgdjiw.exe.2c80e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.2c80e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.dpbgdjiw.exe.2ca0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.dpbgdjiw.exe.2ca0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rXTqHar5Ud.exe.40a0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: classification engine

Classification label: mal100.troj.evad.winEXE@31/3@9/5

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_024CE399 CreateToolhelp32Snapshot,Module32First,

0_2_024CE399

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_03229A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_03229A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3196:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2144:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6320:120:WilError_03

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

File created: C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe

Jump to behavior

Source: rXTqHar5Ud.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rXTqHar5Ud.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

File read: C:\Users\user\Desktop\rXTqHar5Ud.exe

Jump to behavior

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_12-14680

Source: unknown	Process created: C:\Users\user\Desktop\rXTqHar5Ud.exe "C:\Users\user\Desktop\rXTqHar5Ud.exe"
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkajlqvv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe" C:\Windows\SysWOW64\dkajlqvv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description dkajlqvv "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dkajlqvv
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d"C:\Users\user\Desktop\rXTqHar5Ud.exe"
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4892 -ip 4892
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1200
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 564
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkajlqvv\	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe" C:\Windows\SysWOW64\dkajlqvv\	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description dkajlqvv "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dkajlqvv	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4892 -ip 4892	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 564	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1200	Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: rXTqHar5Ud.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Unpacked PE file: 0.2.rXTqHar5Ud.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Unpacked PE file: 12.2.dpbgdjiw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Unpacked PE file: 0.2.rXTqHar5Ud.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Unpacked PE file: 12.2.dpbgdjiw.exe.400000.0.unpack

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_024BE5B4 push eax; retf

0_2_024BE5B5

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	File created: C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe (copy)			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dkajlqvv

Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\rxtqhar5ud.exe

Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

16_2_0322199C

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-15072
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15785
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_16-7599

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_16-6133

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-15766
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_16-6412
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-14777

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-14530
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_0-14583
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_16-7414

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-14696
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-14360

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	API coverage: 5.4 %
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	API coverage: 3.9 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 6552	Thread sleep count: 38 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 6552	Thread sleep time: -38000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000010.00000002.3383067690.0000000003600000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_16-7659
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_0-15846

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_024CDC76 push dword ptr fs:[00000030h]	0_2_024CDC76
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_040A092B mov eax, dword ptr fs:[00000030h]	0_2_040A092B
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_040A0D90 mov eax, dword ptr fs:[00000030h]	0_2_040A0D90
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_0257831E push dword ptr fs:[00000030h]	12_2_0257831E
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_02C80D90 mov eax, dword ptr fs:[00000030h]	12_2_02C80D90
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_02C8092B mov eax, dword ptr fs:[00000030h]	12_2_02C8092B

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_03229A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	16_2_03229A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 98.136.96.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.58.54.132 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.110.27 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 3220000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3220000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3220000			Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3105008			Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkajlqvv\	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe" C:\Windows\SysWOW64\dkajlqvv\	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description dkajlqvv "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start dkajlqvv	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4892 -ip 4892	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 564	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1200	Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

0_2_00407809

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXTqHar5Ud.exe PID: 2532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dpbgdjiw.exe PID: 4892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5236, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.40a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.dpbgdjiw.exe.2ca0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.3220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rXTqHar5Ud.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2ce0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.dpbgdjiw.exe.2c80e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.rXTqHar5Ud.exe.40c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rXTqHar5Ud.exe PID: 2532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dpbgdjiw.exe PID: 4892, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5236, type: MEMORYSTR

Source: C:\Users\user\Desktop\rXTqHar5Ud.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 16_2_032288B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	16_2_032288B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	2 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
rXTqHar5Ud.exe	39%	ReversingLabs
rXTqHar5Ud.exe	100%	Avira	HEUR/AGEN.1310247
rXTqHar5Ud.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
vanaheim.cn:443	100%	Avira URL Cloud	phishing
jotunheim.name:443	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	217.69.139.150	true	true	unknown
mta5.am0.yahoodns.net	98.136.96.74	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	unknown
vanaheim.cn	195.58.54.132	true	true	unknown
smtp.google.com	142.250.110.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true	Avira URL Cloud: phishing	unknown
jotunheim.name:443	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
195.58.54.132	vanaheim.cn	Russian Federation	41082	URALTRANSCOM-ASUA	true
142.250.110.27	smtp.google.com	United States	15169	GOOGLEUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
98.136.96.74	mta5.am0.yahoodns.net	United States	36646	YAHOO-NE1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1516120
Start date and time:	2024-09-23 20:16:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rXTqHar5Ud.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@31/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 62 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.76.201.171, 20.70.246.20, 20.236.44.162, 20.231.239.246, 2.23.209.179, 2.23.209.187, 2.23.209.189, 2.23.209.149, 2.23.209.176, 2.23.209.133, 2.23.209.130, 2.23.209.177, 2.23.209.148
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: rXTqHar5Ud.exe

Simulations

Behavior and APIs

Time	Type	Description
14:17:53	API Interceptor	11x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
195.58.54.132	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse
195.58.54.132	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	Sm4Ty3Em4z.exe	Get hash	malicious	Tofsee	Browse
98.136.96.74	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	data.log.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	52.101.11.9
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
mta5.am0.yahoodns.net	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110
	file.exe	Get hash	malicious	Phorpiex	Browse	98.136.96.74
mxs.mail.ru	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
URALTRANSCOM-ASUA	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	195.58.54.132
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	195.58.54.132
	cQOoKCZyG3.elf	Get hash	malicious	Mirai	Browse	91.215.129.108
	09M6JXwjtO.elf	Get hash	malicious	Mirai	Browse	195.133.84.147
	Pb0GaINSjK.elf	Get hash	malicious	Mirai	Browse	194.87.3.81
	QN5PrDr5St.elf	Get hash	malicious	Unknown	Browse	195.133.84.180
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	91.215.129.145
	wsskM49eA3.elf	Get hash	malicious	Unknown	Browse	195.133.89.28
	quhEKAdhFU.elf	Get hash	malicious	Mirai	Browse	91.215.129.137
	5z7qDyLr2T.elf	Get hash	malicious	Mirai	Browse	91.215.129.142
MAILRU-ASMailRuRU	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	5.61.23.57
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
YAHOO-NE1US	Tsunami.arm.elf	Get hash	malicious	Mirai	Browse	98.137.87.86
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	.exe	Get hash	malicious	Unknown	Browse	98.136.96.76
	VvlYJBzLuW.elf	Get hash	malicious	Mirai	Browse	216.252.107.64
	rRBVVlBwia.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	setup.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	botx.arm.elf	Get hash	malicious	Mirai	Browse	98.138.56.151
MICROSOFT-CORP-MSN-AS-BLOCKUS	fhSD7cCQRW.htm	Get hash	malicious	Unknown	Browse	150.171.27.10
	0n25lfPJxD.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	40.114.114.106
	http://email.lndg.page/ls/click?upn=u001.IvLseMgsVhVvzUpwRiP-2FwHcYgYhC-2FGgyJ4SYlOmfnU0vpk3F-2FdnKwGEcikPNWl7AuE6IkZZ1A-2BFPEyDboqe-2B7Lj4-2FBLrURhM6P-2BVimmhP8ywtnU0tiSwJiHclGExadMkPbv31fArzKsBOdpDUi6FfV4X-2FXMq-2BLiUPVu9cZK2rUixRgPxeHjooE5ANKgz5LO2r1HvkRajramOrfuxyTj5F-2F9ha-2BAfwp8bzuwfnEGUXnAMft6NCcqA5FJmV8JfQ0-2FwKaMV_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FD59pf6KKODwP63UPLy27mgp-2FqTgdFleUsG4ygMdisVJJ0CDq1iL9Ljh5jCrVrbyQsE9Ko6GU4XMfNXGxlhkGjM5VU4HzKNBs1MjxGZ2qRKEJ-2F3V58K5D3LGyY1HE-2BVQpxmLTX1WQNHahobwGsL7GcnagwUjT9o0F5vg9CkCA30qw-3D-3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://forms.office.com/Pages/ShareFormPage.aspx?id=atlxJ-ZfTkmpiBz5GOrQZra6YH8IF9tJvDnK9FEosBRUNUoySTNMSlhENTkyTjRFS0pYUFBWREJDVS4u&sharetoken=VjI7W44Fh45blPkj2SeD	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://wanshaofu.top/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	ffa72d5-Cabinetworksgroup Inv23998.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://href.li/?https://0r2Ic.phydrimic.com/6bvcD/#	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://twwi.documentother.com/ihdLI	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://qfS.zephyrane.com/MFJysj7U/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	150.171.27.10
	https://app.powerbi.com/view?r=eyJrIjoiOWEwN2RmMjItNjhiOC00Njc0LTliM2MtNzdiNWRiOGVlMWIyIiwidCI6IjJkMTNkMGU4LTI1YjgtNDE2Yi04YzQ1LTVkZDU4MDgzYmVjZCJ9	Get hash	malicious	Unknown	Browse	20.201.88.210

Process:	C:\Users\user\Desktop\rXTqHar5Ud.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15208448
Entropy (8bit):	4.8330923320491594
Encrypted:	false
SSDEEP:	393216:8BSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSi:8
MD5:	E30808D178C5406E7E08BAE69EC89233
SHA1:	72D01320B4873C10F7BDAFC362CABB7A89A65FB5
SHA-256:	0DBF88CC067DA8BB92DD12274F6C81C660197D3E754AEF51319A2759F8127F4B
SHA-512:	F8BF96D71ADC683D67CF7046B047CB9E75B57E1968F8F946FA3D851ECAACC4151FAB6715FD7526BD1B5AC5A1FC9D38C4E971A90CB40EF8B98681B4FC8D10491E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............qb..qb..qb.....qb......qb.....qb.....qb..qc.eqb.....qb......qb......qb.Rich.qb.........................PE..L...f..e.............................(............@..................................\|..........................................x.......`...............................................................@...............4............................text............................... ..`.rdata..............................@..@.data...........^..................@....rsrc...`............J..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15208448
Entropy (8bit):	4.8330923320491594
Encrypted:	false
SSDEEP:	393216:8BSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSi:8
MD5:	E30808D178C5406E7E08BAE69EC89233
SHA1:	72D01320B4873C10F7BDAFC362CABB7A89A65FB5
SHA-256:	0DBF88CC067DA8BB92DD12274F6C81C660197D3E754AEF51319A2759F8127F4B
SHA-512:	F8BF96D71ADC683D67CF7046B047CB9E75B57E1968F8F946FA3D851ECAACC4151FAB6715FD7526BD1B5AC5A1FC9D38C4E971A90CB40EF8B98681B4FC8D10491E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............qb..qb..qb.....qb......qb.....qb.....qb..qc.eqb.....qb......qb......qb.Rich.qb.........................PE..L...f..e.............................(............@..................................\|..........................................x.......`...............................................................@...............4............................text............................... ..`.rdata..............................@..@.data...........^..................@....rsrc...`............J..............@..@................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.898855911967009
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rXTqHar5Ud.exe
File size:	406'528 bytes
MD5:	f403202fb853377ceb67200005ef95b8
SHA1:	1840e1495486209e92e5230cf1406f31a02699e7
SHA256:	3eebf917efa82ea7b81f37e9f8c98a702254c5f0a487667a72e78d53a61ce363
SHA512:	13b130d6f2ac8be444e16d4b1116812179d5043912a7aa24bd0d566eeecf4447be09fd54266dc12ff1902569d048c93a2d0c827abc135b0159f8156c18f9bf7a
SSDEEP:	6144:7BYOcLH6/xNtFxaS3DpwmEIey0bGWEbje2bkln5eOy8:76Ocb6/r/xv2GWaeaklQT8
TLSH:	0E846B5292E17C51E96ECF72CE2EC6E4773EB6508E69277E22389A3F04B1171C172721
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............qb..qb..qb......qb......qb......qb......qb..qc.eqb......qb......qb......qb.Rich.qb.........................PE..L...f..e...

File Icon


Icon Hash:	532945654955610d

Static PE Info

General

Entrypoint:	0x4028d3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x658D9166 [Thu Dec 28 15:16:54 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	986c435e506f58d0c12bcc8ade90d975

Entrypoint Preview

Instruction
call 00007F3F306EC12Bh
jmp 00007F3F306E8CFEh
int3
int3
int3
call 00007F3F306E8EACh
xchg cl, ch
jmp 00007F3F306E8E94h
call 00007F3F306E8EA3h
fxch st(0), st(1)
jmp 00007F3F306E8E8Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F3F306E8E81h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F3F306E8E76h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F3F306E8E74h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F3F306E8E77h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F3F306E949Fh
fstp st(0)
fld tbyte ptr [0040FBDAh]
ret
fstp st(0)
or cl, cl
je 00007F3F306E8E7Dh
fstp st(0)
fldpi
or ch, ch
je 00007F3F306E8E74h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F3F306E8E69h
fchs
ret
fstp st(0)
jmp 00007F3F306E9475h
fstp st(0)
mov cl, ch
jmp 00007F3F306E8E72h
call 00007F3F306E8E3Eh
jmp 00007F3F306E9480h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h
push ebx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3eb0c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x205c000	0x1e860	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3eb84	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3e688	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x234	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdefc	0xe000	b5df6ebc595a2803e0d7fb871e8ea275	False	0.6059221540178571	data	6.71489583929132	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x307d0	0x30800	fb50e53fb846b2e78cf1f96df3f70fdc	False	0.9405504993556701	data	7.8843085487433875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x201b1f0	0x5e00	d70e30c3b013fe773e07e0332aaaee8e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x205c000	0x1e860	0x1ea00	17c3c8dca0924acad8e2cda53ead6e40	False	0.4177853954081633	data	4.753377258268954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
NOLIF	0x20752e8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5879156423858196
NOLIF	0x20752e8	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5879156423858196
RT_CURSOR	0x2077158	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x2078000	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x20788a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x205c950	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.43523454157782515
RT_ICON	0x205c950	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.43523454157782515
RT_ICON	0x205d7f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5401624548736462
RT_ICON	0x205d7f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5401624548736462
RT_ICON	0x205e0a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6002304147465438
RT_ICON	0x205e0a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6002304147465438
RT_ICON	0x205e768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6705202312138728
RT_ICON	0x205e768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6705202312138728
RT_ICON	0x205ecd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.32987551867219916
RT_ICON	0x205ecd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.32987551867219916
RT_ICON	0x2061278	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.4047842401500938
RT_ICON	0x2061278	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.4047842401500938
RT_ICON	0x2062320	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.47008196721311474
RT_ICON	0x2062320	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.47008196721311474
RT_ICON	0x2062ca8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.5558510638297872
RT_ICON	0x2062ca8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.5558510638297872
RT_ICON	0x2063188	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.3664712153518124
RT_ICON	0x2063188	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.3664712153518124
RT_ICON	0x2064030	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.45306859205776173
RT_ICON	0x2064030	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.45306859205776173
RT_ICON	0x20648d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.45910138248847926
RT_ICON	0x20648d8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.45910138248847926
RT_ICON	0x2064fa0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.45664739884393063
RT_ICON	0x2064fa0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.45664739884393063
RT_ICON	0x2065508	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.26908713692946057
RT_ICON	0x2065508	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.26908713692946057
RT_ICON	0x2067ab0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.30417448405253283
RT_ICON	0x2067ab0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.30417448405253283
RT_ICON	0x2068b58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x2068b58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x2069028	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.56636460554371
RT_ICON	0x2069028	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.56636460554371
RT_ICON	0x2069ed0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5482851985559567
RT_ICON	0x2069ed0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5482851985559567
RT_ICON	0x206a778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6127167630057804
RT_ICON	0x206a778	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6127167630057804
RT_ICON	0x206ace0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.46141078838174276
RT_ICON	0x206ace0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.46141078838174276
RT_ICON	0x206d288	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.48944652908067543
RT_ICON	0x206d288	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.48944652908067543
RT_ICON	0x206e330	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4934426229508197
RT_ICON	0x206e330	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4934426229508197
RT_ICON	0x206ecb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4512411347517731
RT_ICON	0x206ecb8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4512411347517731
RT_ICON	0x206f188	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.4906716417910448
RT_ICON	0x206f188	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.4906716417910448
RT_ICON	0x2070030	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4720216606498195
RT_ICON	0x2070030	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4720216606498195
RT_ICON	0x20708d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.43858381502890176
RT_ICON	0x20708d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.43858381502890176
RT_ICON	0x2070e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2794605809128631
RT_ICON	0x2070e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2794605809128631
RT_ICON	0x20733e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2844746716697936
RT_ICON	0x20733e8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2844746716697936
RT_ICON	0x2074490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3086065573770492
RT_ICON	0x2074490	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3086065573770492
RT_ICON	0x2074e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3342198581560284
RT_ICON	0x2074e18	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3342198581560284
RT_STRING	0x2079098	0x430	data	Tamil	India	0.45615671641791045
RT_STRING	0x2079098	0x430	data	Tamil	Sri Lanka	0.45615671641791045
RT_STRING	0x20794c8	0x7cc	data	Tamil	India	0.4168336673346693
RT_STRING	0x20794c8	0x7cc	data	Tamil	Sri Lanka	0.4168336673346693
RT_STRING	0x2079c98	0x220	data	Tamil	India	0.5
RT_STRING	0x2079c98	0x220	data	Tamil	Sri Lanka	0.5
RT_STRING	0x2079eb8	0x5e6	data	Tamil	India	0.43178807947019865
RT_STRING	0x2079eb8	0x5e6	data	Tamil	Sri Lanka	0.43178807947019865
RT_STRING	0x207a4a0	0x3c0	data	Tamil	India	0.4479166666666667
RT_STRING	0x207a4a0	0x3c0	data	Tamil	Sri Lanka	0.4479166666666667
RT_ACCELERATOR	0x2077120	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x2077120	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x2078e10	0x30	data			0.9375
RT_GROUP_ICON	0x206f120	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x206f120	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2063110	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2063110	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_GROUP_ICON	0x2068fc0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x2068fc0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2075280	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x2075280	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_VERSION	0x2078e40	0x258	data			0.5433333333333333

Imports

DLL	Import
KERNEL32.dll	GetCurrentProcess, GetLogicalDriveStringsW, SetComputerNameW, CreateHardLinkA, GetModuleHandleW, CreateNamedPipeW, EnumCalendarInfoExW, FindNextVolumeMountPointA, GetNumberFormatA, GetConsoleAliasExesW, TlsSetValue, LoadLibraryW, GetLocaleInfoW, GetCalendarInfoW, CreateEventA, SetVolumeMountPointA, GetFileAttributesA, EnumSystemCodePagesA, GetTimeFormatW, GetModuleFileNameW, CreateActCtxA, SetThreadPriority, GetTempPathW, CreateJobObjectA, VerifyVersionInfoW, GlobalUnfix, GetLastError, GetCurrentDirectoryW, GetProcAddress, GetLongPathNameA, PeekConsoleInputW, GetConsoleDisplayMode, LoadModule, GlobalFree, InterlockedDecrement, LoadLibraryA, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, GetFileType, FoldStringW, SetEnvironmentVariableA, EnumDateFormatsA, GlobalUnWire, GetProcessShutdownParameters, LoadLibraryExA, GetFileTime, WaitForDebugEvent, OpenEventW, GetShortPathNameW, SetFileShortNameA, GetVersionExA, GetDiskFreeSpaceExW, GetWindowsDirectoryW, LCMapStringW, CommConfigDialogW, GetStringTypeW, ReadFile, GetProcessHeap, MultiByteToWideChar, WriteConsoleW, RaiseException, FlushFileBuffers, SetDefaultCommConfigA, GetCommState, EnumCalendarInfoW, InterlockedIncrement, GetConsoleAliasExesLengthA, SetEndOfFile, GetProcessVersion, SetStdHandle, IsValidCodePage, GetOEMCP, GetACP, HeapAlloc, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, ExitProcess, WriteFile, HeapCreate, Sleep, HeapSize, RtlUnwind, HeapFree, SetFilePointer, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsFree, SetLastError, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, CloseHandle, CreateFileA, GetCPInfo, CreateFileW
USER32.dll	DrawStateA, LoadMenuA, CharUpperA, InsertMenuItemW, SetCaretPos, GetMenu, LoadMenuW, GetWindowLongW, GetSysColor, GetMenuStringA
GDI32.dll	GetTextCharset, GetCharWidthI, GetBkMode, GetCharWidthFloatA, CreateDCA, GetCharWidth32W
WINHTTP.dll	WinHttpCloseHandle
MSIMG32.dll	GradientFill

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 20:17:12.660625935 CEST	49715	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:17:13.663608074 CEST	49715	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:17:15.411709070 CEST	49716	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:15.411767960 CEST	443	49716	195.58.54.132	192.168.2.6
Sep 23, 2024 20:17:15.411835909 CEST	49716	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:15.663686037 CEST	49715	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:17:19.679317951 CEST	49715	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:17:27.679271936 CEST	49715	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:17:32.681052923 CEST	49721	25	192.168.2.6	98.136.96.74
Sep 23, 2024 20:17:33.694889069 CEST	49721	25	192.168.2.6	98.136.96.74
Sep 23, 2024 20:17:35.694920063 CEST	49721	25	192.168.2.6	98.136.96.74
Sep 23, 2024 20:17:39.710608959 CEST	49721	25	192.168.2.6	98.136.96.74
Sep 23, 2024 20:17:47.710609913 CEST	49721	25	192.168.2.6	98.136.96.74
Sep 23, 2024 20:17:52.712769985 CEST	49724	25	192.168.2.6	142.250.110.27
Sep 23, 2024 20:17:53.726178885 CEST	49724	25	192.168.2.6	142.250.110.27
Sep 23, 2024 20:17:55.413856983 CEST	49716	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:55.413954973 CEST	443	49716	195.58.54.132	192.168.2.6
Sep 23, 2024 20:17:55.414005041 CEST	49716	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:55.524060011 CEST	49726	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:55.524101973 CEST	443	49726	195.58.54.132	192.168.2.6
Sep 23, 2024 20:17:55.524194956 CEST	49726	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:17:55.741816998 CEST	49724	25	192.168.2.6	142.250.110.27
Sep 23, 2024 20:17:59.757565975 CEST	49724	25	192.168.2.6	142.250.110.27
Sep 23, 2024 20:18:07.757518053 CEST	49724	25	192.168.2.6	142.250.110.27
Sep 23, 2024 20:18:12.727726936 CEST	49728	25	192.168.2.6	217.69.139.150
Sep 23, 2024 20:18:13.741898060 CEST	49728	25	192.168.2.6	217.69.139.150
Sep 23, 2024 20:18:15.741905928 CEST	49728	25	192.168.2.6	217.69.139.150
Sep 23, 2024 20:18:19.757509947 CEST	49728	25	192.168.2.6	217.69.139.150
Sep 23, 2024 20:18:27.773093939 CEST	49728	25	192.168.2.6	217.69.139.150
Sep 23, 2024 20:18:35.538814068 CEST	49726	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:18:35.538896084 CEST	443	49726	195.58.54.132	192.168.2.6
Sep 23, 2024 20:18:35.538960934 CEST	49726	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:18:35.648921013 CEST	49730	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:18:35.649023056 CEST	443	49730	195.58.54.132	192.168.2.6
Sep 23, 2024 20:18:35.649183989 CEST	49730	443	192.168.2.6	195.58.54.132
Sep 23, 2024 20:19:13.288167953 CEST	49733	25	192.168.2.6	52.101.11.0
Sep 23, 2024 20:19:14.288784027 CEST	49733	25	192.168.2.6	52.101.11.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 20:17:12.388784885 CEST	55770	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:12.659671068 CEST	53	55770	1.1.1.1	192.168.2.6
Sep 23, 2024 20:17:15.290523052 CEST	63427	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:15.410991907 CEST	53	63427	1.1.1.1	192.168.2.6
Sep 23, 2024 20:17:32.664135933 CEST	57555	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:32.671399117 CEST	53	57555	1.1.1.1	192.168.2.6
Sep 23, 2024 20:17:32.672019958 CEST	58950	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:32.680217981 CEST	53	58950	1.1.1.1	192.168.2.6
Sep 23, 2024 20:17:52.695506096 CEST	59617	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:52.704253912 CEST	53	59617	1.1.1.1	192.168.2.6
Sep 23, 2024 20:17:52.704848051 CEST	54970	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:17:52.712265015 CEST	53	54970	1.1.1.1	192.168.2.6
Sep 23, 2024 20:18:12.711414099 CEST	52829	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:18:12.718822956 CEST	53	52829	1.1.1.1	192.168.2.6
Sep 23, 2024 20:18:12.719695091 CEST	57427	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:18:12.727164030 CEST	53	57427	1.1.1.1	192.168.2.6
Sep 23, 2024 20:19:13.254934072 CEST	54947	53	192.168.2.6	1.1.1.1
Sep 23, 2024 20:19:13.286005974 CEST	53	54947	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 23, 2024 20:17:12.388784885 CEST	192.168.2.6	1.1.1.1	0x50c6	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:15.290523052 CEST	192.168.2.6	1.1.1.1	0x2ea3	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.664135933 CEST	192.168.2.6	1.1.1.1	0x5cb5	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:32.672019958 CEST	192.168.2.6	1.1.1.1	0x3565	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.695506096 CEST	192.168.2.6	1.1.1.1	0x88d5	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:52.704848051 CEST	192.168.2.6	1.1.1.1	0x6836	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:18:12.711414099 CEST	192.168.2.6	1.1.1.1	0xf757	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:18:12.719695091 CEST	192.168.2.6	1.1.1.1	0x77cd	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:19:13.254934072 CEST	192.168.2.6	1.1.1.1	0x44d1	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 23, 2024 20:17:12.659671068 CEST	1.1.1.1	192.168.2.6	0x50c6	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:12.659671068 CEST	1.1.1.1	192.168.2.6	0x50c6	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:12.659671068 CEST	1.1.1.1	192.168.2.6	0x50c6	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:12.659671068 CEST	1.1.1.1	192.168.2.6	0x50c6	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:15.410991907 CEST	1.1.1.1	192.168.2.6	0x2ea3	No error (0)	vanaheim.cn	195.58.54.132	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.671399117 CEST	1.1.1.1	192.168.2.6	0x5cb5	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:32.671399117 CEST	1.1.1.1	192.168.2.6	0x5cb5	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:32.671399117 CEST	1.1.1.1	192.168.2.6	0x5cb5	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:32.680217981 CEST	1.1.1.1	192.168.2.6	0x3565	No error (0)	mta5.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.704253912 CEST	1.1.1.1	192.168.2.6	0x88d5	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:17:52.712265015 CEST	1.1.1.1	192.168.2.6	0x6836	No error (0)	smtp.google.com	142.250.110.27	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.712265015 CEST	1.1.1.1	192.168.2.6	0x6836	No error (0)	smtp.google.com	66.102.1.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.712265015 CEST	1.1.1.1	192.168.2.6	0x6836	No error (0)	smtp.google.com	66.102.1.27	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.712265015 CEST	1.1.1.1	192.168.2.6	0x6836	No error (0)	smtp.google.com	142.250.110.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:17:52.712265015 CEST	1.1.1.1	192.168.2.6	0x6836	No error (0)	smtp.google.com	173.194.76.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:18:12.718822956 CEST	1.1.1.1	192.168.2.6	0xf757	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Sep 23, 2024 20:18:12.727164030 CEST	1.1.1.1	192.168.2.6	0x77cd	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:18:12.727164030 CEST	1.1.1.1	192.168.2.6	0x77cd	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:19:13.286005974 CEST	1.1.1.1	192.168.2.6	0x44d1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:19:13.286005974 CEST	1.1.1.1	192.168.2.6	0x44d1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:19:13.286005974 CEST	1.1.1.1	192.168.2.6	0x44d1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Sep 23, 2024 20:19:13.286005974 CEST	1.1.1.1	192.168.2.6	0x44d1	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:17:05
Start date:	23/09/2024
Path:	C:\Users\user\Desktop\rXTqHar5Ud.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rXTqHar5Ud.exe"
Imagebase:	0x400000
File size:	406'528 bytes
MD5 hash:	F403202FB853377CEB67200005EF95B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2127342938.00000000040C0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:17:06
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dkajlqvv\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:17:06
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:17:06
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe" C:\Windows\SysWOW64\dkajlqvv\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:17:06
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:17:07
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create dkajlqvv binPath= "C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d\"C:\Users\user\Desktop\rXTqHar5Ud.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:17:07
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:17:07
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description dkajlqvv "wifi internet conection"
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:17:07
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:17:08
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start dkajlqvv
Imagebase:	0xee0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:17:08
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:17:08
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe /d"C:\Users\user\Desktop\rXTqHar5Ud.exe"
Imagebase:	0x400000
File size:	15'208'448 bytes
MD5 hash:	E30808D178C5406E7E08BAE69EC89233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2174434288.0000000002CE0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2167679772.0000000002CA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x960000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2532 -ip 2532
Imagebase:	0xb60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:17:09
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4892 -ip 4892
Imagebase:	0xb60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:17:10
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1200
Imagebase:	0xb60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:17:10
Start date:	23/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 564
Imagebase:	0xb60000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	4.1%
Signature Coverage:	26.3%
Total number of Nodes:	1505
Total number of Limit Nodes:	17

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

%X%08X, xrefs: 0040A0B0
P, xrefs: 00409DAA
", xrefs: 0040A189
", xrefs: 00409EDB
", xrefs: 0040A078
D, xrefs: 00409F8E
\, xrefs: 00409D0C
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 024CE399 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 024CE3C1
Module32First.KERNEL32(00000000,00000224), ref: 024CE3E1

Memory Dump Source

Source File: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ec452be82afc36b232cf059265832c9cd0b2df4c947c303ff16d95b6911a6eba
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: DAF062392007146BE7602AF9988DB6B76E8AF49625F20152EE647D21D0DBF0F8454A61

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F
", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 040A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 040A024D

Strings

kernel32.dll, xrefs: 040A008F, 040A0095
cess, xrefs: 040A018D

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c4baa1a36c1c88623e039b4033ffd85db8839454ea71c4ae51a53c35e0e006b6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2E526B74A01229DFDB64CFA8C984BACBBB1BF09304F1480D9E54DAB351DB30AA95DF15

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 040A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,040A0223,?,?), ref: 040A0E19
SetErrorMode.KERNELBASE(00000000,?,?,040A0223,?,?), ref: 040A0E1E

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: aa8218d920a278acd49a8db63b1ae2b83c19079fa7ae511ab9695a0ffe455710
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E5D0123114512C77DB402ED4DC09BCD7B5CDF09B62F008011FB0DE9080C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 024CE058 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 024CE0A9

Memory Dump Source

Source File: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 291bcedeae03a2eb77a018646de168a01b7dedaf746735bddb3311b58a0fb23c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 66113C79A00208EFDB01DF99C985E99BBF5AF08351F1580A5FA489B361D371EA50DF80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

srv_time, xrefs: 0040CABB
flags_upd, xrefs: 0040CE4A
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
wtm_w, xrefs: 0040C96C
lid_file_upd, xrefs: 0040CE6A
.sys, xrefs: 0040D0CC
\, xrefs: 0040D3A7
wtm_r, xrefs: 0040C97F
4, xrefs: 0040D9F7
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
local_time, xrefs: 0040CACD
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
wtm_c, xrefs: 0040C956
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
drivers\, xrefs: 0040D067
@, xrefs: 0040D754
\, xrefs: 0040D39D

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationThread, xrefs: 00401155
RtlNtStatusToDosError, xrefs: 00401194
ntdll.dll, xrefs: 0040100D
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
RtlInitUnicodeString, xrefs: 00401135
NtQueryInformationToken, xrefs: 00401262
NtOpenProcessToken, xrefs: 004011D4
NtDuplicateToken, xrefs: 004011F3
NtClose, xrefs: 004011B4
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Mon, xrefs: 0040B22C
Fri, xrefs: 0040B248
Aug, xrefs: 0040B287
Jun, xrefs: 0040B279
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Sun, xrefs: 0040B225
Feb, xrefs: 0040B25D
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Jan, xrefs: 0040B256
May, xrefs: 0040B272
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E
Tue, xrefs: 0040B233
Dec, xrefs: 0040B2A3
Wed, xrefs: 0040B23A
Jul, xrefs: 0040B280
Apr, xrefs: 0040B26B
Sat, xrefs: 0040B24F
Thu, xrefs: 0040B241

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
D, xrefs: 004015C6
@, xrefs: 00401380
, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
<, xrefs: 00401378

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

IsWow64Process, xrefs: 00401DF2
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
born_date, xrefs: 00401EAD, 00401ECC
lid_file_upd, xrefs: 00401E25
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
loader_id, xrefs: 00401F4B, 00401F6B
kernel32, xrefs: 00401DF7
net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 040A65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 040A65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 040A6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 040A6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 040A6652

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 43a975dfa60250de319b7f71bb5c5e4c861be54be4288b4525b037cf1522fdfa
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: E611A371600218BFEB619FB5DC05F9B3FB8EB057A9F044424FA09E7250D7B2ED1086A4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 040A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 040A0966
GetProcAddress., xrefs: 040A09DC, 040A09DF, 040A09E4
., xrefs: 040A095F

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: a82863a47a7ee32a9593f35e3836f8bcdee46c17d62b6d218b556de78f494dec
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: AA3139B6910609DFEB10CF99C884AAEBBF5FF48328F15404AD541BB210D771FA55CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 024CDC76 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174520005.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 532cf22512788b0f98e154439420d282e30f865b5328758a848e5b646e45ced1
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 92118276740100DFD744DF59DCC0EA673EAFB89320B29806AED09CB351D6B5E842C760

Function 040A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 27bfe31bfb35ad12db8d1555e65b8e29a56a6146f1affa9217d62723929b1f3d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 2E01DB776016088FDF21CFA4C804BAA33F5FB86315F4544B5E506E7241E774B941CB90

Function 040A9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 040A9E6D
lstrcpy.KERNEL32(?,00000000), ref: 040A9FE1
lstrcat.KERNEL32(?,?), ref: 040A9FF2
lstrcat.KERNEL32(?,0041070C), ref: 040AA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 040AA054
DeleteFileA.KERNEL32(?), ref: 040AA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 040AA0D6
lstrcpy.KERNEL32 ref: 040AA12F
lstrlen.KERNEL32(00000022), ref: 040AA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 040A9F13

Part of subcall function 040A7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 040A7081

Part of subcall function 040A6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\mtjsuzee,040A7043), ref: 040A6F4E
Part of subcall function 040A6F30: GetProcAddress.KERNEL32(00000000), ref: 040A6F55
Part of subcall function 040A6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 040A6F7B
Part of subcall function 040A6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 040A6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 040AA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 040AA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 040AA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 040AA21B
GetDriveTypeA.KERNEL32(?), ref: 040AA265
lstrcat.KERNEL32(?,00000000), ref: 040AA29F
lstrcat.KERNEL32(?,00410A34), ref: 040AA2C5
lstrcat.KERNEL32(?,00000022), ref: 040AA2D9
lstrcat.KERNEL32(?,00410A34), ref: 040AA2F4
wsprintfA.USER32 ref: 040AA31D
lstrcat.KERNEL32(?,00000000), ref: 040AA345
lstrcat.KERNEL32(?,?), ref: 040AA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 040AA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 040AA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 040AA1D1

Part of subcall function 040A9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 040A999D
Part of subcall function 040A9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 040A99BD
Part of subcall function 040A9966: RegCloseKey.ADVAPI32(?), ref: 040A99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 040AA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 040AA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 040AA41D

Strings

D, xrefs: 040AA1F5
", xrefs: 040AA3F0
", xrefs: 040AA2DF
P, xrefs: 040AA011
", xrefs: 040AA142
\, xrefs: 040A9F73

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 1ce395d4448e1cb05f0ab651d1e8333ac623301787928a6566b97caccf64e3a4
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: BCF12EB1D40259AFDF61DBE08C48EEF7BBCAB08304F0484A6E605F2141E775AA95CF65

Function 040A7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 040A7D21
GetUserNameA.ADVAPI32(?,?), ref: 040A7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040A7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 040A7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 040A7DC0
EqualSid.ADVAPI32(?,?), ref: 040A7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 040A7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040A7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 040A7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 040A7E12
LocalFree.KERNEL32(00000000), ref: 040A7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 040A7E35

Strings

PromptOnSecureDesktop, xrefs: 040A7FA0
D, xrefs: 040A7D73

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 955980c3ded740255677abdb136ec4b48f1cf94de033d0485eca69849eb8def5
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: A8A14A72900219AFDB51DFA0DD88FEEBBB9FB08304F04806AE505F6150D775EA95CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
12:08:32, xrefs: 00406535
Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
plgs:, xrefs: 004066AA
except_info, xrefs: 00406728

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

rcpt to:<%s>, xrefs: 0040A855
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
Too small respons, xrefs: 0040A9C9
helo %s, xrefs: 0040A803
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 040A7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 040A7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040A7ACD
GetLengthSid.ADVAPI32(?), ref: 040A7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 040A7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 040A7B1F
EqualSid.ADVAPI32(?,?), ref: 040A7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 040A7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040A7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 040A7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 040A7B77
LocalFree.KERNEL32(00000000), ref: 040A7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 040A7B9A
GetAce.ADVAPI32(?,?,?), ref: 040A7BCA
EqualSid.ADVAPI32(?,?), ref: 040A7BF1
DeleteAce.ADVAPI32(?,?), ref: 040A7C0A
EqualSid.ADVAPI32(?,?), ref: 040A7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 040A7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 040A7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 040A7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 040A7CE0
LocalFree.KERNEL32(00000000), ref: 040A7CEE

Strings

D, xrefs: 040A7AC3

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 4c9818e8546395ba27227307fa84ee12635259e6baa82b505ce7d27c186bfe6d
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: FC813A71910219ABDB21CFE4DD88FEEBBB8AF08304F04816AE605F7150D775EA55CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 040A858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 040A865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 040A867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 040A86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 040A86B1

Strings

", xrefs: 040A896C
PromptOnSecureDesktop, xrefs: 040A85B6, 040A8645, 040A86BD, 040A8708, 040A87C5, 040A8812, 040A88E9, 040A8905

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: c68a3eca156d2a109fbf70bd8d44ed363994997d268d0e4c4cf98ed964238bd5
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: A4C193B2940109BEFB51EBE4DD84EEF7BBDEB04344F148465F604F6050EB70AAA48B65

Function 040A14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 040A1601
lstrlenW.KERNEL32(-00000003), ref: 040A17D8

Strings

D, xrefs: 040A182D
@, xrefs: 040A15E7
, xrefs: 040A16C9
<, xrefs: 040A15DF

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: f59bd094d4bda4c31565db7254f6f54cf26bf94e03ad2349103b18cc25510632
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: FEF17EB55083419FD720DFA4C888BABB7F5FB89304F00892DF596AB290D7B4E944CB56

Function 040A7666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 040A76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 040A7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 040A778F
___ascii_stricmp.LIBCMT ref: 040A78B4
RegCloseKey.ADVAPI32(?), ref: 040A794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 040A796D
RegCloseKey.ADVAPI32(?), ref: 040A797E
RegCloseKey.ADVAPI32(?), ref: 040A79AC
RegCloseKey.ADVAPI32(?), ref: 040A7A56

Part of subcall function 040AF40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,040A772A,?), ref: 040AF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 040A79F6
RegCloseKey.ADVAPI32(?), ref: 040A7A4D

Strings

PromptOnSecureDesktop, xrefs: 040A76C5, 040A76CA, 040A76E5, 040A7782, 040A77E6, 040A7862, 040A787B, 040A79C2
", xrefs: 040A7800

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 0ee7d44abeaf7184e0c47246a03695aa6e80c904efbf3105d767abfe8f8a20cf
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 1FC1B272900109ABEB11DFE4DC44FEE7BF9EB45314F1480A6E504F7150EB75EAA48B61

Function 040A2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 040A2CED
socket.WS2_32(00000002,00000002,00000011), ref: 040A2D07
htons.WS2_32(00000000), ref: 040A2D42
select.WS2_32 ref: 040A2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 040A2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 040A2E62

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 27eb83bcdb58d3029538719261c8e25cccdb495376c0309d6c0cd46c1679e81a
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3461F571504305AFC320EFA0DC48BABBBE8FB44745F0048BDF945A7251D7B5E8909BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 040A958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 040A95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 040A95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 040A95DC
wsprintfA.USER32 ref: 040A9635
wsprintfA.USER32 ref: 040A9673
wsprintfA.USER32 ref: 040A96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 040A9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 040A978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 040A97D8

Strings

PromptOnSecureDesktop, xrefs: 040A9604, 040A9624, 040A9662, 040A9683, 040A96B6, 040A96DF, 040A9701, 040A9734, 040A9780, 040A97B7

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: fa488a19595d54aa6c423302a0e268b014ba2fbd40e41f52b05d027465d6d692
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: D9A15DB1A00208AFEB21DFE0CC85FDE3BACEB44745F104426FA15A6151E7B5E5A48FA5

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2
%TO_DOMAIN, xrefs: 0040B44B
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%s@%s, xrefs: 0040B461
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_HASH, xrefs: 0040B4B0

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 040A1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 040A202D
GetSystemInfo.KERNEL32(?), ref: 040A204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 040A206A
GetProcAddress.KERNEL32(00000000), ref: 040A2071
GetCurrentProcess.KERNEL32(?), ref: 040A2082
GetTickCount.KERNEL32 ref: 040A2230

Part of subcall function 040A1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 040A1E7C

Strings

hi_id, xrefs: 040A217D, 040A2182, 040A219A
work_srv, xrefs: 040A20C5
flags_upd, xrefs: 040A20A5, 040A20AA, 040A20E3
localcfg, xrefs: 040A2091, 040A2098, 040A20AB, 040A20E4, 040A20F3, 040A2119, 040A2138, 040A214E, 040A2166, 040A2183, 040A219B, 040A21B7, 040A21D7

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: a521226c572fa628be88de15e0042dbdd645aa3d083bdfff3460a1079582d631
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 5551B570540344AFE320AFA58C89FA77AECEF5470CF00492DF996A2242D7B9B56487A5

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 040A3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 040A3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 040A3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 040A3095
RtlAllocateHeap.NTDLL(00000000), ref: 040A30B6
htons.WS2_32(00000035), ref: 040A30EF
inet_addr.WS2_32(?), ref: 040A30FA
gethostbyname.WS2_32(?), ref: 040A310D
HeapFree.KERNEL32(00000000), ref: 040A314D

Strings

iphlpapi.dll, xrefs: 040A3062, 040A3067, 040A3077

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 52e3541e3b0da4298ffe0ac6180ee1305a3249f5578aea5d194d44462416a299
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: B831B631A00606ABDB519FF89C4CAAE7BF8EF44760F144125ED18F7290DB74E5918B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 040A6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 040A67C3
htonl.WS2_32(?), ref: 040A67DF
htonl.WS2_32(?), ref: 040A67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 040A68F1
ExitProcess.KERNEL32 ref: 040A69BC

Strings

localcfg, xrefs: 040A6994
except_info, xrefs: 040A698F

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: f0bb42b0f64f5a56733657322c43ff760e5e8ae69b6da49046b6768909a820a2
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: E0618E71A40208AFDB609FB4DC45FEA77F9FB08300F148466FA6DD2161EA75A9908F54

Function 040AF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(040ACC84), ref: 040AF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 040AF5CE
closesocket.WS2_32(00000000), ref: 040AF5DC

Strings

time_cfg, xrefs: 040AF58A

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 5253061560573a1845e4d07815e0a7e59406755da87540691d40e7d894d338d9
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: C1317A7290011AABDB10DFB5DC88DEE7BBCEF88354F104566FA05E3150E770AA918BE5

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 040A2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 040A2FA1
LoadLibraryA.KERNEL32(?), ref: 040A2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 040A2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 040A3000
RtlAllocateHeap.NTDLL(00000000), ref: 040A3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 040A3032

Strings

dnsapi.dll, xrefs: 040A2F90

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 64f29e698faffc982f8f18361045497b47b7978b37ea70190280a230fa17ece0
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: DB219271900229BBCB219F94DC44DEEBBB8EF08B10F008475F901F7240D7B4AA9197D4

Function 040A6F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\mtjsuzee,040A7043), ref: 040A6F4E
GetProcAddress.KERNEL32(00000000), ref: 040A6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 040A6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 040A6F92

Strings

C:\Windows\SysWOW64\, xrefs: 040A6F30, 040A6F38, 040A6F65, 040A6F6C, 040A6F7A, 040A6F85, 040A6F91, 040A6FA9, 040A6FC6, 040A6FEC
\\.\pipe\mtjsuzee, xrefs: 040A6F37
PromptOnSecureDesktop, xrefs: 040A6F9D, 040A6FBF, 040A6FCF, 040A6FE5, 040A6FF5

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\mtjsuzee
API String ID: 1082366364-4095895868
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 2bde7e9390c4460f3c422a05f445ad80fc39888ba5a0ea9ac9f1d9b459361e1d
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 982101217403407EF76257B19C8CFFB2E9C8B52768F1C80A5F544F6181DADAA4F682AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 040A92CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 040A92E2
wsprintfA.USER32 ref: 040A9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 040A9375
lstrlen.KERNEL32(?,?,00000000), ref: 040A9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 040A9394
CloseHandle.KERNEL32(00000000), ref: 040A939B

Strings

PromptOnSecureDesktop, xrefs: 040A932B, 040A9343, 040A935E

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 1078254d5ca57d04f414ede1aabe4c7d51d38b9bef400473272314dd44e7860c
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 401184B27401147BF7206772EC0DFEF3A6DDBC8B18F00C065BB09F5091EAB55A5196A4

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 040A99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 040A9A18
GetThreadContext.KERNEL32(?,?), ref: 040A9A52
TerminateProcess.KERNEL32(?,00000000), ref: 040A9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 040A9A98
SetThreadContext.KERNEL32(?,00010002), ref: 040A9AB5
ResumeThread.KERNEL32(?), ref: 040A9AC2

Strings

D, xrefs: 040A9A10

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: d3c42ce4ec5c6cff300b515c05d2f0e2134698ba4993e92a09e75b5dfeb3815a
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 8A216BB1A01219BBDB119BE1DC08EEF7BBCEF04754F004461BA09F1050E7759A50CBA4

Function 040A1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 040A1C18
LoadLibraryA.KERNEL32(004102C8), ref: 040A1C26
GetProcessHeap.KERNEL32 ref: 040A1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 040A1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 040A1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 040A1D02
FreeLibrary.KERNEL32(?), ref: 040A1D0B

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 530a7b60ad9dc9f14495406d8fca213f49ef52538654e3ddd85ba73ba7f7a216
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: BB315832E00219BFCB519FE4DC888EEBAB9EB49301F24447AE501BA110D7B55E90DB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 040A6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 040A6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 040A6D22
GetLastError.KERNEL32 ref: 040A6DA7
CloseHandle.KERNEL32(?), ref: 040A6DB5
GetLastError.KERNEL32 ref: 040A6DD6
DeleteFileA.KERNEL32(?), ref: 040A6DE7
GetLastError.KERNEL32 ref: 040A6DFD

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 2ad32dc9023fe25916e0a1f02812a3ef1c3c175e0fe5dbc4f69706362a2b44c8
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: E6312572D00149BFDB00DFE4DD44ADE7FB8EB48344F088465E291F7250E772A5658B61

Function 040A93AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 040A93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 040A93CD
CharToOemA.USER32(?,?), ref: 040A93DB
wsprintfA.USER32 ref: 040A9410

Part of subcall function 040A92CB: GetTempPathA.KERNEL32(00000400,?), ref: 040A92E2
Part of subcall function 040A92CB: wsprintfA.USER32 ref: 040A9350
Part of subcall function 040A92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 040A9375
Part of subcall function 040A92CB: lstrlen.KERNEL32(?,?,00000000), ref: 040A9389
Part of subcall function 040A92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 040A9394
Part of subcall function 040A92CB: CloseHandle.KERNEL32(00000000), ref: 040A939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 040A9448

Strings

PromptOnSecureDesktop, xrefs: 040A93FA, 040A93FF, 040A941C

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: a893474926c7db8513d8d1b99685b39b64c0b7f48a75b689af3ac84da8fbc604
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: F90152F69001187BE721A7A19D89EDF377CDB95705F0040A1BB49F2080DAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 040AAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 040AAAE5

Strings

, xrefs: 040AABB3
localcfg, xrefs: 040AAD72

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 45d49bf0fa709b51dd9a6e9b4d359e2c1b062a2c536cda1f4626eee32201f501
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 56713971B10304AAEF718BD4DC85FEE37A9AB40309F244026F946B60D1DBA6B5B4CF65

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 040AE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040ADF6C: GetCurrentThreadId.KERNEL32 ref: 040ADFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 040AE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,040A6128), ref: 040AE950
lstrcmp.KERNEL32(?,00000008), ref: 040AE989

Strings

A, xrefs: 040AE8C6, 040AE8CD, 040AE936, 040AE998
A, xrefs: 040AE960, 040AE965
A, xrefs: 040AE9A0

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 1dfae623eba7f7103d4b6d36a1f69d8808136004605a4f60af2ed950b7a4b852
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 9031AD31640705DBDFB1CFA4C884BAA7BE4EF05724F00892AE595A7551E370F8A4CBD2

Function 040A6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 040A6E19

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: bd8598cd039ea67343e79682b2530bc5c70b67d0165614f5b41b672e6f1dc345
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 4A214D76204115FFDB10EBB0EC48EDF7FBDDB49264B148825F542E1091EB72AA5096B4

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 040AC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 040AC6B4
InterlockedIncrement.KERNEL32(040AC74B), ref: 040AC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,040AC747), ref: 040AC728
CloseHandle.KERNEL32(00000000,?,040AC747,00413588,040A8A77), ref: 040AC733

Strings

localcfg, xrefs: 040AC544

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 4e77356e77407582b0edc10f1384e15bddaf3cbd3004eb0c642953e40c7bb388
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 2251ACB1A04B418FE764CFB9C58462ABBE8FB48304B55593EE18BD7A90D774F850CB10

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 040AE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,040AE50A,00000000,00000000,00000000,00020106,00000000,040AE50A,00000000,000000E4), ref: 040AE319
RegSetValueExA.ADVAPI32(040AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040AE38E
RegDeleteValueA.ADVAPI32(040AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040AE3BF
RegCloseKey.ADVAPI32(040AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,040AE50A), ref: 040AE3C8

Strings

PromptOnSecureDesktop, xrefs: 040AE33A

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 617023ed2fc54c8a2774aa51fd004cd0bc850c348921dea723526904b60630fc
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: E3216172A4021DBBDF209FE5EC89EDE7FB9EF08754F008061F908E6150E2719A64D790

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 040A71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 040A71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 040A7228
LocalFree.KERNEL32(?,?,?), ref: 040A7286
wsprintfA.USER32 ref: 040A729D

Strings

|, xrefs: 040A721A

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 13fb223c80973a8bb85251e493ae023b4fc743862a91f6c87c0fb79a76cef4cb
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 8F314D72A00109BFDB41DFE8DC48ADA3BECEF04358F14C066F959DB100EA75E6588B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 040AB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 040AB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 040AB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 040AB548
GetTimeZoneInformation.KERNEL32(?), ref: 040AB590
wsprintfA.USER32 ref: 040AB61E

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 58df86b7cf16c0a8cf5697d35424b54f7b14875fe1170ef9fbafcdb086d25863
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 435110B1D0021CAACF54DFD5D8885EEBBB9BF48304F10816AF605B6150E7B85AC9CF98

Function 040A62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 040A6303
LoadLibraryA.KERNEL32(?), ref: 040A632A
GetProcAddress.KERNEL32(00000000,?), ref: 040A63B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 040A6405

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 02b12b4178dd7ee7b7109ce59385b648279139a2a802e2531d6895b314d7ad55
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 2B416072A00105EFDB54CF94C884AADB7F4FF04358F188969E995E7250E772F962CB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 040AE795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040ADF6C: GetCurrentThreadId.KERNEL32 ref: 040ADFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,040AA6AC), ref: 040AE7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,040AA6AC), ref: 040AE7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,040AA6AC), ref: 040AE819

Strings

PromptOnSecureDesktop, xrefs: 040AE840, 040AE845, 040AE87C, 040AE89B

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: fc61bb7149b141fd40451fe3ac8c411eada7b612dbee1054dc24816c8a85d68a
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 6221F3B1A403007AF22177B19C45FEB3E4DDF64BACF500538BA09B51D3EAA5A57082F5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 040A7665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 040A76D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 040A796D
RegCloseKey.ADVAPI32(?), ref: 040A797E

Strings

PromptOnSecureDesktop, xrefs: 040A76C5, 040A76CA, 040A76E5

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 349c74559443af82ce5a4b53810c2d9b8f5f5b416f8700af612909d6fb0d41ba
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: F511DC30A00109AFEB129FA9DC44FEFBFB8EB91304F188161F510F7290E2B0D9608B61

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 040A9966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 040A999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 040A99BD
RegCloseKey.ADVAPI32(?), ref: 040A99C6

Strings

PromptOnSecureDesktop, xrefs: 040A9989, 040A998E, 040A99B0, 040A99D3

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 89f791ef51dc7005e66d207aacb99441aa4a49745c01044f5e99ce8cda7a29ef
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 05F0FCB2640108BFF7116B94EC06FDF3A2CDB54718F100074F605B5081F6E55BA042B9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 040A28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 040A28FA
gethostbyname.WS2_32(u6A), ref: 040A2906

Strings

time_cfg, xrefs: 040A28EB
u6A, xrefs: 040A28EC, 040A28F9, 040A2905

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: e818041d9e7f97f785c879801260e19e9ed1f68deb74804eb3e524ba350013f6
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: E3E08C306051118FCB808F28F948AC537E4AF0A230F0081E8F440E32A0C734AC909641

Function 040A69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 040A69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 040A6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 040A6A3A
CloseHandle.KERNEL32(000000FF), ref: 040A6BD8

Part of subcall function 040AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,040A1DCF,?), ref: 040AEEA8
Part of subcall function 040AEE95: HeapFree.KERNEL32(00000000), ref: 040AEEAF

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: c2955a6504cb8402d07743475edb34d35bdb2ccddd2ef43ec0a65a5bc085aebc
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 9E71277190021DEFDF10DFA4CC80AEEBBB9FB08314F14496AE555B6190D731AEA6DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 040A417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 040A41AB
GetLastError.KERNEL32 ref: 040A41B5
WaitForSingleObject.KERNEL32(?,?), ref: 040A41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 040A41D9

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: b4cbe5d4cdd7a0e240fce87b1d455d306e5c884dc9e3f739684ec471d90fbdbb
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 2A010C7A51111AAFDF01DF90ED89BEF7BACEB18755F004461F901E2050D7B0EA648BB6

Function 040A41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 040A421F
GetLastError.KERNEL32 ref: 040A4229
WaitForSingleObject.KERNEL32(?,?), ref: 040A423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 040A424D

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 954f3f7586916be3257eb09dc1e46a685ca2dcb373508e56c463b56d4d3ae456
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: F701C872511109AFDF11DF90EE84BEF7BACEB08259F518461F901F2050D7B0EA649BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 040AE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 040AE066

Strings

A, xrefs: 040AE037, 040AE03C
A, xrefs: 040AE036
A, xrefs: 040AE07F

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: f3626e637ed108290bdfcc5ee951d98a75e965393c4eb6b07461b4cb9b51ab3f
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 2BF062312007029BCB60CFA5D884E82B7E9FB05321B44862AE154E3860D374B4E8CB91

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 040AE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,040A44E2,00000000,00000000,00000000), ref: 040AE470
CloseHandle.KERNEL32(00000001,00000003), ref: 040AE484

Part of subcall function 040AE2FC: RegCreateKeyExA.ADVAPI32(80000001,040AE50A,00000000,00000000,00000000,00020106,00000000,040AE50A,00000000,000000E4), ref: 040AE319
Part of subcall function 040AE2FC: RegSetValueExA.ADVAPI32(040AE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040AE38E
Part of subcall function 040AE2FC: RegDeleteValueA.ADVAPI32(040AE50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 040AE3BF
Part of subcall function 040AE2FC: RegCloseKey.ADVAPI32(040AE50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,040AE50A), ref: 040AE3C8

Strings

PromptOnSecureDesktop, xrefs: 040AE4F1, 040AE4F6, 040AE537, 040AE561

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 159c207be06ff07ffbed82691deae00b1e909b9e2cd6a75f4333ab649c787895
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: B541C772940204BAEB206EE1DC45FEF3BACDB04768F148065FA09B4191E6B5A670D6F4

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 040A8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 040A83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 040A8477

Part of subcall function 040A69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 040A69E5
Part of subcall function 040A69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 040A6A26
Part of subcall function 040A69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 040A6A3A

Part of subcall function 040AEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,040A1DCF,?), ref: 040AEEA8
Part of subcall function 040AEE95: HeapFree.KERNEL32(00000000), ref: 040AEEAF

Strings

PromptOnSecureDesktop, xrefs: 040A83B2, 040A83B7, 040A8483

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: b304a4c4f16bf6b5aca4bb10703753b00fef9bb37b9ed191c7c96f074b7f256a
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 8E413DB2900109BFEB50FBE49D84DEF77ACEB04248F1484AAE504F6150F6B16AA48B65

Function 040AE631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,040AE859,00000000,00020119,040AE859,PromptOnSecureDesktop), ref: 040AE64D
RegCloseKey.ADVAPI32(040AE859,?,?,?,?,000000C8,000000E4), ref: 040AE787

Strings

PromptOnSecureDesktop, xrefs: 040AE637

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 6a390d84c41392bf60bae2abe6917886596a24523d310b36879f1a5c21c9cd5b
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 364109B2D4011DBFEF11EFE4DC84DEEBBB9EB14348F144466E900B6150E371AA658BA0

Function 040AAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 040AAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 040AB00D

Part of subcall function 040AAF6F: gethostname.WS2_32(?,00000080), ref: 040AAF83
Part of subcall function 040AAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 040AAFE6

Part of subcall function 040A331C: gethostname.WS2_32(?,00000080), ref: 040A333F
Part of subcall function 040A331C: gethostbyname.WS2_32(?), ref: 040A3349

Part of subcall function 040AAA0A: inet_ntoa.WS2_32(00000000), ref: 040AAA10

Strings

%OUTLOOK_BND_, xrefs: 040AB076, 040AB07B, 040AB0BE, 040AB0DD

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 8844035f7948f801a01856d64a2a992b219c6896c1a24bcdb69d94c053c66d5b
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 6C41317290024CABDF25EFE0DC45EEE3BACFF08308F144426FA25A2151EA75E6648F54

Function 040A9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 040A9536
Sleep.KERNEL32(000001F4), ref: 040A955D

Strings

, xrefs: 040A94D9

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: d9d9cebbb805b9edfd2787b980038f0d66f87e5a3bbf00326511d96c36aacd04
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 17412BF1B043846FFB75ABF4D88EBE63FE49B02314F140995D08277192D67469908711

Function 040ABC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 040AB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 040ABA3A
InterlockedIncrement.KERNEL32(?), ref: 040ABA94
GetTickCount.KERNEL32 ref: 040ABB79
GetTickCount.KERNEL32 ref: 040ABB99
InterlockedIncrement.KERNEL32(?), ref: 040ABE15
closesocket.WS2_32(00000000), ref: 040ABEB4

Strings

%FROM_EMAIL, xrefs: 040ABC7D

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 625a16bcd7f0af52c3727eb67e786facfc50669d3b86894ceb95e1c472f71d58
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 6B316871500248AFDF65DFE4DC84AEA77F8EB48704F20405AFA25A61A0EB75B6A5CF10

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 040A709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 040A70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 040A70F4

Strings

|, xrefs: 040A70E6

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: af036d0a4d0605139d8a1275b1fea65d9c7dee3d68c007062b73a4065dea8b97
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 6B112A72900118EBDB51CFD8DC88ADEB7FCAB44301F1481B6E501F7090D674EB888BA4

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 040A3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 040A2F88: GetModuleHandleA.KERNEL32(?), ref: 040A2FA1
Part of subcall function 040A2F88: LoadLibraryA.KERNEL32(?), ref: 040A2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 040A31DA
HeapFree.KERNEL32(00000000), ref: 040A31E1

Memory Dump Source

Source File: 00000000.00000002.2174714113.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: e6111182279623e1196ef97e0ac03961d79048c6ebb9c4503ed8be18c1565013
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 0B519071900246AFDF01DFA4D8889FAB7B5FF05308F144569EC96E7210E772EA29CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2173368482.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2173368482.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_rXTqHar5Ud.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: dpbgdjiw.exePID: 4892, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	2.1%
Signature Coverage:	0%
Total number of Nodes:	1572
Total number of Limit Nodes:	13

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\rXTqHar5Ud.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
P, xrefs: 00409DAA
D, xrefs: 00409F8E
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 0040A1D9
\, xrefs: 00409D0C
dkajlqvv, xrefs: 0040A389, 0040A397
", xrefs: 00409EDB
C:\Users\user\Desktop\rXTqHar5Ud.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\rXTqHar5Ud.exe$C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$D$P$\$dkajlqvv
API String ID: 2089075347-1506434891
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 02C8003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02C8024D

Strings

cess, xrefs: 02C8018D
kernel32.dll, xrefs: 02C8008F, 02C80095

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: acd8429db98b17632d335476261fc33c41f825b06f7640636538905718581767
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 62526B75A01229DFDB64CF58C984BACBBB1BF09308F1480D9E54DAB351DB30AA89DF15

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 02578A41 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02578A69
Module32First.KERNEL32(00000000,00000224), ref: 02578A89

Memory Dump Source

Source File: 0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp, Offset: 02568000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2568000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3f83d9c07bf1a8397d54138170f447548537a72075ebc34fd8301782eec96196
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C8F090326407116FD7203BF9B88CBAE7AECBF49635F140528E646D10C0DBB0E8459A69

Function 02C80E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02C80223,?,?), ref: 02C80E19
SetErrorMode.KERNELBASE(00000000,?,?,02C80223,?,?), ref: 02C80E1E

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ac362fad639c5c9b64cd8f07aeb9a6a6ad7bb22d7ae53432970dca695a8b64fe
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 8ED0123214512877D7003A94DC09BCE7B1CDF05B66F008011FB0DD9080C770964046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 02578700 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02578751

Memory Dump Source

Source File: 0000000C.00000002.2174342309.0000000002568000.00000040.00000020.00020000.00000000.sdmp, Offset: 02568000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2568000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 5d485d6457236d43a1f5b9b84c02e605323f5655ba65feb86170f047a16532cb
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1D113C79A40208EFDB01DF98C989E98BFF5AF08351F098094F9489B361D371EA50EF84

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 02C865E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 02C865F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02C86610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02C86631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02C86652

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 5ace20f99ba8f2db7caea61916507c4219cd29ea59a461dcad7799e9da0c77a7
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 6A117371600258BFDB21AF65DC4AF9B3FACEB457A9F108025FA08E7250D7B1DD008AA4

Function 02C89EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02C89E6D
lstrcpy.KERNEL32(?,00000000), ref: 02C89FE1
lstrcat.KERNEL32(?,?), ref: 02C89FF2
lstrcat.KERNEL32(?,0041070C), ref: 02C8A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 02C8A054
DeleteFileA.KERNEL32(?), ref: 02C8A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02C8A0D6
lstrcpy.KERNEL32 ref: 02C8A12F
lstrlen.KERNEL32(00000022), ref: 02C8A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02C89F13

Part of subcall function 02C87029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02C87081

Part of subcall function 02C86F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\mtjsuzee,02C87043), ref: 02C86F4E
Part of subcall function 02C86F30: GetProcAddress.KERNEL32(00000000), ref: 02C86F55
Part of subcall function 02C86F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02C86F7B
Part of subcall function 02C86F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02C86F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 02C8A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02C8A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 02C8A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 02C8A21B
GetDriveTypeA.KERNEL32(?), ref: 02C8A265
lstrcat.KERNEL32(?,00000000), ref: 02C8A29F
lstrcat.KERNEL32(?,00410A34), ref: 02C8A2C5
lstrcat.KERNEL32(?,00000022), ref: 02C8A2D9
lstrcat.KERNEL32(?,00410A34), ref: 02C8A2F4
wsprintfA.USER32 ref: 02C8A31D
lstrcat.KERNEL32(?,00000000), ref: 02C8A345
lstrcat.KERNEL32(?,?), ref: 02C8A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 02C8A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 02C8A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 02C8A1D1

Part of subcall function 02C89966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 02C8999D
Part of subcall function 02C89966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 02C899BD
Part of subcall function 02C89966: RegCloseKey.ADVAPI32(?), ref: 02C899C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 02C8A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 02C8A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 02C8A41D

Strings

P, xrefs: 02C8A011
", xrefs: 02C8A2DF
\, xrefs: 02C89F73
D, xrefs: 02C8A1F5
", xrefs: 02C8A142
", xrefs: 02C8A3F0

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 06925756f76ea49a9ebfaddbe7ad873e1a15d2e2f46d50b998fc6c8871e95f5a
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: C0F145B1D40259AFDF11EBA08C48FEF7BBCAB48308F1484A6E609E2141E7759B85CF55

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
NtOpenProcessToken, xrefs: 004011D4
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlLengthSid, xrefs: 00401246
RtlNtStatusToDosError, xrefs: 00401194
NtQueryInformationToken, xrefs: 00401262
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
RtlInitUnicodeString, xrefs: 00401135
NtFilterToken, xrefs: 0040122B
NtTerminateProcess, xrefs: 004010F6
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtDuplicateToken, xrefs: 004011F3
ntdll.dll, xrefs: 0040100D

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Wed, xrefs: 0040B23A
Nov, xrefs: 0040B29C
Sep, xrefs: 0040B28E
Dec, xrefs: 0040B2A3
Jun, xrefs: 0040B279
Tue, xrefs: 0040B233
Sun, xrefs: 0040B225
Oct, xrefs: 0040B295
Sat, xrefs: 0040B24F
Mon, xrefs: 0040B22C
Apr, xrefs: 0040B26B
Jan, xrefs: 0040B256
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Aug, xrefs: 0040B287
Thu, xrefs: 0040B241
Jul, xrefs: 0040B280
Fri, xrefs: 0040B248
May, xrefs: 0040B272
Mar, xrefs: 0040B264
Feb, xrefs: 0040B25D

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 02C87CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02C87D21
GetUserNameA.ADVAPI32(?,?), ref: 02C87D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02C87D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02C87DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02C87DC0
EqualSid.ADVAPI32(?,?), ref: 02C87DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02C87DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02C87DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02C87E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02C87E12
LocalFree.KERNEL32(00000000), ref: 02C87E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02C87E35

Strings

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 02C87F49, 02C87F76, 02C87F8A, 02C87F8B
D, xrefs: 02C87D73

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$D
API String ID: 2976863881-2164713515
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 5fe214083e80b7babc90f2a528c7564bd6d17684722f76de7d70a28a50edb843
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 9DA16C76900219AFDB11DFA1DC88FEEBBB9FB48308F14816AF505E6150E7758A84CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$D
API String ID: 2976863881-2164713515
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
localcfg, xrefs: 0040672D
Jan 13 2018, xrefs: 0040653A
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
va=%08X%08X uef=%p, xrefs: 00406595

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
quit, xrefs: 0040A86C
Incorrect respons, xrefs: 0040AB39
AUTH LOGIN, xrefs: 0040A80C
., xrefs: 0040A8CA
data, xrefs: 0040A85E
helo %s, xrefs: 0040A803
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
localcfg, xrefs: 0040AB0B
rcpt to:<%s>, xrefs: 0040A855
ESMTP, xrefs: 0040AA38

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02C87A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02C87A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02C87ACD
GetLengthSid.ADVAPI32(?), ref: 02C87ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02C87B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02C87B1F
EqualSid.ADVAPI32(?,?), ref: 02C87B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02C87B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02C87B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02C87B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02C87B77
LocalFree.KERNEL32(00000000), ref: 02C87B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02C87B9A
GetAce.ADVAPI32(?,?,?), ref: 02C87BCA
EqualSid.ADVAPI32(?,?), ref: 02C87BF1
DeleteAce.ADVAPI32(?,?), ref: 02C87C0A
EqualSid.ADVAPI32(?,?), ref: 02C87C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02C87CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02C87CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02C87CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02C87CE0
LocalFree.KERNEL32(00000000), ref: 02C87CEE

Strings

D, xrefs: 02C87AC3

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 340fbd2f38c23651733362cb3c37a812b58fd687eca066892bbc4b16ad3965e5
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 34818C75900619AFDB11DFA0DD84FEEBBB8BF48308F24806AE605E7150E7748A45CBA4

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$localcfg
API String ID: 237177642-3593170167
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

uac, xrefs: 00401628
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
, xrefs: 00401462
<, xrefs: 00401378
useless, xrefs: 0040161E

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 02C8858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 02C8865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 02C8867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 02C886A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02C886B1

Strings

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 02C8882F, 02C8883C, 02C8884C
", xrefs: 02C8896C

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe
API String ID: 237177642-2128151195
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f452aa50ee9aa8271692acfae4e5233ba85cc5bf78e61ca5fe37c4cda03ae216
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: F4C1AFB294024CBEEB11BBA4DD84EEE7BBDEB44308F548169F605E2050E7B04B949B65

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 02C814E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02C81601
lstrlenW.KERNEL32(-00000003), ref: 02C817D8

Strings

, xrefs: 02C816C9
D, xrefs: 02C8182D
@, xrefs: 02C815E7
<, xrefs: 02C815DF

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 631e827b4205eb8789068eccf58d9a93ffdbe26318d97be9da8246b970050cdd
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 83F19EB15083419FD720EF64C888BABB7E5FBC8309F04892DF59A97290D7B4DA45CB52

Function 02C87666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 02C876D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02C87757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 02C8778F
___ascii_stricmp.LIBCMT ref: 02C878B4
RegCloseKey.ADVAPI32(?), ref: 02C8794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 02C8796D
RegCloseKey.ADVAPI32(?), ref: 02C8797E
RegCloseKey.ADVAPI32(?), ref: 02C879AC
RegCloseKey.ADVAPI32(?), ref: 02C87A56

Part of subcall function 02C8F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,02C8772A,?), ref: 02C8F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02C879F6
RegCloseKey.ADVAPI32(?), ref: 02C87A4D

Strings

", xrefs: 02C87800

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 0382227fd81933e942abecf4db7ce388976e77698a953b047deb4f753ac43bf9
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 07C19575900119AFDB11EBA4DC44FEEBBB9EF49318F2480A5E504E6190FB71DB88DB60

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 02C82CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02C82CED
socket.WS2_32(00000002,00000002,00000011), ref: 02C82D07
htons.WS2_32(00000000), ref: 02C82D42
select.WS2_32 ref: 02C82D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02C82DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02C82E62

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 249177d7af9c27568dd357e427be1bbb221bb894fa81e2bb8883bc283b238d35
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 6C61D372504385AFC320AF65DC4CB6BBBE8EB8474AF008819FD4597150D7B5D980CBAB

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_EMAIL, xrefs: 0040B473
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02C81FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 02C8202D
GetSystemInfo.KERNEL32(?), ref: 02C8204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 02C8206A
GetProcAddress.KERNEL32(00000000), ref: 02C82071
GetCurrentProcess.KERNEL32(?), ref: 02C82082
GetTickCount.KERNEL32 ref: 02C82230

Part of subcall function 02C81E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02C81E7C

Strings

work_srv, xrefs: 02C820C5
hi_id, xrefs: 02C8217D, 02C82182, 02C8219A
flags_upd, xrefs: 02C820A5, 02C820AA, 02C820E3
localcfg, xrefs: 02C82091, 02C82098, 02C820AB, 02C820E4, 02C820F3, 02C82119, 02C82138, 02C8214E, 02C82166, 02C82183, 02C8219B, 02C821B7, 02C821D7

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 18819f8b4a410923343c914f2cf0c7281e7052aae025f84de9d76e2842614793
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 5F51A4B09007846FE330BF658C89F67BEECEB8570CF04891DF99682142D7B5A944CB66

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02C83059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02C83068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02C83078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02C83095
RtlAllocateHeap.NTDLL(00000000), ref: 02C830B6
htons.WS2_32(00000035), ref: 02C830EF
inet_addr.WS2_32(?), ref: 02C830FA
gethostbyname.WS2_32(?), ref: 02C8310D
HeapFree.KERNEL32(00000000), ref: 02C8314D

Strings

iphlpapi.dll, xrefs: 02C83062, 02C83067, 02C83077

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 23ed52635f96fc37c1e0ea75784fb2ae9d293356d75d8ae466113d227053a1c7
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 4831F831A00246ABDB11ABB4DC48BBE7B78EF44F28F14D1A5E518E7290DB74D641CB68

Function 02C8958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 02C895A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02C895D5
GetModuleFileNameA.KERNEL32(00000000), ref: 02C895DC
wsprintfA.USER32 ref: 02C89635
wsprintfA.USER32 ref: 02C89673
wsprintfA.USER32 ref: 02C896F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02C89758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02C8978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02C897D8

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: d9ddbfe5f4b249a1347349c149b441fa1bbd5fa5dd8a19a4ee1cff734a104611
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 05A181B1900248AFEB21EFA1CC44FEA3BADEF44749F108026FA05D6251E775D684CFA5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 02C86778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 02C867C3
htonl.WS2_32(?), ref: 02C867DF
htonl.WS2_32(?), ref: 02C867EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02C868F1
ExitProcess.KERNEL32 ref: 02C869BC

Strings

except_info, xrefs: 02C8698F
localcfg, xrefs: 02C86994

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: 823552e9ab29e4a1421c0d8aa3332845868a04edd48a7ff706db2e6d322accc6
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 6A617D71A40208AFDB60AFA4DC45FEA77E9FB48304F248066FA6CD2161EB759990CF14

Function 02C8F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(02C8CC84), ref: 02C8F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 02C8F5CE
closesocket.WS2_32(00000000), ref: 02C8F5DC

Strings

time_cfg, xrefs: 02C8F58A

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 79f65c41262c3ef7c6d2ba7deaae124942775ab470a41c3a77b0f89d66c25dae
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 13316E7290011CABDB10EFA5DC88DEE7BBCEF88314F50856AF915E3150E7709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02C82F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02C82FA1
LoadLibraryA.KERNEL32(?), ref: 02C82FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02C82FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02C83000
RtlAllocateHeap.NTDLL(00000000), ref: 02C83007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02C83032

Strings

dnsapi.dll, xrefs: 02C82F90

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: e282a9ae13010c98a5f018feb87e476c3ed3637619c3936ef8b41bef03e75bc7
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 6B219071D00629BBCB21AB95DC48AAEBBB8EF48B58F008461F901E7140D7B59A81C7E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 02C899E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02C89A18
GetThreadContext.KERNEL32(?,?), ref: 02C89A52
TerminateProcess.KERNEL32(?,00000000), ref: 02C89A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02C89A98
SetThreadContext.KERNEL32(?,00010002), ref: 02C89AB5
ResumeThread.KERNEL32(?), ref: 02C89AC2

Strings

D, xrefs: 02C89A10

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: d0f35fd031db94807b48b85be03c4a54c7c6ba6619d086b0d553143e1b78654c
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: DF213BB1A41219BBDB11ABA1DC09EEF7BBCEF04758F408061FA19E1150E7759A44CBA4

Function 02C81C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02C81C18
LoadLibraryA.KERNEL32(004102C8), ref: 02C81C26
GetProcessHeap.KERNEL32 ref: 02C81C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02C81C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02C81CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02C81D02
FreeLibrary.KERNEL32(?), ref: 02C81D0B

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 44efeac4bca20bc10389a0dfe5bfc2594f608a0593ca17063aef30775bd7362b
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 47313032D00219BFCB11AFA4DC889AEBBF9EB85719B28847AE505A2110D7F54E81DB54

Function 02C86CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02C86CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02C86D22
GetLastError.KERNEL32 ref: 02C86DA7
CloseHandle.KERNEL32(?), ref: 02C86DB5
GetLastError.KERNEL32 ref: 02C86DD6
DeleteFileA.KERNEL32(?), ref: 02C86DE7
GetLastError.KERNEL32 ref: 02C86DFD

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 48601d3c7b235b3e46c05e7a2e946c19cfaf12774895b92c53acb70e7b5f3f50
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: D5310372900249BFCB01EFA5DD44ADE7F7DEB88308F24C466E251E3211E7708A858B61

Function 02C86F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\mtjsuzee,02C87043), ref: 02C86F4E
GetProcAddress.KERNEL32(00000000), ref: 02C86F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02C86F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02C86F92

Strings

C:\Windows\SysWOW64\, xrefs: 02C86F30, 02C86F38, 02C86F65, 02C86F6C, 02C86F7A, 02C86F85, 02C86F91, 02C86FA9, 02C86FC6, 02C86FEC
\\.\pipe\mtjsuzee, xrefs: 02C86F37

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\mtjsuzee
API String ID: 1082366364-3446391654
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 826c8ff7ed0c29d1e1a2bf41e00887625c64b2882bc3be6d1b60f4ae590f9dd3
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 0121047174034039F72273319C8CFFB6E4C8B92718F28C0A9F944D5580EBD985DA82AD

Function 02C8AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02C8AAE5

Strings

, xrefs: 02C8ABB3
localcfg, xrefs: 02C8AD72

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 198fc12ca57c382b94515c7ce4782ac1fe01528965ca73b70db3281ee807ea80
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 19712972A40304BADF21BB54DC85FFE3769AB4070DF24C067FA05E6090EF669A84CB59

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 02C8E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02C8DF6C: GetCurrentThreadId.KERNEL32 ref: 02C8DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 02C8E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02C86128), ref: 02C8E950
lstrcmp.KERNEL32(?,00000008), ref: 02C8E989

Strings

A, xrefs: 02C8E9A0
A, xrefs: 02C8E8C6, 02C8E8CD, 02C8E936, 02C8E998
A, xrefs: 02C8E960, 02C8E965

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: af845370f9e80aaf235c90eae09c4caea98e69083ff458b6f5b28b1fdbb4674f
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 87319E31A00715ABDB71AF25D884BEA7BE4EF85729F00C92AF55687550D3B1EA80CB81

Function 02C86E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02C86E19

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 76a61343ecfdcb3f2cf02aa400dad8b7656c824c6736c8415248888590881279
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 71211A73204259BFDB10BBA5FC49EDF7FAEEB49669B20C425F502D1090EB70DA409A74

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 02C892CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 02C892E2
wsprintfA.USER32 ref: 02C89350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02C89375
lstrlen.KERNEL32(?,?,00000000), ref: 02C89389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02C89394
CloseHandle.KERNEL32(00000000), ref: 02C8939B

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 2616191b9bdd3717e8f83d4c5f13155ef8fcca9bbcb5c5f6e60a5c33be55d5f8
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 45116DB26401147AE7207B22EC0DFEF3A6EDBC8B15F00C065BB09A5190EBB54A459AA4

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 02C8C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02C8C6B4
InterlockedIncrement.KERNEL32(02C8C74B), ref: 02C8C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,02C8C747), ref: 02C8C728
CloseHandle.KERNEL32(00000000,?,02C8C747,00413588,02C88A77), ref: 02C8C733

Strings

localcfg, xrefs: 02C8C544

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 7f6050f0a05cbfa234495dde7b5dd99d4abb8b9492da1a453c169de0050e3cfa
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 505141B1A01B418FD7689F69C5D4626BBE9FB48308B50993FE18BC7A90D774F644CB20

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe
API String ID: 124786226-648084860
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 02C871C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02C871E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02C87228
LocalFree.KERNEL32(?,?,?), ref: 02C87286
wsprintfA.USER32 ref: 02C8729D

Strings

|, xrefs: 02C8721A

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 81a18a0e15fb76d01e3c36b3121a12fe58a94f13f51dad91c0431902ac02f246
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: FD310776A00209BBDB01EFA8DC45ADA7BACEF04318F14C066F959DB200EB75D7488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 02C8B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02C8B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02C8B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 02C8B548
GetTimeZoneInformation.KERNEL32(?), ref: 02C8B590
wsprintfA.USER32 ref: 02C8B61E

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: f099e3ebabbb4ed9e113e0d06d19df95073fdaa3bff98fcbe5920f1c96a695c5
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 42510FB1D0021DAACF14DFD5D8885EEBBB9BF49308F10816AF505A6150E7B94AC9CF98

Function 02C862D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02C86303
LoadLibraryA.KERNEL32(?), ref: 02C8632A
GetProcAddress.KERNEL32(00000000,?), ref: 02C863B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02C86405

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 9a53fd9dc0d323ba4f4a1b354d95966a189ef0b5a4327842c309b2add75eb231
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 4C415CB1A00205AFDB14EF59D884BADB7B8FF8435CF24C169E919D7290D771EA40DB50

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 02C893AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 02C893C6
GetModuleFileNameA.KERNEL32(00000000), ref: 02C893CD
CharToOemA.USER32(?,?), ref: 02C893DB
wsprintfA.USER32 ref: 02C89410

Part of subcall function 02C892CB: GetTempPathA.KERNEL32(00000400,?), ref: 02C892E2
Part of subcall function 02C892CB: wsprintfA.USER32 ref: 02C89350
Part of subcall function 02C892CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02C89375
Part of subcall function 02C892CB: lstrlen.KERNEL32(?,?,00000000), ref: 02C89389
Part of subcall function 02C892CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02C89394
Part of subcall function 02C892CB: CloseHandle.KERNEL32(00000000), ref: 02C8939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02C89448

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: fddb519c22e16e4b15d4508507bd7562c410ad4695e0f6f4a0bf39df7266f22f
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: F2015EF69001587BDB21A7619D8DEEF3B7CDB95705F0040A2BB49E2080EAB497C58F75

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 02C828EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 02C828FA
gethostbyname.WS2_32(u6A), ref: 02C82906

Strings

u6A, xrefs: 02C828EC, 02C828F9, 02C82905
time_cfg, xrefs: 02C828EB

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 7fcb5ed52628197f6c72468aaf24fbb5e5364ac2335c307873130d9e36e5dc76
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 17E08C316041519FCB10AB28F848AC537A4AF8A234F00C180F840C31A0C7349D809641

Function 02C869C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 02C869E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02C86A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02C86A3A
CloseHandle.KERNEL32(000000FF), ref: 02C86BD8

Part of subcall function 02C8EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02C81DCF,?), ref: 02C8EEA8
Part of subcall function 02C8EE95: HeapFree.KERNEL32(00000000), ref: 02C8EEAF

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 125d5fcca4805bdd75530b6a136654f9debb88e579be9befe7e88eeabc92a98d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: F971177190021DEFDB11AFA4CC81AFEBBB9FB44318F2085AAE515A6190D7349F92DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 02C8E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02C8E50A,00000000,00000000,00000000,00020106,00000000,02C8E50A,00000000,000000E4), ref: 02C8E319
RegSetValueExA.ADVAPI32(02C8E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 02C8E38E
RegDeleteValueA.ADVAPI32(02C8E50A,?,?,?,?,?,000000C8,004122F8), ref: 02C8E3BF
RegCloseKey.ADVAPI32(02C8E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,02C8E50A), ref: 02C8E3C8

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 579a14bae885a279ed07f5bd8b3a246ca9cf5a69d4d0ca4c332267889095c64c
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 41216171A0021DBBDF21AFA5EC85EDE7F79EF48754F008025F908E6150E3718A54DB90

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 02C841F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02C8421F
GetLastError.KERNEL32 ref: 02C84229
WaitForSingleObject.KERNEL32(?,?), ref: 02C8423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C8424D

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 008cc490e5796834bca3cb54b48ba33b662abfaa0165f1858493f44d926b2042
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: E401C87251510AAFDF11EF90ED84BEF7BACEB48259F108461F901E2051D770DA548BB6

Function 02C8417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02C841AB
GetLastError.KERNEL32 ref: 02C841B5
WaitForSingleObject.KERNEL32(?,?), ref: 02C841C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02C841D9

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 3704069c28accda113b098631f7febc4a0ec154b33917e43c6d7a86522641d29
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 9C01A57691110AABDF11EF91ED84FEE7BACEB18259F108061F901E2050D7749B648BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 02C8E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 02C8E066

Strings

A, xrefs: 02C8E037, 02C8E03C
A, xrefs: 02C8E07F
A, xrefs: 02C8E036

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 428d7b4c4eb0c0ecc7b51f99cde91d0b30b3bf7b1843dc0cd7873d487358c463
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 38F0C2312003169BCB20DF65DC84A82BBE8FB86329B04CA2AF514C3060D370E598CB91

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 02C88330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 02C883C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02C88477

Part of subcall function 02C869C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 02C869E5
Part of subcall function 02C869C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02C86A26
Part of subcall function 02C869C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02C86A3A

Part of subcall function 02C8EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02C81DCF,?), ref: 02C8EEA8
Part of subcall function 02C8EE95: HeapFree.KERNEL32(00000000), ref: 02C8EEAF

Strings

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 02C8848C, 02C884A1

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe
API String ID: 359188348-648084860
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 67f2ab0c6573f51c6006f52ad16408a8374ea800f63d410471672a961659ccdb
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 1B418DB290014DBEEB10FBA09D80EFF776DEB80308F5485AAE504E6550FBB05B949B61

Function 02C8AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02C8AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 02C8B00D

Part of subcall function 02C8AF6F: gethostname.WS2_32(?,00000080), ref: 02C8AF83
Part of subcall function 02C8AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 02C8AFE6

Part of subcall function 02C8331C: gethostname.WS2_32(?,00000080), ref: 02C8333F
Part of subcall function 02C8331C: gethostbyname.WS2_32(?), ref: 02C83349

Part of subcall function 02C8AA0A: inet_ntoa.WS2_32(00000000), ref: 02C8AA10

Strings

%OUTLOOK_BND_, xrefs: 02C8B076, 02C8B07B, 02C8B0BE, 02C8B0DD

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 9a1322edb87efb8682075cc25b9bcc32a37dbf82ba91a020eef93241dc0074fe
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 124101B290024CABDB25EFA0DC45EEE3B6DFF08308F14842AF925D2151EB75EA549F54

Function 02C89452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02C89536
Sleep.KERNEL32(000001F4), ref: 02C8955D

Strings

, xrefs: 02C894D9

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 1c5c051a6164d2ec7a6696de8180a568d94deb1be952a54fea356a129712a94f
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 0341E7B19043856EEB36BB64D89C7B67BE49B8231CF14C2A5D483973A2D7B44A81C711

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 02C8BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02C8B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 02C8BA3A
InterlockedIncrement.KERNEL32(?), ref: 02C8BA94
GetTickCount.KERNEL32 ref: 02C8BB79
GetTickCount.KERNEL32 ref: 02C8BB99
InterlockedIncrement.KERNEL32(?), ref: 02C8BE15
closesocket.WS2_32(00000000), ref: 02C8BEB4

Strings

%FROM_EMAIL, xrefs: 02C8BC7D

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 447b385f76167fa8638b7555b18b0c414c58c14e9642dccd6e606c4a0afc0166
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 6A316F72500288EFDF25EFA4DC44AEEB7B9EB44708F20805AFA14D2160EB75DA85CF54

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 02C8709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 02C870BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 02C870F4

Strings

|, xrefs: 02C870E6

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 79668ab91de197739a6716bb6985622b0aa51dba881c1a3ca4e5ef4b6903432d
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 7D11617690011CEBDF51DFD4DC84AEEF7BCAB04309F2481AAE515E6094E7709B88CBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 02C83189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02C82F88: GetModuleHandleA.KERNEL32(?), ref: 02C82FA1
Part of subcall function 02C82F88: LoadLibraryA.KERNEL32(?), ref: 02C82FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02C831DA
HeapFree.KERNEL32(00000000), ref: 02C831E1

Memory Dump Source

Source File: 0000000C.00000002.2174405281.0000000002C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2c80000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d9262e1c7266917226e61d2f04ccf54687f569a7fdafe70a092e0a998dcae3f4
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 51518E71900286AFCB01AF64DC889FAB775FF45708B1495A9EC96C7211E7329A19CB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2173205901.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_dpbgdjiw.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 5236, Parent PID: 4892COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1806
Total number of Limit Nodes:	18

Executed Functions

Function 0322C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0322CA4E
closesocket.WS2_32(?), ref: 0322CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0322CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0322CCB4
WriteFile.KERNEL32(0322A4B3,?,-000000E8,?,00000000), ref: 0322CCDC
CloseHandle.KERNEL32(0322A4B3), ref: 0322CCED
wsprintfA.USER32 ref: 0322CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0322CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0322CD89
CloseHandle.KERNEL32(?), ref: 0322CD98
CloseHandle.KERNEL32(?), ref: 0322CD9D
DeleteFileA.KERNEL32(?), ref: 0322CDC4
CloseHandle.KERNEL32(0322A4B3), ref: 0322CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0322CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0322CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0322D033
lstrcatA.KERNEL32(?,04700108), ref: 0322D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0322D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0322D171
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000), ref: 0322D195
CloseHandle.KERNEL32(00000000), ref: 0322D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0322D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0322D231
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 0322D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0322D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0322D2C7
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0322D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0322D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0322D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0322D372
lstrcatA.KERNEL32(?,04700108,?,?,?,?,?,?,?,00000100), ref: 0322D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0322D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0322D408
WriteFile.KERNEL32(00000000,0470012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0322D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0322D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0322D45B
CreateProcessA.KERNEL32(?,03230264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0322D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0322D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0322D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0322D513
closesocket.WS2_32(?), ref: 0322D56C
Sleep.KERNEL32(000003E8), ref: 0322D577
ExitProcess.KERNEL32 ref: 0322D583
wsprintfA.USER32 ref: 0322D81F

Part of subcall function 0322C65C: send.WS2_32(00000000,?,00000000), ref: 0322C74B

closesocket.WS2_32(?), ref: 0322DAD5

Strings

srv_time, xrefs: 0322CABB
time_cfg, xrefs: 0322C95B, 0322C962, 0322C971, 0322C984
drivers\, xrefs: 0322D067
wtm_r, xrefs: 0322C97F
except_info, xrefs: 0322D8CD, 0322D8D2, 0322D8FB
work_srv, xrefs: 0322D607, 0322D60F, 0322D62C
local_time, xrefs: 0322CACD
.dat, xrefs: 0322D0D7, 0322D138, 0322D1AE, 0322D1D4, 0322D28E, 0322D308, 0322D3CF, 0322D441
wtm_w, xrefs: 0322C96C
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 0322CC10, 0322CCF3, 0322D975, 0322D98E
lid_file_upd, xrefs: 0322CE6A
flags_upd, xrefs: 0322CE4A
4, xrefs: 0322D9F7
@, xrefs: 0322D754
localcfg, xrefs: 0322CA89, 0322CA93, 0322CAC0, 0322CAD2, 0322CE4F, 0322CE6F, 0322D8D3, 0322D8FC
wtm_c, xrefs: 0322C956
\, xrefs: 0322D39D
.sys, xrefs: 0322D0CC
\, xrefs: 0322D3A7

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3369033204
Opcode ID: 7c6e0582867fa23eb24a41e66e3892830d033b709d34d37ad6f799324f90ef5c
Instruction ID: 3c14a2df241f8ff2afb26a040565da723c1f0a6375d5469efc36036f1bbbbf59
Opcode Fuzzy Hash: 7c6e0582867fa23eb24a41e66e3892830d033b709d34d37ad6f799324f90ef5c
Instruction Fuzzy Hash: 52B2B6B1950229BFEB10EFA4DD48EEEBFBCEB05300F148469E655A6141D7709AC5CF60

Function 03229A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 03229A7F
SetErrorMode.KERNELBASE(00000003), ref: 03229A83
SetUnhandledExceptionFilter.KERNEL32(03226511), ref: 03229A8A

Part of subcall function 0322EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0322EC5E
Part of subcall function 0322EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0322EC72
Part of subcall function 0322EC54: GetTickCount.KERNEL32 ref: 0322EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 03229AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 03229ABA
GetCommandLineA.KERNEL32 ref: 03229AFD
lstrlenA.KERNEL32(?), ref: 03229B99
ExitProcess.KERNEL32 ref: 03229C06
GetTempPathA.KERNEL32(000001F4,?), ref: 03229CAC
lstrcpyA.KERNEL32(?,00000000), ref: 03229D7A
lstrcatA.KERNEL32(?,?), ref: 03229D8B
lstrcatA.KERNEL32(?,0323070C), ref: 03229D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 03229DED
DeleteFileA.KERNEL32(00000022), ref: 03229E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 03229E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 03229EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 03229ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 03229F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 03229F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 03229F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 03229FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 03229FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 03229FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0322A038
lstrcatA.KERNEL32(00000022,03230A34), ref: 0322A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0322A072
lstrcatA.KERNEL32(00000022,03230A34), ref: 0322A08D
wsprintfA.USER32 ref: 0322A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0322A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0322A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0322A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0322A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0322A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0322A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0322A1B6
GetCommandLineA.KERNEL32 ref: 0322A1E5

Part of subcall function 032299D2: lstrcpyA.KERNEL32(?,?,00000100,032322F8,00000000,?,03229E9D,?,00000022,?,?,?,?,?,?,?), ref: 032299DF
Part of subcall function 032299D2: lstrcatA.KERNEL32(00000022,00000000,?,?,03229E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 03229A3C
Part of subcall function 032299D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,03229E9D,?,00000022,?,?,?), ref: 03229A52

lstrlenA.KERNEL32(?), ref: 0322A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0322A3B7
GetLastError.KERNEL32 ref: 0322A3ED
Sleep.KERNELBASE(000003E8), ref: 0322A400
DeleteFileA.KERNELBASE(032333D8), ref: 0322A407
CreateThread.KERNELBASE(00000000,00000000,0322405E,00000000,00000000,00000000), ref: 0322A42C
WSAStartup.WS2_32(00001010,?), ref: 0322A43A
CreateThread.KERNELBASE(00000000,00000000,0322877E,00000000,00000000,00000000), ref: 0322A469
Sleep.KERNELBASE(00000BB8), ref: 0322A48A
GetTickCount.KERNEL32 ref: 0322A49F
GetTickCount.KERNEL32 ref: 0322A4B7
Sleep.KERNELBASE(00001A90), ref: 0322A4C3

Strings

\, xrefs: 03229D0C
dkajlqvv, xrefs: 0322A389, 0322A397
D, xrefs: 03229F8E
%X%08X, xrefs: 0322A0B0
", xrefs: 03229EDB
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 0322A1D9
P, xrefs: 03229DAA
", xrefs: 0322A078
", xrefs: 0322A189

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$D$P$\$dkajlqvv
API String ID: 2089075347-365796532
Opcode ID: 34e327132edb888ec23124bd2f65ada6dccc3a6ca9c30bd8501c740b341f419c
Instruction ID: f6fd98e4aa66f00a752e877b214fb9a289e61877b2c0e035d877caf404f510f2
Opcode Fuzzy Hash: 34e327132edb888ec23124bd2f65ada6dccc3a6ca9c30bd8501c740b341f419c
Instruction Fuzzy Hash: 625285B1D6036ABFDF11EFA4DC49EEE7FBCAB05700F0484A5E505A6141DBB09AC48B61

Function 0322199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 032219B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,03221E9E), ref: 032219BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 032219E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 032219ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 032219F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,03221E9E), ref: 03221A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,03221E9E), ref: 03221A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,03221E9E), ref: 03221A36
GetAdaptersInfo.IPHLPAPI(00000000,03221E9E,?,?,?,?,00000001,03221E9E), ref: 03221A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,03221E9E,?,?,?,?,00000001,03221E9E), ref: 03221A5A
GetAdaptersInfo.IPHLPAPI(00000000,03221E9E,?,?,?,?,00000001,03221E9E), ref: 03221A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,03221E9E), ref: 03221A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,03221E9E), ref: 03221AA4

Strings

GetAdaptersInfo, xrefs: 032219DC
Iphlpapi.dll, xrefs: 032219B7
localcfg, xrefs: 032219A3
GetIfEntry, xrefs: 032219E4
GetBestInterface, xrefs: 032219EF
123.45.67.89, xrefs: 032219A6

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 98a1199ff426b5ad4d40384db80cea03682b774e90d85acffcf4f272bce89384
Instruction ID: b59f1c3a88cccacf8ef470eb16a8b871b8d3ba9a432ded52c3532e33601804a5
Opcode Fuzzy Hash: 98a1199ff426b5ad4d40384db80cea03682b774e90d85acffcf4f272bce89384
Instruction Fuzzy Hash: 50315072D1026ABFCF11EFE4DC88CBEBFB9EF45601B198579E502A2110D7705A91DBA0

Function 03227A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 03227ABA
GetUserNameA.ADVAPI32(?,?), ref: 03227ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0323070C,?,?,?), ref: 03227B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 03227B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 03227B59
EqualSid.ADVAPI32(?,00000022), ref: 03227B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 03227B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 03227B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 03227B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 03227BAB
LocalFree.KERNEL32(00000000), ref: 03227BB2
GetSecurityDescriptorDacl.ADVAPI32(?,03227FC9,?,00000000), ref: 03227BCE

Strings

D, xrefs: 03227B0C
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 03227CE2, 03227D0F, 03227D23, 03227D24

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$D
API String ID: 2976863881-2164713515
Opcode ID: 031596aebca2464c2e97e5e950fe4ab942d07c2e692e2cc4278dd4d13894186b
Instruction ID: 87501bc3136128c0cbe97907e8e7438f0af4bea398573958281b5c81bde6665b
Opcode Fuzzy Hash: 031596aebca2464c2e97e5e950fe4ab942d07c2e692e2cc4278dd4d13894186b
Instruction Fuzzy Hash: 51A11B7191422ABBDF11DFA5DD88EEEBFB9FB44700F0880A9E506A2141D7359A85CB60

Function 03227809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0322782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 03227866
GetLengthSid.ADVAPI32(?), ref: 03227878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0322789A
GetSecurityDescriptorOwner.ADVAPI32(?,03227F63,?), ref: 032278B8
EqualSid.ADVAPI32(?,03227F63), ref: 032278D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 032278E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 032278F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 03227901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 03227910
LocalFree.KERNEL32(00000000), ref: 03227917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 03227933
GetAce.ADVAPI32(?,00000000,?), ref: 03227963
EqualSid.ADVAPI32(?,03227F63), ref: 0322798A
DeleteAce.ADVAPI32(?,00000000), ref: 032279A3
EqualSid.ADVAPI32(?,03227F63), ref: 032279C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 03227A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 03227A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 03227A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 03227A79
LocalFree.KERNEL32(00000000), ref: 03227A87

Strings

D, xrefs: 0322785C

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 92993a7158f8fc116fa391b450cc53afb6c430c46fdd73e38e62d61cf6209b0b
Instruction ID: c2b4a07b705e7009b25f1b33f6c018e2041c5414b0ce4fadda0be22c6af6dd7d
Opcode Fuzzy Hash: 92993a7158f8fc116fa391b450cc53afb6c430c46fdd73e38e62d61cf6209b0b
Instruction Fuzzy Hash: 42814E71D1422AABDB11DFA9DD48EEEBFBCAF08740F14816AE506E2141D735D681CFA0

Function 03228328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,03230750,?,?,00000000,localcfg,00000000), ref: 032283F3
RegQueryValueExA.KERNELBASE(03230750,?,00000000,?,03228893,?,?,?,00000000,00000103,03230750,?,?,00000000,localcfg,00000000), ref: 03228414
RegSetValueExA.KERNELBASE(03230750,?,00000000,00000004,03228893,00000004,?,?,00000000,00000103,03230750,?,?,00000000,localcfg,00000000), ref: 03228441
RegCloseKey.ADVAPI32(03230750,?,?,00000000,00000103,03230750,?,?,00000000,localcfg,00000000), ref: 0322844A

Strings

localcfg, xrefs: 03228348
C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 032285C8, 032285D5, 032285E5

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe$localcfg
API String ID: 237177642-3593170167
Opcode ID: a4c2c6fc7cfa38cba8a245968c1034db96f1a82de7c19e4334bdaf461fea806d
Instruction ID: 831b59e2c4a242b7d051cdbf3d4ca316736705b958a9c2341df08d81fbd713e3
Opcode Fuzzy Hash: a4c2c6fc7cfa38cba8a245968c1034db96f1a82de7c19e4334bdaf461fea806d
Instruction Fuzzy Hash: BAC192B5D50229BFEB11EBA4EC84EEEBFBCEB04700F188465F505A6041D6B19AC4DB61

Function 03221D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 03221DC6
GetSystemInfo.KERNELBASE(?), ref: 03221DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 03221E03
GetProcAddress.KERNEL32(00000000), ref: 03221E0A
GetCurrentProcess.KERNEL32(?), ref: 03221E1B
GetTickCount.KERNEL32 ref: 03221FC9

Part of subcall function 03221BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 03221C15

Strings

start_srv, xrefs: 03221E6C
hi_id, xrefs: 03221F16, 03221F1B, 03221F33
lid_file_upd, xrefs: 03221E25
flags_upd, xrefs: 03221E3E, 03221E43, 03221E7C
net_type, xrefs: 03221E87
localcfg, xrefs: 03221E2A, 03221E31, 03221E44, 03221E7D, 03221E8C, 03221EB2, 03221ED1, 03221EE7, 03221EFF, 03221F1C, 03221F34, 03221F50, 03221F70
loader_id, xrefs: 03221F4B, 03221F6B
work_srv, xrefs: 03221E5E
kernel32, xrefs: 03221DF7
born_date, xrefs: 03221EAD, 03221ECC
IsWow64Process, xrefs: 03221DF2

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 57a5d02983724ca9372affb7fc390aa5d4535f18af5c00823ce6e0b65dc5094c
Instruction ID: 1b166c248630d0bee9b77654f6cdfccd729f37f41c30484715229934647f40c9
Opcode Fuzzy Hash: 57a5d02983724ca9372affb7fc390aa5d4535f18af5c00823ce6e0b65dc5094c
Instruction Fuzzy Hash: BB51E2B09203547FE320EF658C89F6BBEECEB45604F04481CF59686502D7B4B99487B2

Function 032273FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 03227472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 032274F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 03227528
___ascii_stricmp.LIBCMT ref: 0322764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 032276E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 03227706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 03227717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 03227745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 032277EF

Part of subcall function 0322F1A5: lstrlenA.KERNEL32(000000C8,000000E4,032322F8,000000C8,03227150,?), ref: 0322F1AD

GetFileAttributesExA.KERNELBASE(00000022,00000000,?), ref: 0322778F
RegCloseKey.KERNELBASE(?), ref: 032277E6

Strings

", xrefs: 03227599

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: efe51c53f0fd3b6e2f3f4bef3bcbcf1e6734960c058d6860fa902ccf8e6bc192
Instruction ID: 0aedca499b36558fe0fae3a2ae311c3f694fcf19cba408898f03e32357c1ef36
Opcode Fuzzy Hash: efe51c53f0fd3b6e2f3f4bef3bcbcf1e6734960c058d6860fa902ccf8e6bc192
Instruction Fuzzy Hash: 87C1B37191422ABFDB11DFA8DC48EEEBFB9EF45310F144095E504AA191EBB1DAC4CB60

Function 0322675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0322677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0322679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 032267B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 032267BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 032267D3
ReadFile.KERNELBASE(000000FF,?,00000040,03228244,00000000,?,76230F10,00000000), ref: 03226807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0322681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0322683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0322685C
ReadFile.KERNEL32(000000FF,?,00000028,03228244,00000000,?,76230F10,00000000), ref: 0322688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 03226906
ReadFile.KERNEL32(000000FF,?,00000000,03228244,00000000,?,76230F10,00000000), ref: 0322691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 03226971

Part of subcall function 0322EC2E: GetProcessHeap.KERNEL32(00000000,0322EA27,00000000,0322EA27,00000000), ref: 0322EC41
Part of subcall function 0322EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0322EC48

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 148cbfddc6d3099d8d8669436ccf83f11aaaabbd3042ed3277edcf28d0a421ec
Instruction ID: 5ad93cb41c42d075083c3dfe84b15d85de3c41143794aa5487e6c45a8cdf619f
Opcode Fuzzy Hash: 148cbfddc6d3099d8d8669436ccf83f11aaaabbd3042ed3277edcf28d0a421ec
Instruction Fuzzy Hash: 35715872C1022AFFDF10DFA5DC849EEBBB8FB04314F14456AE915A6190E7709E92DB60

Function 0322F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0322CA1D), ref: 0322F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0322F367
closesocket.WS2_32(00000000), ref: 0322F375

Strings

time_cfg, xrefs: 0322F323

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: e55c39f6a1adee37606c84baf549ddecb8f70445983afe91dc3c0e756d5b49c9
Instruction ID: 9d4916cf409df8f55f7f574f7b76d6b233375f991b19cb6aef580ceb4ba090e4
Opcode Fuzzy Hash: e55c39f6a1adee37606c84baf549ddecb8f70445983afe91dc3c0e756d5b49c9
Instruction Fuzzy Hash: E4318376914229BFDB10DFA5ED84DEE7BBCEF48314F108166FA15D3140D7B09A818BA0

Function 0322405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 03224070
ExitProcess.KERNEL32 ref: 03224121

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 7d4e07adb0d2803d98274fd713bbca65e04ebe7a1ac24c6443ef62099f6dd579
Instruction ID: cc0c3460f69c1796cd707e05641499a14fa11ba54b5c7a6bdda1b2e44738d075
Opcode Fuzzy Hash: 7d4e07adb0d2803d98274fd713bbca65e04ebe7a1ac24c6443ef62099f6dd579
Instruction Fuzzy Hash: 3951A2B5D20229BAEB10FBA29C85FFF7E7CEF10A14F144155F601A6080E7748A81D7A1

Function 03222D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,03222F01,?,032220FF,03232000), ref: 03222D3A
LoadLibraryA.KERNEL32(?), ref: 03222D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 03222D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 03222D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 03222D99
HeapAlloc.KERNEL32(00000000), ref: 03222DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 03222DCB

Strings

dnsapi.dll, xrefs: 03222D29
DnsQuery_A, xrefs: 03222D5B

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: 9fc80f5edca4f26b97114b0c68c44886218abcaf257d3ee62489bc13d7074020
Instruction ID: 1629217e4a52e07cbeb7adddd3a7ce6833a78909670c6ab68d965c64738606bd
Opcode Fuzzy Hash: 9fc80f5edca4f26b97114b0c68c44886218abcaf257d3ee62489bc13d7074020
Instruction Fuzzy Hash: B4214C71910726FBCB61DF64DC489AEBFBCEF08A50F148891F946A7104D7B1A98587E0

Function 032280C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0322815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0322A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 03228187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0322A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 032281BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 03228210

Part of subcall function 0322675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0322677E
Part of subcall function 0322675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0322679A
Part of subcall function 0322675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 032267B0
Part of subcall function 0322675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 032267BF
Part of subcall function 0322675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 032267D3
Part of subcall function 0322675C: ReadFile.KERNELBASE(000000FF,?,00000040,03228244,00000000,?,76230F10,00000000), ref: 03226807
Part of subcall function 0322675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0322681F
Part of subcall function 0322675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0322683E
Part of subcall function 0322675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0322685C

Part of subcall function 0322EC2E: GetProcessHeap.KERNEL32(00000000,0322EA27,00000000,0322EA27,00000000), ref: 0322EC41
Part of subcall function 0322EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0322EC48

Strings

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe, xrefs: 03228225, 0322823A

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe
API String ID: 124786226-648084860
Opcode ID: dac77d5bb4f0f790fc7857b63b52ec75b806bc96aeb93dbad11a193aef2cc69a
Instruction ID: 281e666ec25d6c914b52693ed2fc9596324c8008ada67ed601ce5183ffbfa09b
Opcode Fuzzy Hash: dac77d5bb4f0f790fc7857b63b52ec75b806bc96aeb93dbad11a193aef2cc69a
Instruction Fuzzy Hash: 694185B6925369BFEB10EBA4ED84DBE7F6CEB04600F0449A6E50197005E6B1DAC48B61

Function 03221AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 03221AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 03221AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 03221B20

Strings

GetAdaptersAddresses, xrefs: 03221AE3
Iphlpapi.dll, xrefs: 03221ACC

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 6278b52abc27259d714e8119546bcd525771c66b2e3a9c615b2e2b3ec0c8e728
Instruction ID: e1fd3eddc767b75d5a61ead0b5940ebab295aa033e731e9d6c2c22b64bc02df4
Opcode Fuzzy Hash: 6278b52abc27259d714e8119546bcd525771c66b2e3a9c615b2e2b3ec0c8e728
Instruction Fuzzy Hash: 97119675E21138BFCB25DBA5DC84CEDFFB9EB45B10B198055F006A7101E6706AD0DB94

Function 0322E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0322E5F2,00000000,00020119,0322E5F2,032322F8), ref: 0322E3E6
RegQueryValueExA.ADVAPI32(0322E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0322E44E
RegQueryValueExA.ADVAPI32(0322E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0322E482
RegQueryValueExA.ADVAPI32(0322E5F2,?,00000000,?,80000001,?), ref: 0322E4CF
RegCloseKey.ADVAPI32(0322E5F2,?,?,?,?,000000C8,000000E4), ref: 0322E520

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 817a0b1fc1ae8b93506f0af31db52a3d172c9eec0d6506e1812af2a7f8295d40
Instruction ID: c17e6012c73820f022f65b2736bd0dd9a784f59514524d86407a267cd73d6524
Opcode Fuzzy Hash: 817a0b1fc1ae8b93506f0af31db52a3d172c9eec0d6506e1812af2a7f8295d40
Instruction Fuzzy Hash: AD4136B6D1022EBFEF11EFD4DC84DEEBBBDEB04300F054066EA11A6150E3719A959B60

Function 0322F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0322F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0322F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0322F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0322F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0322F2FD

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 3a6c467cec723e60a90bf90d88bade230fa971430db512ef588e66bca2728e9c
Instruction ID: 360da281fe2b9b192851218df7afc52e7428a735dc1d032439ff1c1f6f146b3e
Opcode Fuzzy Hash: 3a6c467cec723e60a90bf90d88bade230fa971430db512ef588e66bca2728e9c
Instruction Fuzzy Hash: 5C110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 03221BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03221AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 03221AD4
Part of subcall function 03221AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 03221AE9
Part of subcall function 03221AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 03221B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 03221C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 03221C51

Strings

hi_id, xrefs: 03221BE5
localcfg, xrefs: 03221BE7

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 2723d76a07e6c5aef2eec93825690cb9615ae4a2cf29399b607c8056d97d478f
Instruction ID: 56acbd3bb1a9fedeb4027366498c7467e06f9f04bfa61b894f8216ff9f4d5bb9
Opcode Fuzzy Hash: 2723d76a07e6c5aef2eec93825690cb9615ae4a2cf29399b607c8056d97d478f
Instruction Fuzzy Hash: F1018476910129BBEB10DAE8CCC6CEFBABCA744645F144475D602E2100D170AD8486A1

Function 03221B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 03221AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 03221AD4
Part of subcall function 03221AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 03221AE9
Part of subcall function 03221AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 03221B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 03221BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,03221EFD,00000000,00000000,00000000,00000000), ref: 03221BB8

Strings

localcfg, xrefs: 03221B7B

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 84f0b792fe75aec30bc168d391fe4173b2a2e0b2b7628601a0584eb6e02be71a
Instruction ID: 64af620e6347e1e1d9d58d00532db96b4d56343168459b8ed630382b158ad1ca
Opcode Fuzzy Hash: 84f0b792fe75aec30bc168d391fe4173b2a2e0b2b7628601a0584eb6e02be71a
Instruction Fuzzy Hash: 18014BB6D00118BFEB00DAE9CC85DEFFABCAB48650F154162A601E7140D5B06E4886A0

Function 03222684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 03222693
gethostbyname.WS2_32(00000001), ref: 0322269F

Strings

time_cfg, xrefs: 03222684

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 275f0317c12c146549bdd8e71d3eaf3fc174ce1a3e9efcb935001daa1c0d277d
Instruction ID: 618f0761a5ae356b2797c082824673efd9b215783f9bda2833fc5bec6579ed9e
Opcode Fuzzy Hash: 275f0317c12c146549bdd8e71d3eaf3fc174ce1a3e9efcb935001daa1c0d277d
Instruction Fuzzy Hash: A0E0C231228222EFCB90DF28F848AD57BE8EF06230F09C980F441D3194C730D8C08B90

Function 0322E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0322DD05: GetTickCount.KERNEL32 ref: 0322DD0F
Part of subcall function 0322DD05: InterlockedExchange.KERNEL32(032336B4,00000001), ref: 0322DD44
Part of subcall function 0322DD05: GetCurrentThreadId.KERNEL32 ref: 0322DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0322A445), ref: 0322E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,76230F10,?,00000000,?,0322A445), ref: 0322E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0322A445), ref: 0322E5B2

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 5365a68d591b32ff3db76014b809df7b5ab402bf0efdc104d6cd82b475b0e40e
Instruction ID: cd60d209b004e5369d6e95f5e29bbbcc14d7b38c9ecbb0046e9fad0ff59b3d8b
Opcode Fuzzy Hash: 5365a68d591b32ff3db76014b809df7b5ab402bf0efdc104d6cd82b475b0e40e
Instruction Fuzzy Hash: 5B2129FA5603217EE164FA21AC09FAB7E0CDB55710F014418FE0AB91C2E9D1E5E0D1F1

Function 0322877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 032288A5

Part of subcall function 0322F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0322E342,00000000,75B4EA50,80000001,00000000,0322E513,?,00000000,00000000,?,000000E4), ref: 0322F089
Part of subcall function 0322F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0322E342,00000000,75B4EA50,80000001,00000000,0322E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0322F093

Strings

localcfg, xrefs: 032287CA, 032287CF, 032287FB, 03228835, 03228861
rresolv, xrefs: 032287F6, 0322885C

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 308fdbe873f72ca735c1bd0e08e4b069725a99092ef3a29d938520dea567f98a
Instruction ID: fdf259dfac202df1d3113af82a251d5e3ab99acc2413ad0eda74a36ccd274c25
Opcode Fuzzy Hash: 308fdbe873f72ca735c1bd0e08e4b069725a99092ef3a29d938520dea567f98a
Instruction Fuzzy Hash: 9F213476568335BAF314FB65BD8AF6F3E98EB00710F544809F9088E0C5EAE595C081B3

Function 03224000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,032322F8,032242B6,00000000,00000001,032322F8,00000000,?,032298FD), ref: 03224021
GetLastError.KERNEL32(?,032298FD,00000001,00000100,032322F8,0322A3C7), ref: 0322402C
Sleep.KERNEL32(000001F4,?,032298FD,00000001,00000100,032322F8,0322A3C7), ref: 03224046

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 8ddb488733b6df3715c714f01e6e1c220f6788edb42b86599680b5bea75910b8
Instruction ID: 699e8214fe22c8c782ffe5f6148a87b618bc3c0fb8a13f61f575d886b3ddbfee
Opcode Fuzzy Hash: 8ddb488733b6df3715c714f01e6e1c220f6788edb42b86599680b5bea75910b8
Instruction Fuzzy Hash: 1BF0A7312601127BD739AB2ABC49B5A7A65FB81720F298B24F3B6E60D0C67056C59B24

Function 0322DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0322DC19,?,00000104), ref: 0322DB7F
lstrcpyA.KERNEL32(?,032328F8), ref: 0322DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0322DBC2

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: ba6d41be566768535171ba5a2b9188e40ae5fb8c01d1eb55b2c89ef61b9980aa
Instruction ID: 609944ed96c6ff75cea24e74b223b7bba47fc0a5e97e1d36f99c52092a2f93a0
Opcode Fuzzy Hash: ba6d41be566768535171ba5a2b9188e40ae5fb8c01d1eb55b2c89ef61b9980aa
Instruction Fuzzy Hash: 43F0B470110209BBEF10DF64EC49FD97B69BB04708F208194BB51A40D0D7F2D585CF20

Function 0322EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0322EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0322EC72
GetTickCount.KERNEL32 ref: 0322EC78

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 3f869f8cc81e32a55bb80a2427f748ffc91c5129b9ec5b80bc9b34fc6a1a3872
Instruction ID: b143f52f12e8f90151d414b4e3d145c7999867fefec1c3d1cd6ca541c1a17560
Opcode Fuzzy Hash: 3f869f8cc81e32a55bb80a2427f748ffc91c5129b9ec5b80bc9b34fc6a1a3872
Instruction Fuzzy Hash: 09E0BFF5810104BFE701FBB0ED4EDBB77BCFB08614F508650B912D6094DA709A048B74

Function 032230B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 032230D8
gethostbyname.WS2_32(?), ref: 032230E2

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: db95e571d7f1f6864d8a11491fe07ce60ffe7d9004b3f587e81f8de8f0d11d18
Instruction ID: d83cdbad2b85aa8d455d442394177ca6e31a1f48910796ec380146705529ad48
Opcode Fuzzy Hash: db95e571d7f1f6864d8a11491fe07ce60ffe7d9004b3f587e81f8de8f0d11d18
Instruction Fuzzy Hash: EEE09B75900129ABCF00EBA8EC89F8A7BECFF04204F084061F946E7244EE74E50487A0

Function 0322EC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0322EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0322EC0A,00000000,80000001,?,0322DB55,7FFF0001), ref: 0322EBAD
Part of subcall function 0322EBA0: HeapSize.KERNEL32(00000000,?,0322DB55,7FFF0001), ref: 0322EBB4

GetProcessHeap.KERNEL32(00000000,0322EA27,00000000,0322EA27,00000000), ref: 0322EC41
RtlFreeHeap.NTDLL(00000000), ref: 0322EC48

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 18f077b357eb6810714e50be5cf2b13e84a41cb3b6ca739f18d4aa7dae931d76
Instruction ID: be9752959beab50b4ae6e9e79daaefce5eb575f52effa0f49d218d6ef2ad58c2
Opcode Fuzzy Hash: 18f077b357eb6810714e50be5cf2b13e84a41cb3b6ca739f18d4aa7dae931d76
Instruction Fuzzy Hash: 76C012324163307BC5517654BC0CF9B6F18AF45A11F0A8409F4466A1448764588056F1

Function 0322EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0322EBFE,7FFF0001,?,0322DB55,7FFF0001), ref: 0322EBD3
RtlAllocateHeap.NTDLL(00000000,?,0322DB55,7FFF0001), ref: 0322EBDA

Part of subcall function 0322EB74: GetProcessHeap.KERNEL32(00000000,00000000,0322EC28,00000000,?,0322DB55,7FFF0001), ref: 0322EB81
Part of subcall function 0322EB74: HeapSize.KERNEL32(00000000,?,0322DB55,7FFF0001), ref: 0322EB88

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 439e4629a1c799b19c329acf8eea3b76c3a1277c35b50c1ef0b4b5df8e65d00e
Instruction ID: 1241ce2e6c520759516ca9fed4a53549f1ba2358ed9f87aaa865d49a18e051e2
Opcode Fuzzy Hash: 439e4629a1c799b19c329acf8eea3b76c3a1277c35b50c1ef0b4b5df8e65d00e
Instruction Fuzzy Hash: 3BC08C376093307BC60137A8BC0CEDA3E98EF08AA2F05C004F64AC6154CB30488097B2

Function 0322F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0322CA44), ref: 0322F476

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 8c4bede91dc1be30c7e08f0da6f5954f422903f95aa5df56c2e9bff2b16fbe08
Instruction ID: 6bb94911668ef67770983ec56182585a637cd6a4a8577cdcb31f589e48f553bd
Opcode Fuzzy Hash: 8c4bede91dc1be30c7e08f0da6f5954f422903f95aa5df56c2e9bff2b16fbe08
Instruction Fuzzy Hash: 4AF08C3221416ABBDB019E9AED84CEB3FBEFB892107040122FB04D7110D671E860CBB0

Function 03221978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 03221992

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 04fa1f588b7fe9ad637e94f181c13a049d4d7030e99be84ff7d7b974f81746b1
Instruction ID: c46381b77c09f3b7c94502ff108664e51dad2493610fe3503dd752194b465814
Opcode Fuzzy Hash: 04fa1f588b7fe9ad637e94f181c13a049d4d7030e99be84ff7d7b974f81746b1
Instruction Fuzzy Hash: D3D0122625C6327A92113759BC0487FAF9CDF45562711C42AFD49C4154D674C88183A5

Function 0322DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0322DDB5

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: c8ecbda6df3694f86325cd5839304101deb91c63af64aa62256d8e0b0948d3b8
Instruction ID: e9bbd687f22f54e5cb52efb199fe4be40cf4abfcd3ab19cd58be7bc91f9e9265
Opcode Fuzzy Hash: c8ecbda6df3694f86325cd5839304101deb91c63af64aa62256d8e0b0948d3b8
Instruction Fuzzy Hash: E8F08237220B63EBCB20CE25DC44696FBE8EB45625F184C2EE165D2140D730D8C5CB11

Non-executed Functions

Function 0322637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,03229816,EntryPoint), ref: 0322638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,03229816,EntryPoint), ref: 032263A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 032263CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 032263EB

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 167c89d26024265ece10f999eac36037ef8f56c707e7dd10116e8edc10a727f2
Instruction ID: 0ed4bd53b5c9e351c4e15896ed3489f09837e7e01fb261372d4f9ad49750ddc6
Opcode Fuzzy Hash: 167c89d26024265ece10f999eac36037ef8f56c707e7dd10116e8edc10a727f2
Instruction Fuzzy Hash: C5117772610229BFDB219F65DC49F9B3FACEB04BA5F158064F905E7240DAB1DC408AB0

Function 03221000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,03221839,03229646), ref: 03221012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 032210C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 032210E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 03221101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 03221121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 03221140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 03221160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 03221180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0322119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 032211BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 032211DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 032211FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0322121A

Strings

NtQueryInformationToken, xrefs: 03221262
ntdll.dll, xrefs: 0322100D
NtClose, xrefs: 032211B4
RtlLengthSid, xrefs: 03221246
NtDuplicateToken, xrefs: 032211F3
NtTerminateProcess, xrefs: 032210F6
NtSetInformationToken, xrefs: 03221175
NtFilterToken, xrefs: 0322122B
RtlExpandEnvironmentStrings_U, xrefs: 032210BC
RtlNtStatusToDosError, xrefs: 03221194
RtlFreeSid, xrefs: 03221116
NtOpenProcessToken, xrefs: 032211D4
RtlAllocateAndInitializeSid, xrefs: 0322120F
RtlSetLastWin32Error, xrefs: 032210D6
RtlInitUnicodeString, xrefs: 03221135
NtSetInformationThread, xrefs: 03221155

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 57f2da94b401301e8ddcfcd663186c2823bbb4fded96618b9e0c2eee7cd4dc51
Instruction ID: 37a7f85f8b5c31d2ebe128182435b932a63364caa0da3d3b60b7b5e13f0543c8
Opcode Fuzzy Hash: 57f2da94b401301e8ddcfcd663186c2823bbb4fded96618b9e0c2eee7cd4dc51
Instruction Fuzzy Hash: 4351D675622623FAC720EA6DBC48B967AE86748731F088356A620C31D4D7B4E3D3CF51

Function 0322B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0322B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0322B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 0322B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 0322B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 0322B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0322B329
wsprintfA.USER32 ref: 0322B3B7

Strings

Apr, xrefs: 0322B26B
Jul, xrefs: 0322B280
Feb, xrefs: 0322B25D
Dec, xrefs: 0322B2A3
Thu, xrefs: 0322B241
Wed, xrefs: 0322B23A
Mon, xrefs: 0322B22C
Sep, xrefs: 0322B28E
Nov, xrefs: 0322B29C
Oct, xrefs: 0322B295
Sun, xrefs: 0322B225
Aug, xrefs: 0322B287
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0322B3AF
Jun, xrefs: 0322B279
Jan, xrefs: 0322B256
Sat, xrefs: 0322B24F
Tue, xrefs: 0322B233
May, xrefs: 0322B272
Mar, xrefs: 0322B264
Fri, xrefs: 0322B248

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 118b55cb1c0cfcdb1b356409d4e1a42405c5f6780947a6963c99f7adcf2fdc9d
Instruction ID: e4c00bb75665dc8ebda56c89528754c0a6dbba48c842d8f8c59e91d156a5f917
Opcode Fuzzy Hash: 118b55cb1c0cfcdb1b356409d4e1a42405c5f6780947a6963c99f7adcf2fdc9d
Instruction Fuzzy Hash: CC513AB1D2022DABCF14DFD5D8889EEBBB9BF49704F148859E602A7150D3744AC9CBA4

Function 03226511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0322654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0322655C
htonl.WS2_32(?), ref: 03226578
htonl.WS2_32(?), ref: 03226587
wsprintfA.USER32 ref: 0322659B
wsprintfA.USER32 ref: 032265DC
wsprintfA.USER32 ref: 03226671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0322668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 03226696
wsprintfA.USER32 ref: 032266B0
wsprintfA.USER32 ref: 032266E7
wsprintfA.USER32 ref: 032266FF
wsprintfA.USER32 ref: 0322671F
ExitProcess.KERNEL32 ref: 03226755

Strings

va=%08X%08X uef=%p, xrefs: 03226595
localcfg, xrefs: 0322672D
%d=%p, xrefs: 032266F9
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 032265D6
except_info, xrefs: 03226728
ver=%d date=%s %sc=%08x a=%p, xrefs: 03226547
12:08:32, xrefs: 03226535
Jan 13 2018, xrefs: 0322653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0322666B
plgs:, xrefs: 032266AA

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 82a2111cbfe6b5c35028045b20633b009f3a1a645701549ffd8e97a009bf2053
Instruction ID: a489c7ec6106745b588da3eabba03411e0408d43b70f3892cbb589e6fc46cdea
Opcode Fuzzy Hash: 82a2111cbfe6b5c35028045b20633b009f3a1a645701549ffd8e97a009bf2053
Instruction Fuzzy Hash: 94616FB2960218AFDB60DFB4DC45FEA7BF9FF09300F148069F969D2121DA7199808F60

Function 0322A7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0322A7FB
lstrlenA.KERNEL32(?), ref: 0322A87E
send.WS2_32(?,?,00000000,00000000), ref: 0322A893
wsprintfA.USER32 ref: 0322A8AF
send.WS2_32(?,.,00000005,00000000), ref: 0322A8D2
wsprintfA.USER32 ref: 0322A8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 0322A97C
wsprintfA.USER32 ref: 0322A9B9

Strings

helo %s, xrefs: 0322A803
, xrefs: 0322A94C
Incorrect respons, xrefs: 0322AB39
., xrefs: 0322A8CA
AUTH LOGIN, xrefs: 0322A80C
mail from:<%s>, xrefs: 0322A848
quit, xrefs: 0322A86C
ehlo %s, xrefs: 0322A7F5
Too small respons, xrefs: 0322A9C9
localcfg, xrefs: 0322AB0B
Too big smtp respons (%d bytes), xrefs: 0322A9B1
data, xrefs: 0322A85E
ESMTP, xrefs: 0322AA38
Error sending command (sent = %d/%d), xrefs: 0322A8A7, 0322A8DA
rcpt to:<%s>, xrefs: 0322A855

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: 72e2c480e21e6ecc255108694e26fa51fada8664e2a014e4cb69c969679ef3ee
Instruction ID: 5c3aefc14d82ec252c2d0e0185643d694ba28e6346b962a5bacd87cbfedd3445
Opcode Fuzzy Hash: 72e2c480e21e6ecc255108694e26fa51fada8664e2a014e4cb69c969679ef3ee
Instruction Fuzzy Hash: D3A17A71970376BFDF20DA54EC85FAE7F69AB11704F184056F902AA890DEB089C8C755

Function 03221280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0322139A
lstrlenW.KERNEL32(-00000003), ref: 03221571

Strings

D, xrefs: 032215C6
@, xrefs: 03221380
, xrefs: 03221462
%systemroot%\system32\cmd.exe, xrefs: 03221316
useless, xrefs: 0322161E
<, xrefs: 03221378
uac, xrefs: 03221628
wusa.exe, xrefs: 03221388

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 189d8fb9d3306a7642f0f0795dbc5261756c8b53716bb76a018030312cfd1e2e
Instruction ID: a8da5fbf9d634f12f8b8dff24ad254cc0ef15b95261455a363648fccd3538617
Opcode Fuzzy Hash: 189d8fb9d3306a7642f0f0795dbc5261756c8b53716bb76a018030312cfd1e2e
Instruction Fuzzy Hash: 6BF19DB5518351EFD320DF64C888FAABBE9FB88300F04891DF69697290D774E994CB52

Function 03222A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 03222A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 03222A86
socket.WS2_32(00000002,00000002,00000011), ref: 03222AA0
htons.WS2_32(00000000), ref: 03222ADB
select.WS2_32 ref: 03222B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 03222B4A
htons.WS2_32(?), ref: 03222B71
htons.WS2_32(?), ref: 03222B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 03222BFB

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 12b6b136582db26f65784025e5175366c7f563dc99b3ee1304477d61568e10ac
Instruction ID: b6bc7c4d316bf8f8e791fb54ead5e0ebe59e3853216a653cd01611a30c57981b
Opcode Fuzzy Hash: 12b6b136582db26f65784025e5175366c7f563dc99b3ee1304477d61568e10ac
Instruction Fuzzy Hash: AD61B271518325EBC760EF55DC48B6ABFECFB48751F068C09F9859B140D7B6D8808BA2

Function 0322704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 032270C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0322719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 032271B2
RegCloseKey.ADVAPI32(76230F10), ref: 03227208
RegCloseKey.ADVAPI32(76230F10), ref: 03227291
___ascii_stricmp.LIBCMT ref: 032272C2
RegCloseKey.ADVAPI32(76230F10), ref: 032272D0
RegCloseKey.ADVAPI32(76230F10), ref: 03227314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0322738D
RegCloseKey.ADVAPI32(76230F10), ref: 032273D8

Part of subcall function 0322F1A5: lstrlenA.KERNEL32(000000C8,000000E4,032322F8,000000C8,03227150,?), ref: 0322F1AD

Strings

", xrefs: 03227227
, xrefs: 03227194

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 5b9e7b0c92e92c9eb994109b77721f97ef30f344225a067e8b204145042cfcd6
Instruction ID: be3b45225035a69dc582eff64c413d562056945fdcad69c07f947ed6d2287010
Opcode Fuzzy Hash: 5b9e7b0c92e92c9eb994109b77721f97ef30f344225a067e8b204145042cfcd6
Instruction Fuzzy Hash: F7B1947282422ABEDF15EFA4DC44EEE7BB8EF04310F144566F501E6081EBB59AC4CB60

Function 0322AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0322AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0322ADA6

Part of subcall function 0322AD08: gethostname.WS2_32(?,00000080), ref: 0322AD1C
Part of subcall function 0322AD08: lstrlenA.KERNEL32(?), ref: 0322AD60
Part of subcall function 0322AD08: lstrlenA.KERNEL32(?), ref: 0322AD69
Part of subcall function 0322AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 0322AD7F

Part of subcall function 032230B5: gethostname.WS2_32(?,00000080), ref: 032230D8
Part of subcall function 032230B5: gethostbyname.WS2_32(?), ref: 032230E2

wsprintfA.USER32 ref: 0322AEA5

Part of subcall function 0322A7A3: inet_ntoa.WS2_32(00000000), ref: 0322A7A9

wsprintfA.USER32 ref: 0322AE4F
wsprintfA.USER32 ref: 0322AE5E

Part of subcall function 0322EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 0322EF92
Part of subcall function 0322EF7C: lstrlenA.KERNEL32(?), ref: 0322EF99
Part of subcall function 0322EF7C: lstrlenA.KERNEL32(00000000), ref: 0322EFA0

Strings

%s%d, xrefs: 0322AE58
%OUTLOOK_HST, xrefs: 0322AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0322AE49
%OUTLOOK_BND_, xrefs: 0322AE0F, 0322AE14, 0322AE57, 0322AE76
%OUTLOOK_MID, xrefs: 0322AEAE
127.0.0.1, xrefs: 0322ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0322AE9F

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: fb0236dc59d6d22df902167bbd032d483441319b30907a4abce23af7b4e7530f
Instruction ID: c3a2caa9f285790c25abcfcb672f70fef29399a2b4cfa0f3853f9efa5d89ed4a
Opcode Fuzzy Hash: fb0236dc59d6d22df902167bbd032d483441319b30907a4abce23af7b4e7530f
Instruction Fuzzy Hash: 684161B691031CBFDF25EFA0DC45EEE3BADFB08300F14441AF92596151EAB1D9849B60

Function 03222DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 03222E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222E4C
HeapAlloc.KERNEL32(00000000,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222E4F
htons.WS2_32(00000035), ref: 03222E88
inet_addr.WS2_32(?), ref: 03222E93
gethostbyname.WS2_32(?), ref: 03222EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222EE3
HeapFree.KERNEL32(00000000,?,00000000,03222F0F,?,032220FF,03232000), ref: 03222EE6

Strings

GetNetworkParams, xrefs: 03222E28
iphlpapi.dll, xrefs: 03222DFB, 03222E00, 03222E10

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 6ab67b09f4f98a9fa7960d3aeba528615c612a8c1b91b1bc5c1a5da02cf59568
Instruction ID: 96117ed86c2dd1115efb8d1719f2a70e6b803d8870bb62a6e0cb469239853313
Opcode Fuzzy Hash: 6ab67b09f4f98a9fa7960d3aeba528615c612a8c1b91b1bc5c1a5da02cf59568
Instruction Fuzzy Hash: 8F31B531A10316FBDB50EB789C48AAEBBBCEF08760F188555F915E7190DB31E581A7A0

Function 03229326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,03229DD7,?,00000022,?,?,00000000,00000001), ref: 03229340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,03229DD7,?,00000022,?,?,00000000,00000001), ref: 0322936E
GetModuleFileNameA.KERNEL32(00000000,?,03229DD7,?,00000022,?,?,00000000,00000001), ref: 03229375
wsprintfA.USER32 ref: 032293CE
wsprintfA.USER32 ref: 0322940C
wsprintfA.USER32 ref: 0322948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 032294F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 03229526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 03229571

Strings

runas, xrefs: 03229674

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 9f41a73a91ed71eba3a5b85c969451e3d70ecce73a16d2f04efa448dd986ae21
Instruction ID: 7a5f47e5359c1872e76bdb9619a0d3cbdc32af2b696da371e59e7aede2e0ef05
Opcode Fuzzy Hash: 9f41a73a91ed71eba3a5b85c969451e3d70ecce73a16d2f04efa448dd986ae21
Instruction Fuzzy Hash: DCA14AB2920318FFEB25DFA0DC49FEE3BACEB04740F148426FA1596151E7B595D48BA0

Function 0322B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0322B467

Part of subcall function 0322EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 0322EF92
Part of subcall function 0322EF7C: lstrlenA.KERNEL32(?), ref: 0322EF99
Part of subcall function 0322EF7C: lstrlenA.KERNEL32(00000000), ref: 0322EFA0

Strings

%s@%s, xrefs: 0322B461
%TO_DOMAIN, xrefs: 0322B44B
%FROM_USER, xrefs: 0322B431
%TO_USER, xrefs: 0322B488
%P5DATE, xrefs: 0322B4F2
%DATE, xrefs: 0322B4D2
%FROM_EMAIL, xrefs: 0322B3E9
%TO_HASH, xrefs: 0322B4B0
%FROM_DOMAIN, xrefs: 0322B41E
%TO_EMAIL, xrefs: 0322B473
%M5DATE, xrefs: 0322B50F

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: ce5a43960cf2c2df6fb297410b287e1f5151993c8040ef4e2fcdb210cb2c3f03
Instruction ID: 1be1a71e236aafb5b7de5b1b9a4afa964afbd7e52caac06d303480389c1035b1
Opcode Fuzzy Hash: ce5a43960cf2c2df6fb297410b287e1f5151993c8040ef4e2fcdb210cb2c3f03
Instruction Fuzzy Hash: F9417DF642022C7EEF00EAA4CCC1CFF7F6CEF4A688F144415F905A6001DAB0AA9597B0

Function 03222011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03222078
GetTickCount.KERNEL32 ref: 032220D4
GetTickCount.KERNEL32 ref: 032220DB
GetTickCount.KERNEL32 ref: 0322212B
GetTickCount.KERNEL32 ref: 03222132
GetTickCount.KERNEL32 ref: 03222142

Part of subcall function 0322F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0322E342,00000000,75B4EA50,80000001,00000000,0322E513,?,00000000,00000000,?,000000E4), ref: 0322F089
Part of subcall function 0322F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0322E342,00000000,75B4EA50,80000001,00000000,0322E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0322F093

Part of subcall function 0322E854: lstrcpyA.KERNEL32(00000001,?,?,0322D8DF,00000001,localcfg,except_info,00100000,03230264), ref: 0322E88B
Part of subcall function 0322E854: lstrlenA.KERNEL32(00000001,?,0322D8DF,00000001,localcfg,except_info,00100000,03230264), ref: 0322E899

Part of subcall function 03221C5F: wsprintfA.USER32 ref: 03221CE1

Strings

localcfg, xrefs: 03222070, 03222160, 03222186, 03222194, 032221E4
net_type, xrefs: 032221DF
rbl_bl, xrefs: 03222181
rbl_ip, xrefs: 0322218F

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: d6ed62023f12078c7c02a1ff92d456c977d4454cbb2a777d75e2c0e55d280fd5
Instruction ID: 45ada82df007f013fe7d966a07442d0dcdc54e044cd252b60088366422710cff
Opcode Fuzzy Hash: d6ed62023f12078c7c02a1ff92d456c977d4454cbb2a777d75e2c0e55d280fd5
Instruction Fuzzy Hash: 3651E27491835AFEE728FF24FE49B563FE8EB01710F048C1AE6018A195DBF695C4DA21

Function 0322C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0322A4C7: GetTickCount.KERNEL32 ref: 0322A4D1
Part of subcall function 0322A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0322A4FA

GetTickCount.KERNEL32 ref: 0322C31F
GetTickCount.KERNEL32 ref: 0322C32B
GetTickCount.KERNEL32 ref: 0322C363
GetTickCount.KERNEL32 ref: 0322C378
GetTickCount.KERNEL32 ref: 0322C44D
InterlockedIncrement.KERNEL32(0322C4E4), ref: 0322C4AE
CreateThread.KERNEL32(00000000,00000000,0322B535,00000000,?,0322C4E0), ref: 0322C4C1
CloseHandle.KERNEL32(00000000,?,0322C4E0,03233588,03228810), ref: 0322C4CC

Strings

localcfg, xrefs: 0322C2DD

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: ce4dfa426da17d00b35285b7ccab897965169b6ed33a3097e6e13a10d3fd3c34
Instruction ID: 2879e5c36db687cc403d7a8de0ee5c98be30745b0c5b45e72d42f11e9b5a861c
Opcode Fuzzy Hash: ce4dfa426da17d00b35285b7ccab897965169b6ed33a3097e6e13a10d3fd3c34
Instruction Fuzzy Hash: BD5128B1A10B619FD724DF69C9C492AFBE9FB48300B545D2EE58BC7A90D774E884CB10

Function 0322BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0322BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0322BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0322BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0322BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0322BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0322BF94

Strings

smtp_retr, xrefs: 0322BE61, 0322BF8C
smtp_ban, xrefs: 0322BE55, 0322BF77
smtp_herr, xrefs: 0322BE46, 0322BF62

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 13fea5834dc70c792385eea5f104c7a3617aa75a85050f4445411aac3f728b56
Instruction ID: 47e0787ace93c98b75baf6eba4675c03db410dfea4d1f8a09d0a6fce6a5c48c2
Opcode Fuzzy Hash: 13fea5834dc70c792385eea5f104c7a3617aa75a85050f4445411aac3f728b56
Instruction Fuzzy Hash: 5251B175A2032ABFDB15DBA5CC40AA9BFA9AF05344F488055F9419B215D770E9C18FA0

Function 03226A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226A7D
GetDiskFreeSpaceA.KERNEL32(03229E9D,03229A60,?,?,?,032322F8,?,?,?,03229A60,?,?,03229E9D), ref: 03226ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,03229A60,?,?,03229E9D), ref: 03226B80
GetLastError.KERNEL32(?,?,?,03229A60,?,?,03229E9D,?,?,?,?,?,03229E9D,?,00000022,?), ref: 03226B96

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 9215b1b2461d4d22775243b0829c6c54ed21ed51f387f8a1b8d0c0b82932027c
Instruction ID: d16491a599c6eacdfc2f55be7b470e70f12f15e2a451680a2ac4f920eafd89a0
Opcode Fuzzy Hash: 9215b1b2461d4d22775243b0829c6c54ed21ed51f387f8a1b8d0c0b82932027c
Instruction Fuzzy Hash: E131F2B791025DBFCB01EFA49D88ADEBF79EB48300F18C466F252A7241D7B085848B61

Function 03226F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0322D7C3), ref: 03226F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0322D7C3), ref: 03226FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 03226FE8
LocalFree.KERNEL32(00000120), ref: 0322701F
wsprintfA.USER32 ref: 03227036

Strings

|, xrefs: 03226FB3
/%d, xrefs: 03227030

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 0597908f5001688fb98fb33a34b593d5655c0ac9642010280df5388789a2f0ee
Instruction ID: 96057348eeba3ebf31e7b70f558d90be35455ca17aa17d789cf667521dfa7b64
Opcode Fuzzy Hash: 0597908f5001688fb98fb33a34b593d5655c0ac9642010280df5388789a2f0ee
Instruction Fuzzy Hash: ED312772914219BFDB01DFA8DC48ADE7FBCAF04210F04C066F85ADB101EA74E7488BA4

Function 03226CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,032322F8,000000E4,03226DDC,000000C8), ref: 03226CE7
GetProcAddress.KERNEL32(00000000), ref: 03226CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 03226D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 03226D2B

Strings

C:\Windows\SysWOW64\, xrefs: 03226CC9, 03226CD1, 03226CFE, 03226D05, 03226D13, 03226D1E, 03226D2A, 03226D42, 03226D5F, 03226D85
kernel32, xrefs: 03226CE2
GetSystemWow64DirectoryA, xrefs: 03226CDD

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 5de252a5528dbb357184b03bd99dfecc41b454331396b7a1a014f306f77938e4
Instruction ID: 06ecee726b6db37a18c9fa2a5daedbf925a351b919ccbf7618e0f8fe739c13d0
Opcode Fuzzy Hash: 5de252a5528dbb357184b03bd99dfecc41b454331396b7a1a014f306f77938e4
Instruction Fuzzy Hash: 24215E66662369BEF731E632AC8DF7B6E4C8B17640F0CC484F844BA085C6D594C6C2F5

Function 0322977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,03229947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,032322F8), ref: 032297B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,032322F8), ref: 032297EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,032322F8), ref: 032297F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,032322F8), ref: 03229831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,032322F8), ref: 0322984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,032322F8), ref: 0322985B

Strings

D, xrefs: 032297A9

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 3d287c6270448c0b87b0d757d60b5d114a3e11ad53dda3ba514704f997020f97
Instruction ID: 06c6546dc920456bdbe42591eadac6264ca900f349d8a51a1d26ad34030d44de
Opcode Fuzzy Hash: 3d287c6270448c0b87b0d757d60b5d114a3e11ad53dda3ba514704f997020f97
Instruction Fuzzy Hash: CD211DB1911229BBDB21EFA1DC49EEFBF7CEF05650F044061B919E5144EB709694CAA0

Function 0322E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0322DD05: GetTickCount.KERNEL32 ref: 0322DD0F
Part of subcall function 0322DD05: InterlockedExchange.KERNEL32(032336B4,00000001), ref: 0322DD44
Part of subcall function 0322DD05: GetCurrentThreadId.KERNEL32 ref: 0322DD53

Part of subcall function 0322DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0322DDB5

lstrcpynA.KERNEL32(?,03221E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0322EAAA,?,?), ref: 0322E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0322EAAA,?,?,00000001,?,03221E84,?), ref: 0322E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0322EAAA,?,?,00000001,?,03221E84,?,0000000A), ref: 0322E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0322EAAA,?,?,00000001,?,03221E84,?), ref: 0322E94F

Strings

flags_upd, xrefs: 0322E8A7
localcfg, xrefs: 0322E8AB

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 55badd2b30781129e3fb0bf2842a3ca517baf1a8dcf44fe7edafe831ab266b23
Instruction ID: bd3a4f5719a8d986bbecda8ab2553ab9f4a7f679fe2a5be44116336635d58900
Opcode Fuzzy Hash: 55badd2b30781129e3fb0bf2842a3ca517baf1a8dcf44fe7edafe831ab266b23
Instruction Fuzzy Hash: 51514F7691021AFFCB00EFA8CD84DAEBBF9FF48204F05452AE415A7210D775EA55DBA0

Function 03226BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 03226BB2

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 2a8cfa52f40b0da0bee0c8b005bc204b48adc404b3b3e7e62c168ea7805a9108
Instruction ID: 6d567987cdf8e76adac42a1ab189127381140f8ae00197703f99c7c040ece8ee
Opcode Fuzzy Hash: 2a8cfa52f40b0da0bee0c8b005bc204b48adc404b3b3e7e62c168ea7805a9108
Instruction Fuzzy Hash: 9D214AB7124226FFDB15FBA0FD8CDEF7EACEB44660B108515F502E5084EAB19A809674

Function 03229064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,032322F8), ref: 0322907B
wsprintfA.USER32 ref: 032290E9
CreateFileA.KERNEL32(032322F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0322910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 03229122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0322912D
CloseHandle.KERNEL32(00000000), ref: 03229134

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 6af6b8c88fd5f762c3914818979b4a20d11fa5cca59939ba7fb22dd338edf8bb
Instruction ID: 7f03abe885354c02937ed5034da39370a94c23288b2f9c7c9179f4ca873bd133
Opcode Fuzzy Hash: 6af6b8c88fd5f762c3914818979b4a20d11fa5cca59939ba7fb22dd338edf8bb
Instruction Fuzzy Hash: FA119AB66502247FF724BA72EC0DFEF3A7DDBC5B00F00C065BB0AA5144EAB44A919670

Function 0322DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0322DD0F
GetCurrentThreadId.KERNEL32 ref: 0322DD20
GetTickCount.KERNEL32 ref: 0322DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0322E538,?,76230F10,?,00000000,?,0322A445), ref: 0322DD3B
InterlockedExchange.KERNEL32(032336B4,00000001), ref: 0322DD44
GetCurrentThreadId.KERNEL32 ref: 0322DD53

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: eb4ee137eee201e34d35b37d10e26cdbb6414fd69834905d99c2e2273dfa4308
Instruction ID: b5b8598956ded9894ea546fb73df18b1678cc35d1b77cda364816029e46f4887
Opcode Fuzzy Hash: eb4ee137eee201e34d35b37d10e26cdbb6414fd69834905d99c2e2273dfa4308
Instruction Fuzzy Hash: 22F05E77564214EFD780FB6ABD8CBA97BA9E744212F00C015E60AC2249D66091858E76

Function 0322AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0322AD1C
lstrlenA.KERNEL32(?), ref: 0322AD60
lstrlenA.KERNEL32(?), ref: 0322AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 0322AD7F

Strings

LocalHost, xrefs: 0322AD79

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 72f690add1b1e035400d6abce2521c5355d50e3390183b8d7581cb4deab9f975
Instruction ID: 92f8bebf2f818ee4eaa822009b0266657f894a61dc9147c71087c47f3040aeea
Opcode Fuzzy Hash: 72f690add1b1e035400d6abce2521c5355d50e3390183b8d7581cb4deab9f975
Instruction Fuzzy Hash: 0A016824C641AB7EDF35D628DC44BF87F7AAB87606F088096E4C18B915EF6490C78762

Function 03224280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,032298FD,00000001,00000100,032322F8,0322A3C7), ref: 03224290
CloseHandle.KERNEL32(0322A3C7), ref: 032243AB
CloseHandle.KERNEL32(00000001), ref: 032243AE

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 47662f9d9abc25cdb9f6c2861132e846b4d7b9caf5d14e991eeb1c945f44691d
Instruction ID: a261c3ddfdff62f569f2aab78e07064f19d12d8f20622ba12547b81063b61473
Opcode Fuzzy Hash: 47662f9d9abc25cdb9f6c2861132e846b4d7b9caf5d14e991eeb1c945f44691d
Instruction Fuzzy Hash: D541AFB5820219BADF10EBA2DD85FEFBFBCEF40324F204555F615A6180D7749680DBA0

Function 03226069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0322609C
LoadLibraryA.KERNEL32(?,?,032264CF,00000000), ref: 032260C3
GetProcAddress.KERNEL32(?,00000014), ref: 0322614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0322619E

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: b23f9976b167aea0e0abadbb837cb0093693284ed0ac880a73e80832c1ad9c63
Instruction ID: 873570f8f1abcc25a6f834d0b5f3b264ee3c16d242cdff9113a595d30c47d6d6
Opcode Fuzzy Hash: b23f9976b167aea0e0abadbb837cb0093693284ed0ac880a73e80832c1ad9c63
Instruction Fuzzy Hash: 87414D72A20116BBDB14CF58CC84AA9BBB9FF04754F188069E896D7391D7B0F980CB90

Function 03222923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5973c4eff1ec3c8465f83a6f6ad95c383170b6c64efdebc156ab691aeb45bc41
Instruction ID: d9e7680bfeed46979c9b3efbafe7483ff731ea38e05ff9f12c22222f6e633cb9
Opcode Fuzzy Hash: 5973c4eff1ec3c8465f83a6f6ad95c383170b6c64efdebc156ab691aeb45bc41
Instruction Fuzzy Hash: 8D31B175910329FBCB10DFA5CC81ABEBBF8EF48701F108856E945EA244E3B5D6918B60

Function 032226FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0322272E
htons.WS2_32(00000001), ref: 03222752
htons.WS2_32(0000000F), ref: 032227D5
htons.WS2_32(00000001), ref: 032227E3
sendto.WS2_32(?,03232BF8,00000009,00000000,00000010,00000010), ref: 03222802

Part of subcall function 0322EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0322EBFE,7FFF0001,?,0322DB55,7FFF0001), ref: 0322EBD3
Part of subcall function 0322EBCC: RtlAllocateHeap.NTDLL(00000000,?,0322DB55,7FFF0001), ref: 0322EBDA

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: dd5ac2c80152a3940d4cd9ad38b8e03ca546feac7e250a7e704549facc03cd49
Instruction ID: a73750abbbb255c884535e3e451e3d09ac76b939b5d75f7989b2ef2222b8987f
Opcode Fuzzy Hash: dd5ac2c80152a3940d4cd9ad38b8e03ca546feac7e250a7e704549facc03cd49
Instruction Fuzzy Hash: D9310034258392FFD710EF74F884A697B75AF19318B1AC8ADE8558B312D6739882DB10

Function 03229145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,032322F8), ref: 0322915F
GetModuleFileNameA.KERNEL32(00000000), ref: 03229166
CharToOemA.USER32(?,?), ref: 03229174
wsprintfA.USER32 ref: 032291A9

Part of subcall function 03229064: GetTempPathA.KERNEL32(00000400,?,00000000,032322F8), ref: 0322907B
Part of subcall function 03229064: wsprintfA.USER32 ref: 032290E9
Part of subcall function 03229064: CreateFileA.KERNEL32(032322F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0322910E
Part of subcall function 03229064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 03229122
Part of subcall function 03229064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0322912D
Part of subcall function 03229064: CloseHandle.KERNEL32(00000000), ref: 03229134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 032291E1

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ec3bc9be1b66d7cf3e48618c5c6ae851be7b684f68aeea3ff855ea0e3fe31e1f
Instruction ID: 67b38d52f9438329dfc737d39794dbff4a875480e5d247b5225d32d6e2167949
Opcode Fuzzy Hash: ec3bc9be1b66d7cf3e48618c5c6ae851be7b684f68aeea3ff855ea0e3fe31e1f
Instruction Fuzzy Hash: 230140F69002287BDB20E6619D8DEDF7A7CDB95B01F004091B74AE6040D6B096C5CF70

Function 03222419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,03222491,?,?,?,0322E844,-00000030,?,?,?,00000001), ref: 03222429
lstrlenA.KERNEL32(?,?,03222491,?,?,?,0322E844,-00000030,?,?,?,00000001,03221E3D,00000001,localcfg,lid_file_upd), ref: 0322243E
lstrcmpiA.KERNEL32(?,?), ref: 03222452
lstrlenA.KERNEL32(?,?,03222491,?,?,?,0322E844,-00000030,?,?,?,00000001,03221E3D,00000001,localcfg,lid_file_upd), ref: 03222467

Strings

localcfg, xrefs: 0322241F

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: b49e664d8b5fed5b58d53b3585597cc0146c24f514bb333185f43975f7acb50c
Instruction ID: c70cf4eb31e9c3650795b57fbcc84b8e9ec0d70aab080665bbdc15a572dff2ab
Opcode Fuzzy Hash: b49e664d8b5fed5b58d53b3585597cc0146c24f514bb333185f43975f7acb50c
Instruction Fuzzy Hash: B5011A32A10229FFCF51EF69DC848DEBBB9EF44254B45C825F85997200E331EA80CA90

Function 03221C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 03221CE1
wsprintfA.USER32 ref: 03221D6B

Strings

localcfg, xrefs: 03221C70
%u.%u.%u.%u.%s, xrefs: 03221CDB, 03221D65

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 83dc89269974c8eeb9a183cccba78e38146bea8f29379816c2b6e88eebb8ba05
Instruction ID: b24c47341c5d8fb0e466f2d36e3b38d4b63f988e93089f1b26e3e1c0def579f7
Opcode Fuzzy Hash: 83dc89269974c8eeb9a183cccba78e38146bea8f29379816c2b6e88eebb8ba05
Instruction Fuzzy Hash: 1641BB729042A9AFCB31CFB88C44AEE7FECAF49310F240052F9A4D7142D675E645CBA0

Function 0322E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0322DD05: GetTickCount.KERNEL32 ref: 0322DD0F
Part of subcall function 0322DD05: InterlockedExchange.KERNEL32(032336B4,00000001), ref: 0322DD44
Part of subcall function 0322DD05: GetCurrentThreadId.KERNEL32 ref: 0322DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,03225EC1), ref: 0322E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,03225EC1), ref: 0322E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,76230F10,00000000,?,03225EC1), ref: 0322E722

Strings

89ABCDEF, xrefs: 0322E721

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: feb37bba2c2eb22325e0adb645ccb5af063cc31d4d5df9921aaef3e5336394f9
Instruction ID: d9c3bbf6e279da95b84cafe3d433d60855c7dbf6ca1ebf7466c0ef7fd780ae5a
Opcode Fuzzy Hash: feb37bba2c2eb22325e0adb645ccb5af063cc31d4d5df9921aaef3e5336394f9
Instruction Fuzzy Hash: FA31D031520B22EBCB31CE60DC88BA67FE8AF01710F0A886AE4568B540D770E8C4DB91

Function 0322E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0322E2A3,00000000,00000000,00000000,00020106,00000000,0322E2A3,00000000,000000E4), ref: 0322E0B2
RegSetValueExA.ADVAPI32(0322E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,032322F8), ref: 0322E127
RegDeleteValueA.ADVAPI32(0322E2A3,?,?,?,?,?,000000C8,032322F8), ref: 0322E158
RegCloseKey.ADVAPI32(0322E2A3,?,?,?,?,000000C8,032322F8,?,?,?,?,?,?,?,?,0322E2A3), ref: 0322E161

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 44c9e930bdfaeabe19ae528be796b155dbf2c318185382f73a65d400d76f3d22
Instruction ID: 2056257f8a8da3f6399995ddc2ec61e305ca41b341f3b6dcc65104ee31248308
Opcode Fuzzy Hash: 44c9e930bdfaeabe19ae528be796b155dbf2c318185382f73a65d400d76f3d22
Instruction Fuzzy Hash: E0219171A1022ABBDF20DEA4DC89EDF7F7DEF09B50F048061F905E6050E6718A55DBA0

Function 03223F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0322A3C7,00000000,00000000,000007D0,00000001), ref: 03223F44
GetLastError.KERNEL32 ref: 03223F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 03223F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 03223F72

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: d7c0206960a01717946cbb78e8d413c63f183f2839096ebc4eb13a34955434cc
Instruction ID: 9849b1f420e666ad6b9c7ac5c63680bc1203251cba31b96708eba90710482518
Opcode Fuzzy Hash: d7c0206960a01717946cbb78e8d413c63f183f2839096ebc4eb13a34955434cc
Instruction Fuzzy Hash: 0C01087252111ABBDF01EF90ED88BEF7BBCEB04255F508065FA02E6040D774DA548BB2

Function 03223F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0322A3C7,00000000,00000000,000007D0,00000001), ref: 03223FB8
GetLastError.KERNEL32 ref: 03223FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 03223FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 03223FE6

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 84183a3152d8963a460838e7f33e9954cf975a7875c37ad710770f39003a0ded
Instruction ID: 5d556fd2c20270337eb05b8820d0dcff44ccd967ba453cccddf8e95fa436e2e8
Opcode Fuzzy Hash: 84183a3152d8963a460838e7f33e9954cf975a7875c37ad710770f39003a0ded
Instruction Fuzzy Hash: A201A97252021AABDF11DF94ED89BEE7B7CEB04255F108051FA02E6090DB74DA548BB1

Function 03224BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03224BDD
GetTickCount.KERNEL32 ref: 03224BEC
Sleep.KERNEL32(00000000,?,?,?,0361E084,032250F2), ref: 03224BF9
InterlockedExchange.KERNEL32(0361E078,00000001), ref: 03224C02

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 9f5d4f3746b598b0e51ec7d02ab10e8c83af6137a6b36ebc37f00ea8ef6f958a
Instruction ID: 4200c0e565b320468c285a7da0953746a5face2846d495f017e80050ad69face
Opcode Fuzzy Hash: 9f5d4f3746b598b0e51ec7d02ab10e8c83af6137a6b36ebc37f00ea8ef6f958a
Instruction Fuzzy Hash: 2EE07D3371022437C70072BF7C88FDA7B5CDB45262F068072F70AC2140C992E48041B1

Function 03224E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03224E9E
GetTickCount.KERNEL32 ref: 03224EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 03224EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 03224EC3

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 26c4a2bf402f4202a09d7a5e34a36354800673e503854d77ed20a22a8d511992
Instruction ID: 3f5aecc744148ef2a8c23eb5526626fc295d46f2de3e9ad8a8e8dc57b991d5d1
Opcode Fuzzy Hash: 26c4a2bf402f4202a09d7a5e34a36354800673e503854d77ed20a22a8d511992
Instruction Fuzzy Hash: DEE07D3331022437E60072BFFC88F9A7B4D9B45270F014172F70AC2144C596D48205F1

Function 0322A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0322A4D1
GetTickCount.KERNEL32 ref: 0322A4E4
Sleep.KERNEL32(00000000,?,0322C2E9,0322C4E0,00000000,localcfg,?,0322C4E0,03233588,03228810), ref: 0322A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0322A4FA

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 72712b7fbc92dccd72e1f8b608ce961c8925c9bace070de7b95b3b7a77c1ec44
Instruction ID: edf1d3e3f1efd789533288a206291ab002d696765e75aebdb84bf5ac59c805c7
Opcode Fuzzy Hash: 72712b7fbc92dccd72e1f8b608ce961c8925c9bace070de7b95b3b7a77c1ec44
Instruction Fuzzy Hash: 1DE026332102256BC600A7A9BD88FAB3B9CAB4D661F058061FA05D3540DA56E48181B2

Function 032230FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03223103
GetTickCount.KERNEL32 ref: 0322310F
Sleep.KERNEL32(00000000), ref: 0322311C
InterlockedExchange.KERNEL32(?,00000001), ref: 03223128

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 009bdbc93ab3f489e2a376b86cbcae55cc14d825d1fcb97968a9fb50981c6503
Instruction ID: f310eeadf84ccb91a235db2387aeefa12b8f5f88f899f0d5c661d796d46abcf7
Opcode Fuzzy Hash: 009bdbc93ab3f489e2a376b86cbcae55cc14d825d1fcb97968a9fb50981c6503
Instruction Fuzzy Hash: 20E0C23A620235BBDB00FB7ABD48B896E5EEF84B61F018071F702E2094C6A488408971

Function 03228CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 03228D02
GetTickCount.KERNEL32 ref: 03228DA1

Strings

localcfg, xrefs: 03228D19

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f1957ab502f868e9ab46b572ab83d9d439713fb2ee254f7040e737e4f453be0e
Instruction ID: 447773bf3f6c084a7e6d1c8c45b9d87c8d573b8fb07ef7f224a50ad7956f9f9f
Opcode Fuzzy Hash: f1957ab502f868e9ab46b572ab83d9d439713fb2ee254f7040e737e4f453be0e
Instruction Fuzzy Hash: 4D21B437A30626BFDB10DF78EC955AABFB9FB20251B2D8059D401DB511CB74E988CB50

Function 0322BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0322BFD0
wsprintfA.USER32 ref: 0322C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0322C057

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 7ee40c019be66d3e9f18f83254c945a2c4c6baa352d51785e5d58406b5c7a507
Instruction ID: e582d257fbc2f53fb0c2804d99290aea1579d6cb25b8fdfc74728f86cac53d64
Opcode Fuzzy Hash: 7ee40c019be66d3e9f18f83254c945a2c4c6baa352d51785e5d58406b5c7a507
Instruction Fuzzy Hash: C6119772100100FFDB429AA9DD48E567FA6FF88718B34819CF6188E126D633D863EB50

Function 032226B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 032226C3
inet_ntoa.WS2_32(?), ref: 032226E4

Strings

localcfg, xrefs: 032226CD, 032226D2, 032226DE

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: dec033c9d5da556ef2b07957d79c1451fb1e82d50be95ff0b4d79109e37e51d9
Instruction ID: 09b5f34e1d48028b01ff453813fc266c0a2a1f698048d9568b5c34c9261e9ce8
Opcode Fuzzy Hash: dec033c9d5da556ef2b07957d79c1451fb1e82d50be95ff0b4d79109e37e51d9
Instruction Fuzzy Hash: DFF03737268319BFEF04EFA4EC09EAA3B9CDF05650F148465F909DE090DBB1D5809798

Function 0322EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0322EB54,_alldiv,0322F0B7,80000001,00000000,00989680,00000000,?,?,?,0322E342,00000000,75B4EA50,80000001,00000000), ref: 0322EAF2
GetProcAddress.KERNEL32(77310000,00000000), ref: 0322EB07

Strings

ntdll.dll, xrefs: 0322EAED

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: 3fd822e7af76d8e1da4f9dd550107a5b3056e0a21f40a3d9c06dd1fef967ee85
Instruction ID: 783bad281795d295aab63c9a7a5b0adf32706804d316ee78ee2a03732a072bd6
Opcode Fuzzy Hash: 3fd822e7af76d8e1da4f9dd550107a5b3056e0a21f40a3d9c06dd1fef967ee85
Instruction Fuzzy Hash: 34D0C978A65303AFCF52EF65F94E9597AACBB40A01B40C095B55BC1505E730D494EA14

Function 03222F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03222D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,03222F01,?,032220FF,03232000), ref: 03222D3A
Part of subcall function 03222D21: LoadLibraryA.KERNEL32(?), ref: 03222D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 03222F73
HeapFree.KERNEL32(00000000), ref: 03222F7A

Memory Dump Source

Source File: 00000010.00000002.3382908601.0000000003220000.00000040.00000400.00020000.00000000.sdmp, Offset: 03220000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_3220000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 277335bce8bc33e54ba65d6acc3b11c2eedeac00cb1c53596c7e9e704ebdca64
Instruction ID: 24f569a697c59664d8383c059405ecb2534122272624e4bba826f97c5064b21a
Opcode Fuzzy Hash: 277335bce8bc33e54ba65d6acc3b11c2eedeac00cb1c53596c7e9e704ebdca64
Instruction Fuzzy Hash: 9B51C07591022AEFCB01DF64DC889F9BB79FF05300F1485A9ED96D7210E7329A59CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rXTqHar5Ud.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\dpbgdjiw.exe

C:\Windows\SysWOW64\dkajlqvv\dpbgdjiw.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
rXTqHar5Ud.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre