Edit tour

Windows Analysis Report
UsoOuMVYCv8QrxG.exe

Overview

General Information

Sample name:	UsoOuMVYCv8QrxG.exe
Analysis ID:	1517890
MD5:	fce19affe7db15edd2b851ea84cd37ad
SHA1:	143e9f5102833d028aca51437854e4a56f1dde11
SHA256:	26ed62c404f08cb73c5f52cf8df52546a0c69bef2c50a577afa65a515da0cb22
Tags:	exeuser-lowmal3
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Injects a PE file into a foreign processes

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

UsoOuMVYCv8QrxG.exe (PID: 4016 cmdline: "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe" MD5: FCE19AFFE7DB15EDD2B851EA84CD37AD)

UsoOuMVYCv8QrxG.exe (PID: 4208 cmdline: "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe" MD5: FCE19AFFE7DB15EDD2B851EA84CD37AD)

UsoOuMVYCv8QrxG.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe" MD5: FCE19AFFE7DB15EDD2B851EA84CD37AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "192.3.64.152:2559:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TS121V", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b708:$a1: Remcos restarted by watchdog! 0x6bc80:$a3: %02i:%02i:%02i:%03i
00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x132098:$a1: Remcos restarted by watchdog! 0x1536b8:$a1: Remcos restarted by watchdog! 0x132610:$a3: %02i:%02i:%02i:%03i 0x153c30:$a3: %02i:%02i:%02i:%03i
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x1c1b4:$a1: Remcos restarted by watchdog! 0x4b9dc:$a1: Remcos restarted by watchdog! 0x1c70e:$a3: %02i:%02i:%02i:%03i 0x1cb3d:$a3: %02i:%02i:%02i:%03i 0x4bf36:$a3: %02i:%02i:%02i:%03i 0x4c365:$a3: %02i:%02i:%02i:%03i
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xd39c:$a1: Remcos restarted by watchdog! 0xd8f6:$a3: %02i:%02i:%02i:%03i 0xdd25:$a3: %02i:%02i:%02i:%03i
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x690a8:$a1: Remcos restarted by watchdog! 0x69620:$a3: %02i:%02i:%02i:%03i
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack	REMCOS_RAT_variants	unknown	unknown	0x630fc:$str_a1: C:\Windows\System32\cmd.exe 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6316c:$str_b2: Executing file: 0x641ec:$str_b3: GetDirectListeningPort 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63d18:$str_b7: \update.vbs 0x63194:$str_b9: Downloaded file: 0x63180:$str_b10: Downloading file: 0x63224:$str_b12: Failed to upload file: 0x641b4:$str_b13: StartForward 0x641d4:$str_b14: StopForward 0x63c70:$str_b15: fso.DeleteFile " 0x63c04:$str_b16: On Error Resume Next 0x63ca0:$str_b17: fso.DeleteFolder " 0x63214:$str_b18: Uploaded file: 0x631d4:$str_b19: Unable to delete: 0x63c38:$str_b20: while fso.FileExists(" 0x636b1:$str_c0: [Firefox StoredLogins not found]
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x62f7c:$s1: CoGetObject 0x62f90:$s1: CoGetObject 0x62fac:$s1: CoGetObject 0x6cf38:$s1: CoGetObject 0x62f3c:$s2: Elevation:Administrator!new:
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x8c0c8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i 0x8c640:$a3: %02i:%02i:%02i:%03i
0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x86008:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x85f9c:$s1: CoGetObject 0x85fb0:$s1: CoGetObject 0x85fcc:$s1: CoGetObject 0x8ff58:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new: 0x85f5c:$s2: Elevation:Administrator!new:
Click to see the 23 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: DA 76 22 27 90 A5 F3 EE 3C 26 53 C2 B0 E9 C9 81 3F 2B 17 12 FD 34 BC 93 9D CD 9A 50 69 F9 46 E9 2F 89 A6 48 E7 DE A7 3D D2 CC C0 F8 6C D7 0D 73 95 E0 8C 08 7D 23 31 BB 36 75 76 20 DC E9 47 A8 ED 17 EC E3 5A 64 BA 0D 82 08 90 8D F2 F5 7A 8F DD 46 2D 38 6A 35 EB 46 54 89 53 72 , EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, ProcessId: 6508, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-TS121V\exepath

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T08:47:08.223485+0200	2036594	1	Malware Command and Control Activity Detected	192.168.2.6	49712	192.3.64.152	2559	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T08:47:10.635343+0200	2803304	3	Unknown Traffic	192.168.2.6	49715	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "192.3.64.152:2559:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-TS121V", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for submitted file

Source: UsoOuMVYCv8QrxG.exe

ReversingLabs: Detection: 21%

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: UsoOuMVYCv8QrxG.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

4_2_00433837

Source: UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6199235e-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_004074FD _wcslen,CoGetObject,

4_2_004074FD

Source: UsoOuMVYCv8QrxG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: UsoOuMVYCv8QrxG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: txzc.pdb source: UsoOuMVYCv8QrxG.exe
Source:	Binary string: txzc.pdbSHA256 source: UsoOuMVYCv8QrxG.exe

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49712 -> 192.3.64.152:2559

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 192.3.64.152

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.64.152
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_0041B380

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: geoplugin.net

Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpO
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

4_2_0040A2B8

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_004168C1

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

4_2_0040B70E

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

4_2_0040A3E0

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041C9E2 SystemParametersInfoW,

4_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	4_2_004132D2
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	4_2_0041BB09
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	4_2_0041BB35

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

4_2_004167B4

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_0320DEEC	0_2_0320DEEC
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_05800007	0_2_05800007
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_05800040	0_2_05800040
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08084898	0_2_08084898
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08084451	0_2_08084451
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08084CC0	0_2_08084CC0
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08084CD0	0_2_08084CD0
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_0808B4D0	0_2_0808B4D0
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08086530	0_2_08086530
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_08086E08	0_2_08086E08
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0043E0CC	4_2_0043E0CC
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041F0FA	4_2_0041F0FA
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00454159	4_2_00454159
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00438168	4_2_00438168
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_004461F0	4_2_004461F0
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0043E2FB	4_2_0043E2FB
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0045332B	4_2_0045332B
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0042739D	4_2_0042739D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_004374E6	4_2_004374E6
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0043E558	4_2_0043E558
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00438770	4_2_00438770
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_004378FE	4_2_004378FE
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00433946	4_2_00433946
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0044D9C9	4_2_0044D9C9
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00427A46	4_2_00427A46
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041DB62	4_2_0041DB62
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00427BAF	4_2_00427BAF
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00437D33	4_2_00437D33
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00435E5E	4_2_00435E5E
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00426E0E	4_2_00426E0E
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0043DE9D	4_2_0043DE9D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00413FCA	4_2_00413FCA
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00436FEA	4_2_00436FEA

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: String function: 00401E65 appears 35 times

Source: UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UsoOuMVYCv8QrxG.exe
Source: UsoOuMVYCv8QrxG.exe, 00000000.00000002.2134202113.000000000158E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UsoOuMVYCv8QrxG.exe
Source: UsoOuMVYCv8QrxG.exe, 00000000.00000000.2116921634.0000000000F76000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametxzc.exe> vs UsoOuMVYCv8QrxG.exe
Source: UsoOuMVYCv8QrxG.exe, 00000000.00000002.2138141527.00000000084C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UsoOuMVYCv8QrxG.exe
Source: UsoOuMVYCv8QrxG.exe	Binary or memory string: OriginalFilenametxzc.exe> vs UsoOuMVYCv8QrxG.exe

Source: UsoOuMVYCv8QrxG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: UsoOuMVYCv8QrxG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, GQeV0NvZ68G4mo6hRI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, GQeV0NvZ68G4mo6hRI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, qE4A89LEQLVRR3vg7U.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@5/2@1/2

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

4_2_00417952

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

4_2_0040F474

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

4_2_0041B4A8

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UsoOuMVYCv8QrxG.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-TS121V
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Mutant created: NULL

Source: UsoOuMVYCv8QrxG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UsoOuMVYCv8QrxG.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UsoOuMVYCv8QrxG.exe

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: UsoOuMVYCv8QrxG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UsoOuMVYCv8QrxG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: UsoOuMVYCv8QrxG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: txzc.pdb source: UsoOuMVYCv8QrxG.exe
Source:	Binary string: txzc.pdbSHA256 source: UsoOuMVYCv8QrxG.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: UsoOuMVYCv8QrxG.exe, MainForm.cs	.Net Code: InitializeComponent
Source: 0.2.UsoOuMVYCv8QrxG.exe.32e99c4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.32dc814.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.8000000.7.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, qE4A89LEQLVRR3vg7U.cs	.Net Code: ImC2V0YLvb System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.329a1fc.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, qE4A89LEQLVRR3vg7U.cs	.Net Code: ImC2V0YLvb System.Reflection.Assembly.Load(byte[])
Source: 0.2.UsoOuMVYCv8QrxG.exe.328d9d4.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])

Source: UsoOuMVYCv8QrxG.exe

Static PE information: 0x8635F06E [Thu May 9 03:11:42 2041 UTC]

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_0041CB50

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_0580EB08 pushfd ; iretd	0_2_0580EB09
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_05831704 pushfd ; iretd	0_2_05832F8D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 0_2_05832EEB pushfd ; iretd	0_2_05832F8D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00457106 push ecx; ret	4_2_00457119
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0045B11A push esp; ret	4_2_0045B141
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0045E54D push esi; ret	4_2_0045E556
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00457A28 push eax; ret	4_2_00457A46
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00434E56 push ecx; ret	4_2_00434E69

Source: UsoOuMVYCv8QrxG.exe

Static PE information: section name: .text entropy: 7.89619188199847

Source: 0.2.UsoOuMVYCv8QrxG.exe.32e99c4.0.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.UsoOuMVYCv8QrxG.exe.32e99c4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.32dc814.2.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.UsoOuMVYCv8QrxG.exe.32dc814.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.8000000.7.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.UsoOuMVYCv8QrxG.exe.8000000.7.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, XfmbedHfTmndsCUAdI.cs	High entropy of concatenated method names: 'h0xVb3Eq2', 'WB4TIda1r', 'ke4Lk8OTx', 'ffM9U0skI', 'w6pBMajkw', 'g7yMj1UaB', 'k1CwlVZU7bMF5rEvlH', 'I1dkTikgrTJL2Dokor', 'SIaHn2LXE', 'Rp0JHNJnB'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, Kr1DKY20AVdUZGMlvM1.cs	High entropy of concatenated method names: 'UIH7Yh7hHN', 'qRn7GSKn1x', 'JFy7V92K1T', 'G2f7T0Hdu2', 'Ejg7bGCtw8', 'Krl7LqtPP1', 'Jxi79FxsOY', 'VPN76nnSbv', 'zxd7BTENvd', 'swP7MAmq0R'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, GQeV0NvZ68G4mo6hRI.cs	High entropy of concatenated method names: 'qQkq1nkvA0', 'pNDqkAmCmv', 'JcGquJTWpb', 'eEVqRr6Auu', 'z2Zq4D3Hf9', 'sFVqaxuiKZ', 'S3ZqZ6QsTY', 'rBYqPcnGqT', 'UJGqABmxct', 'idOq0QNpSw'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, AYeZ3t9Cldm65rOXiY.cs	High entropy of concatenated method names: 'HZ9oQqjZpT', 'RhaoqEc7bK', 'WWloc9Lb4k', 'FrloFntuvX', 'jhfoCq7UJj', 'NhTc4SL70V', 'ewQca1YhGl', 'BvIcZHC1aI', 'WhOcPWjfLb', 'yl2cA68EXr'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, Pe3GjfQeAKKF5bEAR5.cs	High entropy of concatenated method names: 'BFWdPtbRrn', 'RAid08EsYJ', 'PMiHrPegV9', 'R5pHy72Gta', 'LZDdjpOWaS', 'YOkdU3cRHX', 'OFUdnFHfT3', 'EWNd1foHt7', 'Wa8dkkofLH', 'J0ldub0To9'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, PO60Qrj7RPVwTBrHkq.cs	High entropy of concatenated method names: 'Ok0Fvbqiy5', 'wsQF5mHUmF', 'jeFFodcuv9', 'XoTo0IM2LG', 'DrWozmQrto', 'hKyFrsjuDt', 'lrfFycEvUE', 'ax1Fe8fvXs', 'nBPFIdG0aA', 'P1QF2T5XZG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, TeqThy7YVdM9Z7TprN.cs	High entropy of concatenated method names: 'arEyFBHHui', 'lw6yCnLoqV', 'jfEyDZPwpp', 'mSAypGxiLp', 'JRWyfynxoP', 'afkyxtFZnh', 'Fhq1EyLVfW0MZvkB4D', 'RrKbrbBiBlyx4KCoGy', 'WS8yybmHbG', 'auYyIaGs0e'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, QTRMetYZ1qXeI4wbGC.cs	High entropy of concatenated method names: 'Dispose', 'FsByAZ6ldd', 'BXSemYjMEU', 'NYIttCWqux', 'rMwy0IHdyn', 'uyUyzt6tr4', 'ProcessDialogKey', 'nfUerOVTbn', 'V7aeyoyQh2', 'H0Ceei0iLa'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, doDWQ9SPCai0eihHV3.cs	High entropy of concatenated method names: 'IWVouPS9pN', 'U5PoRYKH2S', 'bhao4ippy6', 'ToString', 'unIoaGlSLB', 'd0RoZUTA1M', 'Ps2hvswysTa9nKpOkhe', 'CO1NL3w5ADJQBm8PfSn'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, BcXyBMyFTH0rOb6w8C.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'A3keAmlMLT', 'T4oe0U7g2k', 'n2Xez19ygH', 'VmsIrw0MpT', 'gq8IytBrOr', 'HeEIeK6vMP', 'T4wII3FU5H', 'dZiZpOb1pdvk3xGrb2r'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, qE4A89LEQLVRR3vg7U.cs	High entropy of concatenated method names: 'cDGIQkSiXp', 'K8LIvOZ4Tt', 'vNiIqek5th', 'uI6I5QE6Yt', 'pNRIcJISEW', 'qhVIoi2euc', 'aLiIFocRcd', 'YWpICEto9q', 'XlLIwCCy57', 'TiKIDXfw1M'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, oJLRnThhYqeS5TtRMa.cs	High entropy of concatenated method names: 'Jl1HvB4CEk', 'j5THqTNVY8', 'wmnH5i0uhk', 'C68HcY3n7w', 'hIwHoTExVa', 'uaBHF94O2O', 'YAgHC1tG2I', 'TCqHwaTtgJ', 'hG3HDWDFdM', 'L3cHplpfVn'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, uSWMBLdUA8mMyZ4fnE.cs	High entropy of concatenated method names: 'unTFYYBoH4', 'nfrFGQEJJP', 'LvFFVNhB9r', 'qdvFTM1vfw', 'IwjFbEUXJ6', 'PgvFLCBgCk', 'le9F9N6Ra7', 'bVCF65Hrcy', 'lB6FBs6PVx', 'D5SFM9rJvq'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, WVBpp6g7PfW8oRt3ll.cs	High entropy of concatenated method names: 'Cc1cbrxupb', 'zQic9aAtKy', 'l9j5lpESiG', 'uIy5X8nI0k', 'UfA58IYvy6', 'cIX5OZl487', 't2d5gSZSf7', 'gFa5NYyNgx', 'lZ853GFyfI', 'B4c5KhlPTt'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, SFy7j52frmYeoGptwdx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vy3J1xKWCJ', 'qlvJk71eTp', 'hkIJu3I2JG', 'ENcJRiq8eS', 'kKYJ4v7Ox0', 'ga5JaY01gH', 'eAVJZBrHbX'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, lWbhmQVJF07KMSEM7Z.cs	High entropy of concatenated method names: 'IrxfKRgpkS', 'SxUfUyLFMY', 'bNFf1Yu8xj', 'kCTfkUXhOT', 'm0Kfmscd1r', 'NM7flV2c0m', 'wZcfXXCfyt', 'esHf8aV8ea', 'PFwfObwCRH', 'jPtfgA36LB'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, wlZqEFzn9ZyEPDBkA5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TZ47EWia4M', 'Fch7f9Z76N', 'vm27xxdXd7', 'tJr7dWUICj', 'TLg7HJDwln', 'gb1772pSps', 'Vs17JV7aE2'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, YGoTn3K3RECmdm3iEa.cs	High entropy of concatenated method names: 'ibE7yLYdXL', 'nh27Ixw9KT', 'rxv72dsJpv', 'pkm7vgehmA', 'rGk7qRS1wc', 'vJf7cBG7i0', 'j9P7oNHwZm', 'epSHZrku5D', 'HNRHPJtEyo', 'OlyHAys10S'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, fbH8SLNCAyHiyKsaDZ.cs	High entropy of concatenated method names: 'TBW5TqZOsC', 'tvA5L46oPO', 'RHt56RRrub', 'W505ByJxBy', 'KyW5fo2NZe', 'mEq5x8V3Dr', 'Or65drj9R7', 'utM5HTAhpe', 'dgI57fEeqC', 'Cdc5J00Z6S'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, aZCFgpuKfMLf0L4o0C.cs	High entropy of concatenated method names: 'pVJHWg7eyA', 'aD7HmMdJbf', 'dteHll7lUT', 'eSKHXI63mC', 'OORH1Pd1lO', 'sIMH8V3caB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UsoOuMVYCv8QrxG.exe.84c0000.8.raw.unpack, vOZ745qej3iO9JsUVW.cs	High entropy of concatenated method names: 'MrME61yuSi', 'h2CEBEupRr', 'wChEWf8DyI', 'LkjEmEPXk0', 'HqNEXeKSHj', 'jucE8H8y9V', 'esFEgZtPrh', 'Y1ZENuoGrn', 'AB9EKLA8Ll', 'yReEjajKUv'
Source: 0.2.UsoOuMVYCv8QrxG.exe.329a1fc.1.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.UsoOuMVYCv8QrxG.exe.329a1fc.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, XfmbedHfTmndsCUAdI.cs	High entropy of concatenated method names: 'h0xVb3Eq2', 'WB4TIda1r', 'ke4Lk8OTx', 'ffM9U0skI', 'w6pBMajkw', 'g7yMj1UaB', 'k1CwlVZU7bMF5rEvlH', 'I1dkTikgrTJL2Dokor', 'SIaHn2LXE', 'Rp0JHNJnB'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, Kr1DKY20AVdUZGMlvM1.cs	High entropy of concatenated method names: 'UIH7Yh7hHN', 'qRn7GSKn1x', 'JFy7V92K1T', 'G2f7T0Hdu2', 'Ejg7bGCtw8', 'Krl7LqtPP1', 'Jxi79FxsOY', 'VPN76nnSbv', 'zxd7BTENvd', 'swP7MAmq0R'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, GQeV0NvZ68G4mo6hRI.cs	High entropy of concatenated method names: 'qQkq1nkvA0', 'pNDqkAmCmv', 'JcGquJTWpb', 'eEVqRr6Auu', 'z2Zq4D3Hf9', 'sFVqaxuiKZ', 'S3ZqZ6QsTY', 'rBYqPcnGqT', 'UJGqABmxct', 'idOq0QNpSw'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, AYeZ3t9Cldm65rOXiY.cs	High entropy of concatenated method names: 'HZ9oQqjZpT', 'RhaoqEc7bK', 'WWloc9Lb4k', 'FrloFntuvX', 'jhfoCq7UJj', 'NhTc4SL70V', 'ewQca1YhGl', 'BvIcZHC1aI', 'WhOcPWjfLb', 'yl2cA68EXr'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, Pe3GjfQeAKKF5bEAR5.cs	High entropy of concatenated method names: 'BFWdPtbRrn', 'RAid08EsYJ', 'PMiHrPegV9', 'R5pHy72Gta', 'LZDdjpOWaS', 'YOkdU3cRHX', 'OFUdnFHfT3', 'EWNd1foHt7', 'Wa8dkkofLH', 'J0ldub0To9'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, PO60Qrj7RPVwTBrHkq.cs	High entropy of concatenated method names: 'Ok0Fvbqiy5', 'wsQF5mHUmF', 'jeFFodcuv9', 'XoTo0IM2LG', 'DrWozmQrto', 'hKyFrsjuDt', 'lrfFycEvUE', 'ax1Fe8fvXs', 'nBPFIdG0aA', 'P1QF2T5XZG'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, TeqThy7YVdM9Z7TprN.cs	High entropy of concatenated method names: 'arEyFBHHui', 'lw6yCnLoqV', 'jfEyDZPwpp', 'mSAypGxiLp', 'JRWyfynxoP', 'afkyxtFZnh', 'Fhq1EyLVfW0MZvkB4D', 'RrKbrbBiBlyx4KCoGy', 'WS8yybmHbG', 'auYyIaGs0e'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, QTRMetYZ1qXeI4wbGC.cs	High entropy of concatenated method names: 'Dispose', 'FsByAZ6ldd', 'BXSemYjMEU', 'NYIttCWqux', 'rMwy0IHdyn', 'uyUyzt6tr4', 'ProcessDialogKey', 'nfUerOVTbn', 'V7aeyoyQh2', 'H0Ceei0iLa'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, doDWQ9SPCai0eihHV3.cs	High entropy of concatenated method names: 'IWVouPS9pN', 'U5PoRYKH2S', 'bhao4ippy6', 'ToString', 'unIoaGlSLB', 'd0RoZUTA1M', 'Ps2hvswysTa9nKpOkhe', 'CO1NL3w5ADJQBm8PfSn'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, BcXyBMyFTH0rOb6w8C.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'A3keAmlMLT', 'T4oe0U7g2k', 'n2Xez19ygH', 'VmsIrw0MpT', 'gq8IytBrOr', 'HeEIeK6vMP', 'T4wII3FU5H', 'dZiZpOb1pdvk3xGrb2r'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, qE4A89LEQLVRR3vg7U.cs	High entropy of concatenated method names: 'cDGIQkSiXp', 'K8LIvOZ4Tt', 'vNiIqek5th', 'uI6I5QE6Yt', 'pNRIcJISEW', 'qhVIoi2euc', 'aLiIFocRcd', 'YWpICEto9q', 'XlLIwCCy57', 'TiKIDXfw1M'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, oJLRnThhYqeS5TtRMa.cs	High entropy of concatenated method names: 'Jl1HvB4CEk', 'j5THqTNVY8', 'wmnH5i0uhk', 'C68HcY3n7w', 'hIwHoTExVa', 'uaBHF94O2O', 'YAgHC1tG2I', 'TCqHwaTtgJ', 'hG3HDWDFdM', 'L3cHplpfVn'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, uSWMBLdUA8mMyZ4fnE.cs	High entropy of concatenated method names: 'unTFYYBoH4', 'nfrFGQEJJP', 'LvFFVNhB9r', 'qdvFTM1vfw', 'IwjFbEUXJ6', 'PgvFLCBgCk', 'le9F9N6Ra7', 'bVCF65Hrcy', 'lB6FBs6PVx', 'D5SFM9rJvq'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, WVBpp6g7PfW8oRt3ll.cs	High entropy of concatenated method names: 'Cc1cbrxupb', 'zQic9aAtKy', 'l9j5lpESiG', 'uIy5X8nI0k', 'UfA58IYvy6', 'cIX5OZl487', 't2d5gSZSf7', 'gFa5NYyNgx', 'lZ853GFyfI', 'B4c5KhlPTt'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, SFy7j52frmYeoGptwdx.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vy3J1xKWCJ', 'qlvJk71eTp', 'hkIJu3I2JG', 'ENcJRiq8eS', 'kKYJ4v7Ox0', 'ga5JaY01gH', 'eAVJZBrHbX'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, lWbhmQVJF07KMSEM7Z.cs	High entropy of concatenated method names: 'IrxfKRgpkS', 'SxUfUyLFMY', 'bNFf1Yu8xj', 'kCTfkUXhOT', 'm0Kfmscd1r', 'NM7flV2c0m', 'wZcfXXCfyt', 'esHf8aV8ea', 'PFwfObwCRH', 'jPtfgA36LB'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, wlZqEFzn9ZyEPDBkA5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'TZ47EWia4M', 'Fch7f9Z76N', 'vm27xxdXd7', 'tJr7dWUICj', 'TLg7HJDwln', 'gb1772pSps', 'Vs17JV7aE2'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, YGoTn3K3RECmdm3iEa.cs	High entropy of concatenated method names: 'ibE7yLYdXL', 'nh27Ixw9KT', 'rxv72dsJpv', 'pkm7vgehmA', 'rGk7qRS1wc', 'vJf7cBG7i0', 'j9P7oNHwZm', 'epSHZrku5D', 'HNRHPJtEyo', 'OlyHAys10S'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, fbH8SLNCAyHiyKsaDZ.cs	High entropy of concatenated method names: 'TBW5TqZOsC', 'tvA5L46oPO', 'RHt56RRrub', 'W505ByJxBy', 'KyW5fo2NZe', 'mEq5x8V3Dr', 'Or65drj9R7', 'utM5HTAhpe', 'dgI57fEeqC', 'Cdc5J00Z6S'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, aZCFgpuKfMLf0L4o0C.cs	High entropy of concatenated method names: 'pVJHWg7eyA', 'aD7HmMdJbf', 'dteHll7lUT', 'eSKHXI63mC', 'OORH1Pd1lO', 'sIMH8V3caB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UsoOuMVYCv8QrxG.exe.43daa10.6.raw.unpack, vOZ745qej3iO9JsUVW.cs	High entropy of concatenated method names: 'MrME61yuSi', 'h2CEBEupRr', 'wChEWf8DyI', 'LkjEmEPXk0', 'HqNEXeKSHj', 'jucE8H8y9V', 'esFEgZtPrh', 'Y1ZENuoGrn', 'AB9EKLA8Ll', 'yReEjajKUv'
Source: 0.2.UsoOuMVYCv8QrxG.exe.328d9d4.3.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.UsoOuMVYCv8QrxG.exe.328d9d4.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

4_2_00406EB0

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

4_2_0041AA4A

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

4_2_0041CB50

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0040F7A7 Sleep,ExitProcess,

4_2_0040F7A7

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 3250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 5250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 8680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 9680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: 9850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Memory allocated: A850000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

4_2_0041A748

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Window / User API: threadDelayed 1146			Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Window / User API: threadDelayed 8849			Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe TID: 4072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe TID: 3820	Thread sleep count: 1146 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe TID: 3820	Thread sleep time: -3438000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe TID: 3820	Thread sleep count: 8849 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe TID: 3820	Thread sleep time: -26547000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409253
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	4_2_0041C291
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	4_2_0040C34D
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	4_2_00409665
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0044E879 FindFirstFileExA,	4_2_0044E879
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	4_2_0040880C
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040783C FindFirstFileW,FindNextFileW,	4_2_0040783C
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	4_2_00419AF5
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	4_2_0040BB30
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	4_2_0040BD37

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

4_2_00407C97

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.000000000111C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@(

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

API call chain: ExitProcess graph end node

graph_4-48593

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_004349F9

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

4_2_0041CB50

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_004432B5 mov eax, dword ptr fs:[00000030h]

4_2_004432B5

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00412077 GetProcessHeap,HeapFree,

4_2_00412077

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004349F9
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00434B47 SetUnhandledExceptionFilter,	4_2_00434B47
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0043BB22
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: 4_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00434FDC

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Memory written: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

4_2_004120F7

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00419627 mouse_event,

4_2_00419627

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"			Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Process created: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe "C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"			Jump to behavior

Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerEs
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerOs3X
Source: UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.0000000001106000.00000004.00000020.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00434C52 cpuid

4_2_00434C52

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoA,	4_2_0040F8D1
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: EnumSystemLocalesW,	4_2_00452036
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_004520C3
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoW,	4_2_00452313
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: EnumSystemLocalesW,	4_2_00448404
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_0045243C
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoW,	4_2_00452543
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00452610
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: GetLocaleInfoW,	4_2_004488ED
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	4_2_00451CD8
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: EnumSystemLocalesW,	4_2_00451F50
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: EnumSystemLocalesW,	4_2_00451F9B

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

4_2_00404F51

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_0041B60D GetComputerNameExW,GetUserNameW,

4_2_0041B60D

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: 4_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

4_2_00449190

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

4_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		4_2_0040BB30
Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe	Code function: \key3.db		4_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-TS121V

Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.UsoOuMVYCv8QrxG.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.4d5cc60.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UsoOuMVYCv8QrxG.exe.43205f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UsoOuMVYCv8QrxG.exe PID: 6508, type: MEMORYSTR

Source: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Code function: cmd.exe

4_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	12 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	122 Process Injection	1 Timestomp	LSA Secrets	33 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bypass User Account Control	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	31 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	122 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UsoOuMVYCv8QrxG.exe	21%	ReversingLabs
UsoOuMVYCv8QrxG.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://geoplugin.net/json.gpSystem32	0%	Avira URL Cloud	safe
192.3.64.152	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpO	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
192.3.64.152	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp/C	UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, UsoOuMVYCv8QrxG.exe, 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpSystem32	UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpO	UsoOuMVYCv8QrxG.exe, 00000004.00000002.4574260536.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false
192.3.64.152	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517890
Start date and time:	2024-09-25 08:46:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UsoOuMVYCv8QrxG.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@5/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 174 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: UsoOuMVYCv8QrxG.exe

Simulations

Behavior and APIs

Time	Type	Description
02:47:04	API Interceptor	4679999x Sleep call for process: UsoOuMVYCv8QrxG.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	Awb_Shipping_Documents_BL_Invoice_Packinglist_0000000000000000000000pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.Trojan.Packed2.48025.19608.243.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	QUOTATION.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	PO904321.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	0988986.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17271612591ab6f17ada184393f4f649df7ae1e0875e1ed7c7f90b08ae9f86559128c060fa548.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
192.3.64.152	New Order.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Trojan.PackedNET.3042.4675.2937.exe	Get hash	malicious	Remcos	Browse
	Quote.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.PWSX-gen.3135.16188.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	Awb_Shipping_Documents_BL_Invoice_Packinglist_0000000000000000000000pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.Trojan.Packed2.48025.19608.243.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	QUOTATION.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	178.237.33.50
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO904321.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0988986.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17271612591ab6f17ada184393f4f649df7ae1e0875e1ed7c7f90b08ae9f86559128c060fa548.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Payment Slip.xls	Get hash	malicious	DBatLoader, Remcos	Browse	107.175.243.142
	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.3.146.145
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	192.210.214.9
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.210.214.9
	Request for Tender Quotation.exe	Get hash	malicious	RedLine	Browse	198.12.90.244
	17271612591ab6f17ada184393f4f649df7ae1e0875e1ed7c7f90b08ae9f86559128c060fa548.dat-decoded.exe	Get hash	malicious	Remcos	Browse	192.210.150.29
	gwfe4fo1Sp.rtf	Get hash	malicious	Remcos, PureLog Stealer	Browse	107.172.148.248
	zJvqmu3tWt.rtf	Get hash	malicious	Unknown	Browse	192.3.223.30
	osmAcHNA4D.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	192.227.228.34
	0n25lfPJxD.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	192.227.228.34
ATOM86-ASATOM86NL	US0914424A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	Awb_Shipping_Documents_BL_Invoice_Packinglist_0000000000000000000000pdf.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	SecuriteInfo.com.Trojan.Packed2.48025.19608.243.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	QUOTATION.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	IEnetbookCookies.hta	Get hash	malicious	Cobalt Strike, Remcos, PureLog Stealer	Browse	178.237.33.50
	US091024A.xla.xlsx	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO904321.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	0988986.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17271612591ab6f17ada184393f4f649df7ae1e0875e1ed7c7f90b08ae9f86559128c060fa548.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.891280721639507
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	UsoOuMVYCv8QrxG.exe
File size:	930'304 bytes
MD5:	fce19affe7db15edd2b851ea84cd37ad
SHA1:	143e9f5102833d028aca51437854e4a56f1dde11
SHA256:	26ed62c404f08cb73c5f52cf8df52546a0c69bef2c50a577afa65a515da0cb22
SHA512:	6046d7e2848132ee293a5b507dd76f84d506d4ed2e3673fb9a8bb5fa2d5645c6920de81f1c84f5fa3ee0b493b2c1941be7f37d650de27cec2b3b9113d820ab7d
SSDEEP:	24576:pIK++j3zMXN4nH3o4Tps96bSKVZgbI0Nrs4kWAh:7jDkN4nH3/pw6bSKVebI0wT
TLSH:	581512612395C907D0930BF44AB2E2F867355E895522C34BEEFABEEF783A3615440B53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.5...............0..(...........G... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4e47da
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x8635F06E [Thu May 9 03:11:42 2041 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe4786	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe6000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe2e70	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe27e0	0xe2800	c1162532cbb4d449039a15b0c7f1d7cd	False	0.9475070709161147	data	7.89619188199847	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe6000	0x5b4	0x600	7ee36e2aaf95539011443d5978fa9e14	False	0.421875	data	4.0914253692495866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0xc	0x200	392c266b735be718add972a0218fb7ec	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe6090	0x324	data			0.43407960199004975
RT_MANIFEST	0xe63c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T08:47:08.223485+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49712	192.3.64.152	2559	TCP
2024-09-25T08:47:10.635343+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 08:47:06.722965002 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:07.584110022 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:07.584232092 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:07.589526892 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:07.594472885 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.169895887 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.223484993 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:08.297533035 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.304459095 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:08.309377909 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.309830904 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:08.314662933 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.864581108 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:08.893728018 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:08.898638964 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:09.161964893 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:09.202799082 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:09.202908993 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:09.998020887 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:47:10.004048109 CEST	80	49715	178.237.33.50	192.168.2.6
Sep 25, 2024 08:47:10.004173040 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:47:10.004307985 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:47:10.009005070 CEST	80	49715	178.237.33.50	192.168.2.6
Sep 25, 2024 08:47:10.635211945 CEST	80	49715	178.237.33.50	192.168.2.6
Sep 25, 2024 08:47:10.635343075 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:47:10.647525072 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:10.652667046 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:11.634221077 CEST	80	49715	178.237.33.50	192.168.2.6
Sep 25, 2024 08:47:11.635885000 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:47:22.191709995 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:22.239018917 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:22.243978977 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:52.235263109 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:47:52.236936092 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:47:52.241722107 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:48:22.297514915 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:48:22.299381971 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:48:22.304214001 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:48:52.362096071 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:48:52.363706112 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:48:52.368582010 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:48:59.823534966 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:00.129781008 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:00.739201069 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:01.942336082 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:04.349961042 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:09.161031008 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:18.770442009 CEST	49715	80	192.168.2.6	178.237.33.50
Sep 25, 2024 08:49:22.662076950 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:49:22.662128925 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:49:22.662200928 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:49:22.663686037 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:49:22.884860992 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:49:22.884919882 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:49:22.885562897 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:49:52.507847071 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:49:52.509902000 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:49:52.514795065 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:50:22.568794966 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:50:22.570511103 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:50:22.580368996 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:50:52.638456106 CEST	2559	49712	192.3.64.152	192.168.2.6
Sep 25, 2024 08:50:52.640779972 CEST	49712	2559	192.168.2.6	192.3.64.152
Sep 25, 2024 08:50:52.645582914 CEST	2559	49712	192.3.64.152	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 08:47:09.834837914 CEST	65152	53	192.168.2.6	1.1.1.1
Sep 25, 2024 08:47:09.991987944 CEST	53	65152	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 08:47:09.834837914 CEST	192.168.2.6	1.1.1.1	0x3f3e	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 08:47:09.991987944 CEST	1.1.1.1	192.168.2.6	0x3f3e	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	178.237.33.50	80	6508	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 08:47:10.004307985 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Sep 25, 2024 08:47:10.635211945 CEST	1170	IN	HTTP/1.1 200 OK date: Wed, 25 Sep 2024 06:47:10 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	02:47:04
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Imagebase:	0xe90000
File size:	930'304 bytes
MD5 hash:	FCE19AFFE7DB15EDD2B851EA84CD37AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2135443708.0000000004D5C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2135443708.0000000004259000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:47:05
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Imagebase:	0x1c0000
File size:	930'304 bytes
MD5 hash:	FCE19AFFE7DB15EDD2B851EA84CD37AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:47:05
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe"
Imagebase:	0x920000
File size:	930'304 bytes
MD5 hash:	FCE19AFFE7DB15EDD2B851EA84CD37AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.4574260536.00000000010A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.4574260536.00000000010C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	213
Total number of Limit Nodes:	9

Executed Functions

Function 05838ADC Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05839A57
, xrefs: 05839A5E

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 0b867bbaaf94fe77041ee97b64de04e31d44d113f563ba8d777d3adc41b7e223
Instruction ID: 241a9dd9e8d679605023099c421c0a8f73373832bd3d5149de4988cff1e33ad0
Opcode Fuzzy Hash: 0b867bbaaf94fe77041ee97b64de04e31d44d113f563ba8d777d3adc41b7e223
Instruction Fuzzy Hash: D771B631910705DFDB10EF28E889655B7B1FF95304B41D6A8D949AB326EBB1F988CB80

Function 05839A11 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05839A57
, xrefs: 05839A5E

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e9aa570bf9f0e9570305b757053482ee05d09b0fbd4a1d814e0cfe99d0f261ee
Instruction ID: 1112b310f8a533d2a29fc3e8efd136222a6eebf0f69acd4e9121405e15e68ca9
Opcode Fuzzy Hash: e9aa570bf9f0e9570305b757053482ee05d09b0fbd4a1d814e0cfe99d0f261ee
Instruction Fuzzy Hash: BD71C731910701DFEB10EF28E889655B7B1FF95304B41D6A8D949AF326EBB1F984CB80

Function 08087655 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08087896

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 88d4aeb130e0cd081c2f4cbf237297d88bd939a5ae94979bbb3e5595087dd2b1
Instruction ID: c876e83ff5142c3d5c1d44382626389d9c407046b626dc112e3202e6284b8e45
Opcode Fuzzy Hash: 88d4aeb130e0cd081c2f4cbf237297d88bd939a5ae94979bbb3e5595087dd2b1
Instruction Fuzzy Hash: A1A18D71D01219CFEB10DF68C840BEEBBF2BF48311F2481A9E898A7244DB749985CF91

Function 08087660 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 08087896

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 708a46318cfc834ecefb7b5e59371d09f8dedd7298ffccc536f3fe6d08b9c87c
Instruction ID: 40d11975f1120087aaff2ed7da64d435ca3c36edacd735ea7bd7e7e2e6af5bab
Opcode Fuzzy Hash: 708a46318cfc834ecefb7b5e59371d09f8dedd7298ffccc536f3fe6d08b9c87c
Instruction Fuzzy Hash: 60917D71D01619CFEB10DF69C840BEEBBF2BF48311F2481A9E899A7244DB749985CF91

Function 0320B0E8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0320B33E

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aeea01807cce3f105054b609c943a2382880e82b1ca7803584f6136bbf681c73
Instruction ID: 7666c1e92fd6a71d45a9c47a4c916a231e669e5aa312c44c8243ce5305a1903d
Opcode Fuzzy Hash: aeea01807cce3f105054b609c943a2382880e82b1ca7803584f6136bbf681c73
Instruction Fuzzy Hash: FD714470A10B069FD724DF2AD44475AFBF5FF88600F14892DD08ADBA91DB74E889CB90

Function 0320AFC8 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0320D58E,?,?,?,?,?), ref: 0320D64F

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c25a73f8c9839b3c7bb146fd41d501afb2acf5ac25212b460207122a7afbb022
Instruction ID: 6c04502c26e077483f226f16d4d05d68f6d8a37190beeef0199e652cfe2fc961
Opcode Fuzzy Hash: c25a73f8c9839b3c7bb146fd41d501afb2acf5ac25212b460207122a7afbb022
Instruction Fuzzy Hash: 3851CC70914349DFDB21CF68C444B9ABFF1FF45304F18495AE1659B2A2C3B6E889CBA1

Function 0320590C Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 032059C9

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7fefa755663e3b69918deb12601fe101889ecefb782380592a4cc7937c20b9cf
Instruction ID: 37a16ccf8298bc8904639b5c556e5fba060dbfd4ac18fda56fb3f717ebd532e2
Opcode Fuzzy Hash: 7fefa755663e3b69918deb12601fe101889ecefb782380592a4cc7937c20b9cf
Instruction Fuzzy Hash: C4411470C0071DCFDB14DFA9C884B9DBBB1BF89714F24816AD408AB251D7756949CF90

Function 05801284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05804381

Memory Dump Source

Source File: 00000000.00000002.2137005719.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5800000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6df1e3e7918401afd3ebc4804d45d27d60adb08606cb0f513172c015ecbe9c4e
Instruction ID: 570f7cbfa0bc4cb38ec3153f098e8bfcacbfca0275d77927efa775a7ccf76405
Opcode Fuzzy Hash: 6df1e3e7918401afd3ebc4804d45d27d60adb08606cb0f513172c015ecbe9c4e
Instruction Fuzzy Hash: 9A4138B4900209DFDB54CF99C848AAABBF6FF88314F259459D519AB360D734A841CBA0

Function 03204514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 032059C9

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9fe8cf4a6b7175404bef4287db4f69c233487ef6de172abe98dc886155433244
Instruction ID: bc8a787cc848c4933f9664ee7090a86b21f6297b85c2a62478eecd59fce05296
Opcode Fuzzy Hash: 9fe8cf4a6b7175404bef4287db4f69c233487ef6de172abe98dc886155433244
Instruction Fuzzy Hash: FF41F2B0C0471DCFDB24DFA9C88479EBBB5BF89704F2080AAD508AB251DB756949CF90

Function 080873D0 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08087468

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 66b6e7d4a814141a830a3880d370d70edcc25bf90e96e6c970321bc8133d94f4
Instruction ID: 7a773cb0fc23156dd642a7d737f6704ee7d1c84b48d0b4fc109ff24d29fa3b58
Opcode Fuzzy Hash: 66b6e7d4a814141a830a3880d370d70edcc25bf90e96e6c970321bc8133d94f4
Instruction Fuzzy Hash: 0C215A72900359DFDB10DFA9C885BEEBBF1FF48310F24842AE959A7240C7789554CBA0

Function 080873D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 08087468

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8990700ac82b710c4b5cec47b2a9c06b7a1d0e6af2b1ae82dfc58e6f99343eac
Instruction ID: 699157d2d1d49d574d2e94e25d9855541d9cefa830e91fb94c3a66fe58da69a6
Opcode Fuzzy Hash: 8990700ac82b710c4b5cec47b2a9c06b7a1d0e6af2b1ae82dfc58e6f99343eac
Instruction Fuzzy Hash: 64216972900319DFDB10DFA9C881BDEBBF5FF48310F208429E958A7240C7789954CBA4

Function 08087238 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 080872BE

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 476bd2a740c1979f8c7e14b98f171c9becfc4f825fbb806f3437633089e7976f
Instruction ID: 3b344e8072b59613c89b8b9762db1476f9f5952a5fa65a308c92a6cfa8a7a954
Opcode Fuzzy Hash: 476bd2a740c1979f8c7e14b98f171c9becfc4f825fbb806f3437633089e7976f
Instruction Fuzzy Hash: 60213A719003098FDB10DFA9C485BEEBBF5EF88325F24842EE559A7240C7789545CFA4

Function 080874C1 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08087548

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e70b7ce625890ffb2025adf6c60d24b3a21f8971e81dd1f738ea03cdef893342
Instruction ID: 7bb5a39e893d0d0bed5cc8c17ac3df5174ffa6efe0614c22552b1bf7bf8a1212
Opcode Fuzzy Hash: e70b7ce625890ffb2025adf6c60d24b3a21f8971e81dd1f738ea03cdef893342
Instruction Fuzzy Hash: 6C2136B18002499FDB10DFAAC881BEEBBF1FF48320F24842AE558A7250C7789554CBA4

Function 0320AFD4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0320D58E,?,?,?,?,?), ref: 0320D64F

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0066c9f15554006a0f4121ea14c139aa763cb30b379ba1b077b825790b3d0951
Instruction ID: 3b90bae0e6822ecfef5fb8cfea8d7d408b297ebb07bd665f0fc55bee60c3eaf5
Opcode Fuzzy Hash: 0066c9f15554006a0f4121ea14c139aa763cb30b379ba1b077b825790b3d0951
Instruction Fuzzy Hash: 6D21E4B5901209DFDB10DF9AD884AEEFFF5EB48310F14841AE918A7351D378A954CFA4

Function 0320D5C1 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0320D58E,?,?,?,?,?), ref: 0320D64F

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 91fad7d33da4e8a904b92e50af1e7e41ad3342a1a362cda4c17943e617e7f2e4
Instruction ID: 2ff5382b3d6d1e0d5feb5bc6ebc626ae71eb764869123383fb1361d89732fd20
Opcode Fuzzy Hash: 91fad7d33da4e8a904b92e50af1e7e41ad3342a1a362cda4c17943e617e7f2e4
Instruction Fuzzy Hash: 2C21E4B5911209EFDB10DF9AD884ADEFBF4FB48310F14841AE918A3351D379A954CFA4

Function 08087240 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 080872BE

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 39b96bb25a73067d82bb61d84523c99b92a08da521a62e83f81b9f2cdb19a5eb
Instruction ID: 677ef05c5665eea3e83d6fc16775173501b4e8f65c7fa2d2ba13919c50c83ff2
Opcode Fuzzy Hash: 39b96bb25a73067d82bb61d84523c99b92a08da521a62e83f81b9f2cdb19a5eb
Instruction Fuzzy Hash: 7C212971D003098FEB10DFAAC485BEEBBF5EF88324F648429D559A7240CB789944CFA4

Function 080874C8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08087548

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8c17e2aa0b10a558b2fe285b74eb06e599d169701f1896d8b4de9ee30d628a50
Instruction ID: fda537c2e0701df23018890cdc86ed3581627b855875a5d0402658545e339535
Opcode Fuzzy Hash: 8c17e2aa0b10a558b2fe285b74eb06e599d169701f1896d8b4de9ee30d628a50
Instruction Fuzzy Hash: 272128718003599FDB10DFAAC881BEEBBF5FF48320F648429E558A7250C7799550DBA4

Function 08087310 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08087386

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 80b8351f5eb835cc009c68966158099d22dabf44f965f5ee3ca06bcf15b76dae
Instruction ID: c82b7e7dcbe6a14e9dcfe5b13d48bf056f8cfb715c2626a2b867b16bf8d757e7
Opcode Fuzzy Hash: 80b8351f5eb835cc009c68966158099d22dabf44f965f5ee3ca06bcf15b76dae
Instruction Fuzzy Hash: 2E115972900349CFDB10DFA9D845BDEBBF1AF48320F248419E959A7250C7799554CFA1

Function 08087318 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 08087386

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 943deaf54a0d213100eb9605c762000be9d0bf639599a8dfa2f4a6ac4eac359b
Instruction ID: 080bb4c920882e525d3b40d19c4d03fdb475acdbb0c0b4ae26b5137199096bfb
Opcode Fuzzy Hash: 943deaf54a0d213100eb9605c762000be9d0bf639599a8dfa2f4a6ac4eac359b
Instruction Fuzzy Hash: 3D1156728003499FDB10DFAAC845BDEBBF5EF88320F248419E519A7250C775A950CBA1

Function 08086D51 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08086DBA

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3a57ded758407f80babe64e44016710b2e7ec39a2de1c150111c34d81a1ee705
Instruction ID: 820a0e70fe0ff58cd3ace02713b328a53bef51aaa320603c547906571b319e8d
Opcode Fuzzy Hash: 3a57ded758407f80babe64e44016710b2e7ec39a2de1c150111c34d81a1ee705
Instruction Fuzzy Hash: 44114671D003498FEB20DFAAD448BEEBBF5AF88324F24841AD559A7240C73A6545CFA4

Function 08086D58 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 08086DBA

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7d660e2eeab8738d86503d020d41c3e49c92c75a5ddc48b1a5e7edac0535a5f7
Instruction ID: 535ca2cf7fa065f04fbbe7720db7d2e888e88076c150b33e2595585c5f35d640
Opcode Fuzzy Hash: 7d660e2eeab8738d86503d020d41c3e49c92c75a5ddc48b1a5e7edac0535a5f7
Instruction Fuzzy Hash: 06115571C003498FEB10EFAAC4457EEFBF5AF88320F248419C519A7240CB39A940CFA4

Function 08085CB0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08089985

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7c20052d6f81ce45c9ae023ca3d96da218e6734f4a992c0268d8b13aab1f4cf7
Instruction ID: 1d408f06127feb618f12144b6c59c6b0f34aeb3740e82f06b50fe78e1e2c518d
Opcode Fuzzy Hash: 7c20052d6f81ce45c9ae023ca3d96da218e6734f4a992c0268d8b13aab1f4cf7
Instruction Fuzzy Hash: FC11F5B5800349DFDB10EF9AD444BEEBFF8EB48310F108419E558A7210C375A994CFA1

Function 0320B2D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0320B33E

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8c9cab3e618b8b7d98e6acf8fb3405146c19b72ace6f6d52659eb70c6d8a3042
Instruction ID: 8bbbfe26e72296144a699496f9bd1b56f5524eef3fbccb7ef6ccd1b441aaeec8
Opcode Fuzzy Hash: 8c9cab3e618b8b7d98e6acf8fb3405146c19b72ace6f6d52659eb70c6d8a3042
Instruction Fuzzy Hash: EF1113B6C002498FDB24CF9AD444BDEFBF4AF88214F24841AD519A7250C379A549CFA1

Function 08089920 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 08089985

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1913bd1dd850a2eb349f787c5c87b49dfe9cbd1d22b3facf5b0a358a94d58dc6
Instruction ID: 0050acd9b9a70889e551ee22d193d917aa5601083264bce107beaeb0d3c85b21
Opcode Fuzzy Hash: 1913bd1dd850a2eb349f787c5c87b49dfe9cbd1d22b3facf5b0a358a94d58dc6
Instruction Fuzzy Hash: 6811F5B5800249DFDB10DF99D545BDEBFF4EB48320F248419E558A7210C379A594CFA1

Function 0583F430 Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09bc019504e83e4391a989b37d2e69d5999512ae168acc9c641964c61f299db
Instruction ID: 7b866a6a7ca93727a6ea2825b2824b4a4559e17925a745f902ae6ce9cd213836
Opcode Fuzzy Hash: d09bc019504e83e4391a989b37d2e69d5999512ae168acc9c641964c61f299db
Instruction Fuzzy Hash: D1724D31910609CFDB14EF68D8996ADB7B1FF55300F018299D94AAB265EF30AEC5CBC1

Function 0583C3E8 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6a2f70819ea7d0c2ea7fa4611bef36dd5d6733eaf2b7c9656da123758d3498
Instruction ID: d691ed65f9aaf7bf4ae54d62f0cfdf5e25948f06dad2d7436933655b51f5ac2b
Opcode Fuzzy Hash: 2b6a2f70819ea7d0c2ea7fa4611bef36dd5d6733eaf2b7c9656da123758d3498
Instruction Fuzzy Hash: 0B42C831E107198BCB14EF68C8956EDB7B1FF89304F1186A9D859B7251EB70AE85CF80

Function 0583C3D9 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c4e76f6b5e63707a17817815398c9c123652255a98ff2c22ea46d4ce40f1ee
Instruction ID: 09c9d069713d3e6d4944ee5566dc44a891b7656fe1b09f36659014427d88d6de
Opcode Fuzzy Hash: 72c4e76f6b5e63707a17817815398c9c123652255a98ff2c22ea46d4ce40f1ee
Instruction Fuzzy Hash: DCE1DA31E106198BCB14DF68C8956EDB7B1BF49304F1586A9D859FB251EB30AD81CF80

Function 05833378 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df222f92526fd9edd09414598da99d10611bb873286949cf6f422fd7eb083189
Instruction ID: ec0d5002639ffee30b86767e8fb20f9b947ac70321ef7971529af67851797136
Opcode Fuzzy Hash: df222f92526fd9edd09414598da99d10611bb873286949cf6f422fd7eb083189
Instruction Fuzzy Hash: FAC15134B107058BDB04EF78D8986A9B7A2FF89300F158579EC0A9B3A5DF749C85CB91

Function 058343F8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104f898beaa965c4bd378aa5024e3aaa7cc757547acd284ae504a2800dcd9e62
Instruction ID: 4bbe53f96798b3e687a4a89c19b9c57758ba45172c87b40ff0fd52393d69f25f
Opcode Fuzzy Hash: 104f898beaa965c4bd378aa5024e3aaa7cc757547acd284ae504a2800dcd9e62
Instruction Fuzzy Hash: DFA16035B107018BDB04EF68D8986A9B7A2FF89300F158579DC0A9F3A6DF71AC45CB91

Function 05831858 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095ae7c0753989ece7d707aac23f541e6c4b6b5929f1aacbc25a8a5b999c4092
Instruction ID: c4018573717dc4cef23c2a4178bb9978eb14044c22d76d0001fd6aeb9145847d
Opcode Fuzzy Hash: 095ae7c0753989ece7d707aac23f541e6c4b6b5929f1aacbc25a8a5b999c4092
Instruction Fuzzy Hash: BF816874E003199FDB04DFA9C8956AEBBF6BF88300F14852AE805EB351DB749D45CB91

Function 058358A4 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0aac47dfe29e8378106b790636ff2a5d8e92b5324f218207b78a102953cac48
Instruction ID: deb8a91c2ba93f43d612d00e0cc9692d007f237cc46b5e1d7a4ff4b600c48848
Opcode Fuzzy Hash: e0aac47dfe29e8378106b790636ff2a5d8e92b5324f218207b78a102953cac48
Instruction Fuzzy Hash: 13719E31B006069FCB09EF7DC89555AB7A6FFC82107508969D50AAF365EF30EC868B81

Function 0583EDC0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e54ea64a0cd94a207380a0dfbb2b6850ea93993278f4727859a55d093c7727
Instruction ID: 3c60a81f54763f6f0f7792ee73f29ac7aeeabe683bd73a9957cadd0aa929561d
Opcode Fuzzy Hash: a1e54ea64a0cd94a207380a0dfbb2b6850ea93993278f4727859a55d093c7727
Instruction Fuzzy Hash: BD91F97191060ADFCB01DFA8C884999FBF5FF89310B15C79AE819EB255E770E985CB80

Function 058374C0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715b25baf94ad2e6aa5fddd898717003cf0c022d74cf58e7efccdabc38f2650d
Instruction ID: 3130838c1fad3838f748113ff2ba76bd62a860c6813d009e771357b133660286
Opcode Fuzzy Hash: 715b25baf94ad2e6aa5fddd898717003cf0c022d74cf58e7efccdabc38f2650d
Instruction Fuzzy Hash: F771C074A11248AFCB05DFA8D895DAEBBB6FF49710B1140A9F901EB361D731ED81CB90

Function 05834880 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c923c3628b8004eb24bdf68a8ea5bb38d5b78febfa1ba629c01dbf6180250d75
Instruction ID: 0d02e148debf4b0343df99cdaed1648ba06a27feee67954dc8eee84b3d979a31
Opcode Fuzzy Hash: c923c3628b8004eb24bdf68a8ea5bb38d5b78febfa1ba629c01dbf6180250d75
Instruction Fuzzy Hash: 45714D31E0134B9BCB14EFA8E89469DF7B2FF95300F208619D015BF265DB706995CB80

Function 05835F48 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdae19b0e7a977a313ed2d75494066a09a2a7b73b5d8322c4a3f6e46f6dcb38e
Instruction ID: 843dabec95963a85bdf7d0aff51e31df59813014016aadb50862fb56366b73ba
Opcode Fuzzy Hash: bdae19b0e7a977a313ed2d75494066a09a2a7b73b5d8322c4a3f6e46f6dcb38e
Instruction Fuzzy Hash: E151B630A003069FDB14EBA9C4656AEBBB6FF84300F148569D906EB351EF759D46C781

Function 05832D30 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6445aa9bd712ad34fb80f40cb8cfb173c0f7bb1a911c4ab54c391ee303d5d66
Instruction ID: 89b6694b3ca229c93c8737029862a72fbe47f2a4522bddd5f802a8c397548200
Opcode Fuzzy Hash: b6445aa9bd712ad34fb80f40cb8cfb173c0f7bb1a911c4ab54c391ee303d5d66
Instruction Fuzzy Hash: 3151F37AA043489FDB18DFA9D8096AEBFF6FF85210F14846AD846D7341DA349C05CBE1

Function 05834890 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55480cffabe1f13c79855292c3687163f3f050ccb3efd124500c7f89ef29b4b8
Instruction ID: d1be6aac296d0a7d8f27b0499ba924236ca7acce535979cbd87ab65f53969f5b
Opcode Fuzzy Hash: 55480cffabe1f13c79855292c3687163f3f050ccb3efd124500c7f89ef29b4b8
Instruction Fuzzy Hash: 0B712C31E0135B9BCB14EFA8E89469DF7B2FF95300F218619D0157F264EBB46995CB80

Function 058385D8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748ad57ef1987a87504a92e608b144275ca83210876dab695b1d3a87946a5dc9
Instruction ID: 649abd8676189f619ddc8e6bbe8873f8fcf865acc69c2679423df01fb4f32058
Opcode Fuzzy Hash: 748ad57ef1987a87504a92e608b144275ca83210876dab695b1d3a87946a5dc9
Instruction Fuzzy Hash: 3051D734A10605CFCB04EF68C89899DBBB6FF89704B1585A9E506EB371EB71ED45CB80

Function 05830BFC Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59095c8b0084203802338f1a332aca3a9003761f26540af3e1eccf5dc149e3d
Instruction ID: 5ddd5b364844f30ec891b123bcf557360c2d0d53cc87ea0e2b1082f88593c4b2
Opcode Fuzzy Hash: c59095c8b0084203802338f1a332aca3a9003761f26540af3e1eccf5dc149e3d
Instruction Fuzzy Hash: 83514F75E003059FCB10DFA9D849AEFBBF9EF88710F10881AE915E7250DB749905CB91

Function 0583EDB1 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313e41c1b7d33886e0616cde490a88f68b20ca81b3ddfab7bd6f3bdf475cd24b
Instruction ID: b03fd7d334f2e5310c107cb4c9282a65ceef00099acde0ed8233c046b6a77407
Opcode Fuzzy Hash: 313e41c1b7d33886e0616cde490a88f68b20ca81b3ddfab7bd6f3bdf475cd24b
Instruction Fuzzy Hash: 47610B7191070ACFCB01EFA8C884999FBB5FF49310B14879AE859EB255E770E985CB80

Function 05839118 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8bc4d920c9467f9ac6d96ce083be5330eb2c771c0e69da16d9b8efbe37ab54
Instruction ID: 45cbab72abfb64350adfea1459985693c75fdc3d87df713e8265805ad5547146
Opcode Fuzzy Hash: db8bc4d920c9467f9ac6d96ce083be5330eb2c771c0e69da16d9b8efbe37ab54
Instruction Fuzzy Hash: CD51C031A007168FCB14EF78C4545AEBBB2FF842147148A6DD84AEB355EB31AD42CBD1

Function 058385E8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7e40f25a92d1b8a06f49512128c8fd2c83469fdb45781b643bc52dbc9d23a8
Instruction ID: 0357d731a0f422cb4c93d4f1262bc008d54a0fdfebb4f0609d4edac414e44e4c
Opcode Fuzzy Hash: da7e40f25a92d1b8a06f49512128c8fd2c83469fdb45781b643bc52dbc9d23a8
Instruction Fuzzy Hash: 0651E734A10605CFCB04EF68C89899DBBB6FF89700B1585A9E506EB371EB70ED45CB80

Function 05831644 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fdd17a2f9a802052525f64c2a6c2e0f975b0c4452cb51d7d79c0edec456b7e
Instruction ID: 9b688df963e18cc50ee5fc3a02103a9c72ceb33aeea0158e47fb8bd8c33e4193
Opcode Fuzzy Hash: 38fdd17a2f9a802052525f64c2a6c2e0f975b0c4452cb51d7d79c0edec456b7e
Instruction Fuzzy Hash: FD319034A02318DFCB14DFA4E5496EDBBB2FF85301F158569E852A7794CB309C66CB80

Function 05835AB0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16438dc0081556a4ec0261bb0583aa6ee826e2658c84b7a9883f34178a275a2
Instruction ID: 469a2abfdd31a3603bfe2893d974a57361dd82a857542e017e9de8a85243ceaf
Opcode Fuzzy Hash: d16438dc0081556a4ec0261bb0583aa6ee826e2658c84b7a9883f34178a275a2
Instruction Fuzzy Hash: 11517A34A01245CFCB15DF68C595A9DBBF2FF89204B1584A9D406AF3A2CBB2AC45CB90

Function 05831704 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546e07259bfd80fed9a33b7e61f63e988c370ed0fcc6cf251b6fd5cdcfd92fe9
Instruction ID: 6e77823293e499115b67ded9d8b9665e539d400ea9e4a8c549807331ca0f8119
Opcode Fuzzy Hash: 546e07259bfd80fed9a33b7e61f63e988c370ed0fcc6cf251b6fd5cdcfd92fe9
Instruction Fuzzy Hash: 9241D6B5E042199FDB14DFA9D845AAFBBF9EB88610F14841AE805E7340DB749C01CBE1

Function 05837940 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf903bfbe3884b011e202946b3f38e033f94e2c41c3b779492d7db6da2980bd
Instruction ID: f37f2ef9f075dc5be5dd108a0302e55ff2f21384e6ff8f4996a935f11d9caa04
Opcode Fuzzy Hash: dcf903bfbe3884b011e202946b3f38e033f94e2c41c3b779492d7db6da2980bd
Instruction Fuzzy Hash: A4415874B242588FDB14DB69C885EADBBF6FF89604F1440A9E901EB3A1DB75DD00CB90

Function 058363B0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d86a767a14f3b8f2bba649d63a82d8221d6a6bbefaf67820b5439cadf51c48
Instruction ID: df817c3450b0fb741268cc5d19100bcaa1e7adc59c39657e4de22eb1f298e07c
Opcode Fuzzy Hash: 50d86a767a14f3b8f2bba649d63a82d8221d6a6bbefaf67820b5439cadf51c48
Instruction Fuzzy Hash: 57512B34A01209EFDF10DF99D595BAEBBB2FF48310F208068E906AB355DB71AD10CB91

Function 05835D28 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eadf4a62072a9967349bd7b10e9ef471d5996b589a4c25b18da7b52300d2b66
Instruction ID: 5b9c36a19910dab2f33d94bffb595a255c39c57db379c849e12706d6515e10d8
Opcode Fuzzy Hash: 2eadf4a62072a9967349bd7b10e9ef471d5996b589a4c25b18da7b52300d2b66
Instruction Fuzzy Hash: E9410834B042188FDB54EBA8C899BEDB7B1BF49704F114069E905EB3A1D778AC45CFA0

Function 05835AE0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f802eda1f1890e802548730a75f51c5a31699acf17fd6507e517b1554b167c
Instruction ID: fd4cd3a0c10af35ad1de7d234c8672e1cf594ca1cf681dae958e830076206173
Opcode Fuzzy Hash: c0f802eda1f1890e802548730a75f51c5a31699acf17fd6507e517b1554b167c
Instruction Fuzzy Hash: A3413B34A10245CFCB14EF68D595A9DB7F2FF88305F108569D506AF3A1CBB2AD45CB90

Function 058392F0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f106d85ed724e6b56e94310a2b3dda242d5047d4d5ffec585c26cb0f378559
Instruction ID: f163506256fc28212d9412aeb9e847d418434f8b5e688730619d33c58b9d7169
Opcode Fuzzy Hash: 11f106d85ed724e6b56e94310a2b3dda242d5047d4d5ffec585c26cb0f378559
Instruction Fuzzy Hash: 4E414531B05219DFCF19DFACD8856AEB7F2AF88204F104529E906E7390DB74AD41CB85

Function 0583D071 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a2c0d9d61aa2d4baab07feec1939c1594ba2d1056367f82c9781af3a939990
Instruction ID: fbeaa6a159f0028a0046ec8d488fc30c419cf40082562118443d6e54cb25ae8d
Opcode Fuzzy Hash: 22a2c0d9d61aa2d4baab07feec1939c1594ba2d1056367f82c9781af3a939990
Instruction Fuzzy Hash: B6416F34A10709CFCB04EFA8C8949DDBBB6FF89304F018559E515AB365EB71A946CF81

Function 05834C63 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bbf22a6950e20f77a9f96abcfd737fdac15cf6d00fe4f6cd46cd547d1e24ab4
Instruction ID: b48d802173801cb73d717d024c60f98ec4e7474b8d05c6775a50f298d9f9aba0
Opcode Fuzzy Hash: 6bbf22a6950e20f77a9f96abcfd737fdac15cf6d00fe4f6cd46cd547d1e24ab4
Instruction Fuzzy Hash: DB412132D10B0A9ACB00EFA8D8444AAF775FF95300B51CB59E9596B221FB30E6D5CB80

Function 05838178 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de5d08c38c72b877182d9f604e75544c9cf9b6fe26e8da456d6b3ab2416dece
Instruction ID: 2cc323206f35f0700d0dd60f1f0d1bd2eeecee19c5e7edc8248b8d10557e50f0
Opcode Fuzzy Hash: 7de5d08c38c72b877182d9f604e75544c9cf9b6fe26e8da456d6b3ab2416dece
Instruction Fuzzy Hash: 64413E34A10709CFCB14EF68C8949EDFBB6FF89304F008569E515AB325EB71A946CB81

Function 0583DDB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9c7ac44dd782021612d050a5b15048b01d17418c9742e9ddec4352084a849
Instruction ID: 1050efb7fdf1c7e2f6b6f674ca23f882a06624fcffa8a7aec036bf645cf05269
Opcode Fuzzy Hash: 84b9c7ac44dd782021612d050a5b15048b01d17418c9742e9ddec4352084a849
Instruction Fuzzy Hash: 87312532B083428FCB05ABB8E84528DBBB1FFD5210B15492AD145EF351DB30AC4AC7D1

Function 05831CA4 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10e97435384e39123de76aabf84181916fc41ae48c982d7e9ad3eb8f7acaf41
Instruction ID: bac7463d568088eafde682ae1862cea69abfcddca1d6e2d9ea21b9c31d33f5d8
Opcode Fuzzy Hash: d10e97435384e39123de76aabf84181916fc41ae48c982d7e9ad3eb8f7acaf41
Instruction Fuzzy Hash: E141F2B1D00709DFDB20DFA9C588ADDBBB5BF48704F24812AD909BB210D7756A4ACF90

Function 05831544 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0805a2db47c12a7cc3e92d9c1db5cc84c256a0a3f17a7aaefc7efb7996dc7
Instruction ID: 14715eccd45671594df7151dd6293a0dda74ab786f132c459b6e2521e139aee1
Opcode Fuzzy Hash: d6c0805a2db47c12a7cc3e92d9c1db5cc84c256a0a3f17a7aaefc7efb7996dc7
Instruction Fuzzy Hash: 8841F2B1D00709CBDB20DFA9C584ADDFBB5BF49704F64802AD909BB210D7756A4ACF90

Function 05830BF0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d645748db50f3818806f86690860787750b302a530c1c5a6a19026cb974d1d17
Instruction ID: b444176a958bed3396618e457644e89e24a9d47ff4c4c4297cb0c3b6a406ba70
Opcode Fuzzy Hash: d645748db50f3818806f86690860787750b302a530c1c5a6a19026cb974d1d17
Instruction Fuzzy Hash: 7B41B0B0D10359DFDB14CF9AD888A9EFBB1BF88710F64812AE818BB250D7746845CF90

Function 0583AD03 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f70689a997f3841f38f88c4fd16f7eb1b7689dd3485da9f1f86d1d614d5c4d0
Instruction ID: 8db57ca2688deeefec49d0fee2c169edfd84db2df507a5fc5e9637b7e3aa8047
Opcode Fuzzy Hash: 2f70689a997f3841f38f88c4fd16f7eb1b7689dd3485da9f1f86d1d614d5c4d0
Instruction Fuzzy Hash: 7D41F575A0020A9FCB44DF69D8849AEFBB5FF48310B14C269E818AB315E730AD85CF90

Function 05838A7C Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1545056c4d26c03a6d752d8cb96f6bc85f46030ffa3a66d4bf89e7afc12ea3f
Instruction ID: 65a9f404678e5c3151e875ada969382d3ae2e1807abe4ddab9316a16e1dcf461
Opcode Fuzzy Hash: c1545056c4d26c03a6d752d8cb96f6bc85f46030ffa3a66d4bf89e7afc12ea3f
Instruction Fuzzy Hash: 0131A731A10301DBDB00EF69E899765B7A6FF98310F04C679EC4DAB245EFB09884CB91

Function 0583AD08 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97283d7fc9a16019ee726a5e17ac9f52ee082dbe5e0113e64ff4c7cf9968c00e
Instruction ID: ec590c8f60eb7620d36a1aaf9c09a1696c9d1b97a921258eca21966751203929
Opcode Fuzzy Hash: 97283d7fc9a16019ee726a5e17ac9f52ee082dbe5e0113e64ff4c7cf9968c00e
Instruction Fuzzy Hash: 84410675A0020A9FCB44DF69D88499EFBB5FF48310B14C259E818AB315E730AD85CF90

Function 0583CF78 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4db8dec4c15be97c7811a9a4f1c4a7a2cf70e8d45b8f5ed80a6ca4f925e4df9
Instruction ID: 37f029747eeb6bc725474fb0ccadbaf138a178ab234c581fbbaf9f8817bc4418
Opcode Fuzzy Hash: f4db8dec4c15be97c7811a9a4f1c4a7a2cf70e8d45b8f5ed80a6ca4f925e4df9
Instruction Fuzzy Hash: B6317036B012159FCF04EB68E8548DDB7B6FF89210B058169E906AB320EB71AD46CBC1

Function 05832EEB Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6edaaf159ec30cfdfc9bd4b0cb71562fdf9bf3a5ff23d8e13c4dbbf01e4e29
Instruction ID: aeb6c59a550b426e2d6e89675a6d3ed48a9a5f06d9529e6473daa867af6382cc
Opcode Fuzzy Hash: 8d6edaaf159ec30cfdfc9bd4b0cb71562fdf9bf3a5ff23d8e13c4dbbf01e4e29
Instruction Fuzzy Hash: 3C11067BA053049FDF25966DDC167AEBBB9EB84624F184466EC06C7242DA64CC06C7E0

Function 05839811 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069ae71a4a55eb3939ca272adc42d2adf84ee4578fb272bf9d6e9e0243aa255c
Instruction ID: 280001502d8deb915cba9b7b40b9afc00e4aa8a7623f66b549caadf90586da12
Opcode Fuzzy Hash: 069ae71a4a55eb3939ca272adc42d2adf84ee4578fb272bf9d6e9e0243aa255c
Instruction Fuzzy Hash: 8231A732A10300DBDB10EF69E84976577B5FF99210F05C579EC49AB345EFB09844DB51

Function 0583B2A4 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb87e7c9c84fcd3cfe0edce208f831e9f6a1e66dcc50b3290751abce5f3e03c
Instruction ID: 4177cfbf8fb1744b408a3c1964e0183fa65cd8003aae46b64f13d970a31cb0b9
Opcode Fuzzy Hash: adb87e7c9c84fcd3cfe0edce208f831e9f6a1e66dcc50b3290751abce5f3e03c
Instruction Fuzzy Hash: EB2180723141018FDB149B2CC88666D7BE6FF85716B1981B9EA0ACF3A6DA35DC058B90

Function 05831E27 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508db2ce40a179a43a12b8847068723c930bf34c48ae7b27acfad20130f6004f
Instruction ID: 477aef3eee8fc84d06cbbb027dddc5ccbff175c488a07acd783cb7e549317711
Opcode Fuzzy Hash: 508db2ce40a179a43a12b8847068723c930bf34c48ae7b27acfad20130f6004f
Instruction Fuzzy Hash: AB215E71B002459FCB11EBADC8099BFBBFAEF84B00B14856AE955D3251EA708E05CBD1

Function 058379C6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436d60fa9dc3d73349bb183e4942cff08160fa2f91881e010adaf617f923f326
Instruction ID: dd5c8cb1ae83743ae698e30c056dad53a17a42da788451edc22e7a274cb4af2c
Opcode Fuzzy Hash: 436d60fa9dc3d73349bb183e4942cff08160fa2f91881e010adaf617f923f326
Instruction Fuzzy Hash: 133134747242148FDB00DB69C885EAC7BB6FF89604F5440A9E901EB2A2DB71DE40CB50

Function 05831BA8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770ad99c0d04aac07e45d198deba7b946f8328d0509af70338e2d587cd652bc1
Instruction ID: ec81c055e49a47c9422f09cae742ad15ca8ef4fe61d523af09e0f5778cf2ebca
Opcode Fuzzy Hash: 770ad99c0d04aac07e45d198deba7b946f8328d0509af70338e2d587cd652bc1
Instruction Fuzzy Hash: CC21E675A003058FC711DF39C8498AABBFAFF85614B1585A9D906DB361EF71DC0ACBA0

Function 058392E1 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed2819ae48a853e8890bc36ed2ec44c29bacd501ff2fa6be66c8f6a9eb66f2b
Instruction ID: 862b231fdc60ecf0d683dec9f5422b11f409f399463411e960ad41542dea3b50
Opcode Fuzzy Hash: fed2819ae48a853e8890bc36ed2ec44c29bacd501ff2fa6be66c8f6a9eb66f2b
Instruction Fuzzy Hash: 8B319A71B05209CFCB15DFB8D8856ADB7F2BF88604F10406AE906E7390EBB0AD41CB81

Function 05837C61 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1337cdf5882aa79e0d9138efa2ad63576ca71c0f11b6a01ca0ba4dfb5aaec00
Instruction ID: f9e737d6084eaa2fec7ac2c8018706ab0a23a8c4631654eb5fd94b9ae703e6fe
Opcode Fuzzy Hash: c1337cdf5882aa79e0d9138efa2ad63576ca71c0f11b6a01ca0ba4dfb5aaec00
Instruction Fuzzy Hash: 062119743506108FC714DF2DD498E2977E6FF89A1436640A9EA06CB3B6DB71EC02CB90

Function 05833DD8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753e53e46840eb9bca23e371c4968b37bc1fdc60bdbbbdf5574b2ee05638dc9a
Instruction ID: 55d4066f7e7c08ac611e55644882f488d6172c577976e8d9862cbd6f614ad09f
Opcode Fuzzy Hash: 753e53e46840eb9bca23e371c4968b37bc1fdc60bdbbbdf5574b2ee05638dc9a
Instruction Fuzzy Hash: 2B21C431614B049FD734CE38D486A26B7F2FB49610F040E29E8AACBA00DB70E849CB91

Function 0153D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865fd7f929ccb5c39d8d86338ccdd6922dd32af2a7b7e8bad114e8dc57bd794e
Instruction ID: fadb2c8625fcff3785d97e8c6775b214e628b710517c5630a9f8e39fc74f614e
Opcode Fuzzy Hash: 865fd7f929ccb5c39d8d86338ccdd6922dd32af2a7b7e8bad114e8dc57bd794e
Instruction Fuzzy Hash: 45210072100204DFDB01DF54D980B5ABBB5FBC8324F208568E9090F256C37AE456CAA1

Function 0153D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c8c8075f4634f55a60299c4751c4ff0c4c5684d6b18c587a796c01c3566772
Instruction ID: 3f1d1ad05c313fe37f8d1bc336e9c8f33259612b3cff3941db5949f2bcafcfb4
Opcode Fuzzy Hash: 85c8c8075f4634f55a60299c4751c4ff0c4c5684d6b18c587a796c01c3566772
Instruction Fuzzy Hash: 6321F172500240DFDB05DF54D9C0B2ABFB5FBC8318F608569E9090F296C336D456CAA1

Function 05834C70 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84494be632f076211c351ecf6ca69da8a7862510dbec251730c8e97ddcfe1a6
Instruction ID: f9b66b3e29a0c9771b9c45c0fb030f97b6f9ee032af79678b12e57cdc7dc0e01
Opcode Fuzzy Hash: b84494be632f076211c351ecf6ca69da8a7862510dbec251730c8e97ddcfe1a6
Instruction Fuzzy Hash: EF311032910B09DACB01AFA8C844499FBB5FF95300B11CA59E95967221FB30E695CB80

Function 0154D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134031686.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798ea4750bd5e4c4febb364ca9a7d4d01010f53aac061362c67b30b8108c76f7
Instruction ID: e23ae56762f4e14de1e3b0c7239deacfbf8f2a1eefe3be1b4156aec7a15bd19e
Opcode Fuzzy Hash: 798ea4750bd5e4c4febb364ca9a7d4d01010f53aac061362c67b30b8108c76f7
Instruction Fuzzy Hash: 3721D771608204EFDB05DF94D5C4B1ABBB5FB94328F24CA6DE9094F252C37AD446CA61

Function 0154D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134031686.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b599259587d6fac404dc38d9862fa7f22170c24996c1aa2d9c7ae93c06da5d
Instruction ID: 5501b2d873dd08f95c361b9345644bbc603cb47cf8380ef63a5eee0847acc4ab
Opcode Fuzzy Hash: e8b599259587d6fac404dc38d9862fa7f22170c24996c1aa2d9c7ae93c06da5d
Instruction Fuzzy Hash: B1212271604204DFDB15DF94D984B2ABBB1FB94318F20C96DD90E4F286D33AD447CA61

Function 05839008 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec438e35cfabe3af64b66f605ae6082b3faf7445977ebe24eb8ba4fc5930383
Instruction ID: ff2c6dacd287f24d3e8e3487d6255760bf4e921ea7974d1ebcd7a0427a6537bb
Opcode Fuzzy Hash: cec438e35cfabe3af64b66f605ae6082b3faf7445977ebe24eb8ba4fc5930383
Instruction Fuzzy Hash: 012100303102118FDB14EB79C465A2A77E6EF8571571584ADE906CF361DBB2DC46CB90

Function 05838FF9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a933d111df1f73c21231342c8f06ded9ec9c07de606da8a09975730d99b62205
Instruction ID: 93591c51bf85d23e984bf5d754af89198bdaac1f32aa7b985aedb8a64e24ae41
Opcode Fuzzy Hash: a933d111df1f73c21231342c8f06ded9ec9c07de606da8a09975730d99b62205
Instruction Fuzzy Hash: 99217C303142018FDB29DF39C468A2977E6EF85714B1584AEE906CF3A1DBB2DC42CB80

Function 05836820 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ebb7cd4821d20f7dd9c44f33ae32085448696289d6ebf6dfdbd802f3f5fd49
Instruction ID: 920033e12e5f0f6be7119c434f0d35e85d3a89ce52c55d7ab56e421641fc4dec
Opcode Fuzzy Hash: 55ebb7cd4821d20f7dd9c44f33ae32085448696289d6ebf6dfdbd802f3f5fd49
Instruction Fuzzy Hash: D8219231A1070ADFCB04EF6DC884899F7B5FF9931075186A9E549AB321EB30ED85CB81

Function 058363B2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2308c664a8bd82c221257d4481bb3d1785ea9aabc26061a426d4b9531ba69e
Instruction ID: c3b31c5b2e9180f30feb345b5b108f268088f1374a185d9aa9f0f843fb5435e2
Opcode Fuzzy Hash: cb2308c664a8bd82c221257d4481bb3d1785ea9aabc26061a426d4b9531ba69e
Instruction Fuzzy Hash: 8C311974A01209AFDB10CF59D595BAEBBF2FF88310F158069E906BB750DB31AD50CB94

Function 05838D30 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7ab2e15a0bec6853bcc30937265cdd05453c7366e4b6df57b2b4c84ff11f7c
Instruction ID: e7d9d83ce23e77023679f44886eae74c532ffda530e62c952af025dcfe49a0ca
Opcode Fuzzy Hash: ea7ab2e15a0bec6853bcc30937265cdd05453c7366e4b6df57b2b4c84ff11f7c
Instruction Fuzzy Hash: 9411B431F11B194BDB21EEADC8426BEB7B6FFC4610F04862AE906E7240DB749D418BC1

Function 05836C31 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17902c19157826e09caca690d612efd4c9bb2ea0e04914905906572fb0171c2
Instruction ID: 7dca82f8b27678991cfa43c91fe913f59dfe8dcf9f5b5778aaa5083973f39b76
Opcode Fuzzy Hash: f17902c19157826e09caca690d612efd4c9bb2ea0e04914905906572fb0171c2
Instruction Fuzzy Hash: D421AC31A007029BCB159F6DC88265ABBB1FF88310B108969C90AAF345EB31EC85CBC0

Function 05832B98 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff08c95d12a81a67a2d1d39d132249a123d2f9fa8ff73c59a8fe2169f86fd8e
Instruction ID: 73aa654b713e13272a97bc6e0f157b0d664c11703dc785f98cafacd9be4a255d
Opcode Fuzzy Hash: 9ff08c95d12a81a67a2d1d39d132249a123d2f9fa8ff73c59a8fe2169f86fd8e
Instruction Fuzzy Hash: 69215B38A01218EBCB24DFA1E5495EEFBB2FF44311F214569E892B2654CB309D65CB80

Function 058358B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413c4073da95bdbbe2abd05a5c66eebbef93ff3815f3d3ef451af0a6d08b9d43
Instruction ID: 36da283d24846e462738cb300950a30a14ca78eb1019a0bb633a48e9f9c6b2d4
Opcode Fuzzy Hash: 413c4073da95bdbbe2abd05a5c66eebbef93ff3815f3d3ef451af0a6d08b9d43
Instruction Fuzzy Hash: C621627190024BDFDB05EBB8E8916EEBBB5FF84304F004469C601AF251DF719A4A8B91

Function 0154D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134031686.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fe462689eabcbf0706f6fbef0c112dac84bb78a2d2668c7958e6eadd2a7c94
Instruction ID: 78d3f2a5a4b95c601ad206932866bc1b79ee5098671faa474556f09a25284345
Opcode Fuzzy Hash: 31fe462689eabcbf0706f6fbef0c112dac84bb78a2d2668c7958e6eadd2a7c94
Instruction Fuzzy Hash: 872192755093808FCB13CF64D994715BF71FB46218F28C5DAD8498F2A7C33A980ACB62

Function 05831B99 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046516176b217b7239235ce0365a00d2332f6c08617bf75250c2b9a102204eae
Instruction ID: fb2765ffacf33389648aaf2250be73bc0f695ea0f82409df3c2991e0fa84d5cb
Opcode Fuzzy Hash: 046516176b217b7239235ce0365a00d2332f6c08617bf75250c2b9a102204eae
Instruction Fuzzy Hash: 6F11B1716002098FCB00EB69C4599ABB7FAFFC4601B008569DA02DF360EF70EC098F90

Function 05838D2B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cc080c9a252c9ad10e68678a70688ba2d07d1256f676d8a6ec2d87b65a9a48
Instruction ID: 88bc26d190f7e304c0749d4cae5c33c4347dd96aa15527aae981439aca5f3ee6
Opcode Fuzzy Hash: 78cc080c9a252c9ad10e68678a70688ba2d07d1256f676d8a6ec2d87b65a9a48
Instruction Fuzzy Hash: 9C11E532F117155BDB20EEA9C8427BFB7B6EBC4610F14853AE906E7344D674AE018BC1

Function 05838A4C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45af1c29c7da6b8645ac27de1a4f74f936dd28fea5c790b7c0e00b5be0a45d55
Instruction ID: 30d0cc98b65efcea53ca1a0c5a2fab58ffc8f257dc247b4ac881de078038cb2d
Opcode Fuzzy Hash: 45af1c29c7da6b8645ac27de1a4f74f936dd28fea5c790b7c0e00b5be0a45d55
Instruction Fuzzy Hash: C9217F31701705CFC754EB78C445AAAB7B6EFC5315F00886DE55A8B260DF71A88ACB82

Function 05839739 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce90e2bf0951c9da76a2ff0b6c61cdff4512878024b47de142e515c03efef2f
Instruction ID: feb194af2553a866a249e6a617012d7b89857b957e45b485bdda91621c3b938c
Opcode Fuzzy Hash: 2ce90e2bf0951c9da76a2ff0b6c61cdff4512878024b47de142e515c03efef2f
Instruction Fuzzy Hash: D7219D32600705CFC765EB78C449AAAB7B6EF85314F0588ADD5595B260CF71A88ACF82

Function 058358C8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee09720f18e8030591fb16bc827279c8b7d9089272c747cbd706755a75f14bcc
Instruction ID: d800d27379f3ea2f5ec7b97f4af1738d22d465029890b3d8acc7ab13093aebb8
Opcode Fuzzy Hash: ee09720f18e8030591fb16bc827279c8b7d9089272c747cbd706755a75f14bcc
Instruction Fuzzy Hash: 9F113330A0010BDFCB05EBB8E8909AEBBB6FF84304F404569C6016B251DF715E4A9B91

Function 0583BE39 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69dbb6e2e83816ab8b379dbb64350b35678f43a32a2f5b927a76a0e6088bdb4
Instruction ID: 7b9c217fdd031e03f16149e459a46cdae0c661fdcf7feb76c86a79dde873883f
Opcode Fuzzy Hash: d69dbb6e2e83816ab8b379dbb64350b35678f43a32a2f5b927a76a0e6088bdb4
Instruction Fuzzy Hash: 4111C4763182014FDB248A1CC8C66A93BE2FFC9311F1980B6E54ACF3A6D925DC058B90

Function 0153D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 225b22155be341ccb9b3350c5dfcc10ba702937b7aa74533e6fc80e8b330d72e
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: D411CD72404240CFCB02CF54D5C0B5ABF71FB84224F2482A9D8090F257C37AE456CBA1

Function 0153D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 02412dd3da4d6019cbd59bb5da14eb95345785c05e01da38ed28a041617437c5
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 62119D76504280CFCB16CF54D5C4B1ABF71FB84218F2486A9D8494F656C33AD456CBA1

Function 0154D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134031686.000000000154D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0154D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_154d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: 735318acccb9169e4228228883ff820f26c922ad02ad365866914c2afb931ad9
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: B011BB75508280DFCB02CF54C5C4B19BBB1FB84228F24C6A9D8494F296C33AD40ACB61

Function 0583BCF8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43310e68ca1918b8577b79017eed722619b64e17fde7c96a27e5985ad9f43827
Instruction ID: 2852cdcd3dad2d2c8dbf0d16676aed88bd33324e772d9805bba462a7fb635370
Opcode Fuzzy Hash: 43310e68ca1918b8577b79017eed722619b64e17fde7c96a27e5985ad9f43827
Instruction Fuzzy Hash: 670190B67083518FC7119E298856AB87BB19F83666F0E029AD852CB6F6CF34DC05C791

Function 05831580 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a56d5d3551702579ba7bcecbf88f9f6b08955d8fccf8ed02269847c0577d558
Instruction ID: 4fa7687d0c50f68bdcbea49259b805103e54d2997a337d279e7d2e9c37498e07
Opcode Fuzzy Hash: 4a56d5d3551702579ba7bcecbf88f9f6b08955d8fccf8ed02269847c0577d558
Instruction Fuzzy Hash: 091137B5C042488FDB10EF9AD544B9EFBF8EF48310F14801AD915A7310D374A904CFA4

Function 05831734 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798710a5149087968dc8cab9ae0431260e674a26585290bd071bf39dba03d7d6
Instruction ID: 3c60ccff84a915ead3b5ee234e3771c5a479a6e45382aa7dd29fe16cf8038497
Opcode Fuzzy Hash: 798710a5149087968dc8cab9ae0431260e674a26585290bd071bf39dba03d7d6
Instruction Fuzzy Hash: 771123B5C042088FCB10EF9AD544B9EFBF8EB48220F14801AE959A7310D378A904CFA5

Function 0583214B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289fa77afd2f00821b288a999c9b523297c3a6f92b24fb1d486e2d9edd098147
Instruction ID: 111f33341ce8a2081f8851dc7bb0d94d59fb14833135ee88075a3d92614a6189
Opcode Fuzzy Hash: 289fa77afd2f00821b288a999c9b523297c3a6f92b24fb1d486e2d9edd098147
Instruction Fuzzy Hash: 4D1102B5C002498FDB10DF9AD945B9EFBF8EB88320F14841AD959A7310D378A944CFA5

Function 05833728 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1de5d601d98acb77ed3a47ee662aa55b56f3e5b31227d15892833af7dafaa6
Instruction ID: f1b447b392ef50458ab4504de5573a95e36fe212c0ddad683dfbbc64192d3573
Opcode Fuzzy Hash: ef1de5d601d98acb77ed3a47ee662aa55b56f3e5b31227d15892833af7dafaa6
Instruction Fuzzy Hash: C21125B58046488FDB10DF9AD485BDEBBF4EB48320F24851AD919A7350C775A944CFA1

Function 0583333C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3a6e6f4204e344d95d555f514a5fdc13b8b67ef3e08990b2731bbaa9c87813
Instruction ID: edfd3c30bab87e615c1f71bfa8e4b6dcd0264933c7de844c9478c260cc9afd2c
Opcode Fuzzy Hash: ed3a6e6f4204e344d95d555f514a5fdc13b8b67ef3e08990b2731bbaa9c87813
Instruction Fuzzy Hash: C01122B58003488FCB10DF9AD485B9EBBF4EB48320F20841ADA19A7210C778A944CFA4

Function 058332E8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9103f891360e91ad685f776aa9e1962acc0e2fe40e8f5a2cd7f5aea037086fe4
Instruction ID: b1358ac4466dd624a23265900637535c7a3dc09652cc950f64346baf4f61d5ca
Opcode Fuzzy Hash: 9103f891360e91ad685f776aa9e1962acc0e2fe40e8f5a2cd7f5aea037086fe4
Instruction Fuzzy Hash: 651122B58003498FCB10DF9AD485B9EBBF4EB48320F20881ADA59A7310C778A944CFA4

Function 0583436F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43fa20554920c684f978f302020f9aa4833710379caf80a9120ce447d5893e3
Instruction ID: 2e3faeb96370b5a3580fbba6d42e6c37a2f9114934c972fe427aea58d9af3044
Opcode Fuzzy Hash: b43fa20554920c684f978f302020f9aa4833710379caf80a9120ce447d5893e3
Instruction Fuzzy Hash: 0D01D1303507145BDB14A628D82EBAE729AAF85B05F00451CDC02CF3E1CFE69C0A83C6

Function 0153D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 545b1c7a148f590c8cec1b0b7fa2a6a0ec5021ba59af3dadcfede4948aedf098
Instruction ID: 1fc47aa36084c4192d18cab4cbfdcb75c35336d8d9b0f525a827180c4e0d3da9
Opcode Fuzzy Hash: 545b1c7a148f590c8cec1b0b7fa2a6a0ec5021ba59af3dadcfede4948aedf098
Instruction Fuzzy Hash: 1B01F7310043849AE7125AA9CD84B6BBFF8FF81264F58851AEE084F282D23D9441C671

Function 0583D2A9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8497b4ff381efe5e9d823cef39f80c92083e26dd8bc94fe353f25f56b197e1
Instruction ID: c2a7deb4af2b6b4b3d90e9f454f4a8998c3e161d6069438247a850aa109df505
Opcode Fuzzy Hash: 9b8497b4ff381efe5e9d823cef39f80c92083e26dd8bc94fe353f25f56b197e1
Instruction Fuzzy Hash: AB01DF30605B058FC315EF79C44256ABBB6BF82240B40896EDD82CB261EB30ED85CB91

Function 0583D2B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2228751db25c2a37d9df0ded73f61a80bb1b71cceb7ac2b1283933a3c384d8c
Instruction ID: 5a5028ddcda88387070eb27d6c0061767eccdb8238346b2f16e824c6100c0fe2
Opcode Fuzzy Hash: d2228751db25c2a37d9df0ded73f61a80bb1b71cceb7ac2b1283933a3c384d8c
Instruction Fuzzy Hash: 71011331601B058FC728EF29C44656AB7B6BF85241B50896ED9868B260EB31ED81CB91

Function 05834F48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae52e08b8f76d32414833f91c7eff5453a1edcc932a1c524aad316086092ce6
Instruction ID: 32d762a4b2f9650eb6369a4261e09f0de7f817eaa692f81472cff90a0d06e1f3
Opcode Fuzzy Hash: 5ae52e08b8f76d32414833f91c7eff5453a1edcc932a1c524aad316086092ce6
Instruction Fuzzy Hash: EB01F2313147049BCB02AA29981896EBBB6EBC5360705425AF805C73A1DF75CD85D791

Function 05833732 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346be6c494fe637ca766f9b3696d434b96a753284e6a37b9aad5d7bb27886221
Instruction ID: 1e0cc1d0cc558cbe35b09d56806475d14f81ff1f52fed30b823140ed71c05017
Opcode Fuzzy Hash: 346be6c494fe637ca766f9b3696d434b96a753284e6a37b9aad5d7bb27886221
Instruction Fuzzy Hash: A81112B5800249CFDB10DF9AD485BDEFBF4EB48320F24841AD919A7210C739A944CFA4

Function 0583DA80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e851ac1f169233e41fb68d8845378f41e391c84ceae281d5d796b5c71f704e6e
Instruction ID: d2c098fa2b529cc738f1ae87b4418592b67bcdbaae9148d7e65761c4aae54641
Opcode Fuzzy Hash: e851ac1f169233e41fb68d8845378f41e391c84ceae281d5d796b5c71f704e6e
Instruction Fuzzy Hash: 5A0126317097808FCB02BB78C8094AEBB35EFC2251F05459EDC4997240EF349841C7E6

Function 0583AC59 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9afb3c94c7e86454ded19c10387e721182fb241d215d1b66636b8fbda5a8c87b
Instruction ID: cce2e83b18a7b0338c8a9d842f85fe28960d401729694ddbc2bc540056a86201
Opcode Fuzzy Hash: 9afb3c94c7e86454ded19c10387e721182fb241d215d1b66636b8fbda5a8c87b
Instruction Fuzzy Hash: A1114031D043499FCB01DFACC5448DDBFF0EF09210B15829AE494EB361E730AA44CB91

Function 0583BC89 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dce98fbe8a7296e644dfc1c3540fe9b17e81f7dc96a093d0c9c003f0feb8c0f
Instruction ID: baa820fb745331ec1bd46bb74ee9bf9f50c0ed18bc43186c49172de978ce0e97
Opcode Fuzzy Hash: 2dce98fbe8a7296e644dfc1c3540fe9b17e81f7dc96a093d0c9c003f0feb8c0f
Instruction Fuzzy Hash: 82F0F6B13043108BCB1AAB78941A63D77A2AFC551370A816AEC16CB3B2CF24CC03C7D6

Function 05838882 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c58101ea27c934ba5674531be50cd953d4f68ca7e60727c4c6ef9fef2186d3
Instruction ID: 6a100383787179bad291a493ed9aa7e2a90f9d880ac1935578b5e3404ef8299e
Opcode Fuzzy Hash: e1c58101ea27c934ba5674531be50cd953d4f68ca7e60727c4c6ef9fef2186d3
Instruction Fuzzy Hash: 680181347001109FC764DB29D8589A977F6EFC9611B1980ABE50ACB3B5CF309C42CFA0

Function 05832698 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02452e175447de455101b61de555ab3393bdfa7cc0c0d5cf5d9750bf8e986fd0
Instruction ID: 311135caeb6c0611fe54246851e1f4afd19434e3d805e03ddc5553d7e3d6eaa5
Opcode Fuzzy Hash: 02452e175447de455101b61de555ab3393bdfa7cc0c0d5cf5d9750bf8e986fd0
Instruction Fuzzy Hash: 60F096B5B003189B8F05B6EDD85A5FEBBBA9B88A10B140038EA05E7340EE300E01C7D6

Function 0583B284 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0887db9243ad3f5226325ab4230e3a37e7ad6360835f71df3f8335bfa63656
Instruction ID: 4c9972f23e18655a1540dd58ffb5bd844e20dfc43832843c2fe2d3881be87a5d
Opcode Fuzzy Hash: bf0887db9243ad3f5226325ab4230e3a37e7ad6360835f71df3f8335bfa63656
Instruction Fuzzy Hash: B8F0E970314621CBD724AD2A8497A7E73DAEFC46677044429EC07C7264DF38DC01D6D1

Function 0583DB00 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae25af1282f5c8beff5ba2b3b69d5f591414c6206afea27c13036ebe319561a
Instruction ID: c61711a8f482d4f971703db25dae46ab2f8bf3729a09d4878f5e419b64be56f5
Opcode Fuzzy Hash: 7ae25af1282f5c8beff5ba2b3b69d5f591414c6206afea27c13036ebe319561a
Instruction Fuzzy Hash: 42F0F6767047008FC7259F19E958A6AB7B6FF89310702015AE54ACB3A2DB74EC47DB90

Function 05832688 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926e4a6a4c82febf3275e7a531ba792aeab279b36b1c2e68df9c786afb0362b8
Instruction ID: 886f27eec3e24f546f7c0821637aa326911adea4cfe6c710961ffa0f0055f3b1
Opcode Fuzzy Hash: 926e4a6a4c82febf3275e7a531ba792aeab279b36b1c2e68df9c786afb0362b8
Instruction Fuzzy Hash: 66F0C8B5B003448FCF06EBE8D45A1FDBB729B94610B140479DD05D7290EA340E11C7D7

Function 05834380 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f6787ae4c23388dbce7312bafcd4157493d6877e54a16c1cbc812d1ecc3d09
Instruction ID: a33c42648740def316f5504e1185a0e928bd27f677c041022ddc9a485e8bb5ac
Opcode Fuzzy Hash: 25f6787ae4c23388dbce7312bafcd4157493d6877e54a16c1cbc812d1ecc3d09
Instruction Fuzzy Hash: B7F0963035071457DB14AA2CE42AB6E3296AF88B15F00451CEC06CF3D1CFE69C4583C5

Function 05834F58 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcde43d43ea3583e72765d8f687e47bb298ebb699406bf4b90d47362ce7b8bb
Instruction ID: c70963975c79cb05335f4274b353e9aa43ed9f575ad00da34075d839b3e43c9a
Opcode Fuzzy Hash: 6dcde43d43ea3583e72765d8f687e47bb298ebb699406bf4b90d47362ce7b8bb
Instruction Fuzzy Hash: DBF0C235310B048BCB15BB29E41896EBBAAFBC9321741821AF80A873A0DF7588859791

Function 0583DE88 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac507552e9e836ba44aa1efd5987a847c37f69e0ce402491c7b7315b9553205f
Instruction ID: 7c93d6086181d185320c5404744fd33b68b269eefd67090b0c928adc52bec8ea
Opcode Fuzzy Hash: ac507552e9e836ba44aa1efd5987a847c37f69e0ce402491c7b7315b9553205f
Instruction Fuzzy Hash: 86F0B471B056024FC7015BB9F89994DBFE5EF99561305456AE109CB361DD608C0687E0

Function 0583DE98 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6457e93dd08d64d00180964b67c3e2543191b37fcf1d98e5fbd71f401400b383
Instruction ID: 8f4b5865a98ae92a9483761b177f500d0d3e4361d8f034900a081a19696d70a1
Opcode Fuzzy Hash: 6457e93dd08d64d00180964b67c3e2543191b37fcf1d98e5fbd71f401400b383
Instruction Fuzzy Hash: F9F05432B046124F97149BAAF88485EBFE9FBC8265304453AE20ACB220DE71DC0687E0

Function 0583DA90 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e49c979961421bea34e6558306ae3ef3658789b5fab5831dee98d2d6bbba797
Instruction ID: c1f286f8dd5691cba1d12fa2de79cb4b836d60e8cbf6761dc2f03ab03c93d4ac
Opcode Fuzzy Hash: 8e49c979961421bea34e6558306ae3ef3658789b5fab5831dee98d2d6bbba797
Instruction Fuzzy Hash: A4F06231704B048BCB15BA7CC4064AEB779EFC1251F05456DDD49A7240EF70A941C7E6

Function 0583BC98 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4496c3d046a1bcf06963c313141a728d4f0d4ce8c96132e20d95e22c95237a0e
Instruction ID: 30cff02a4dab76363a36f259fad2832cfffd9cbbc9295b19cae1dff0607e457f
Opcode Fuzzy Hash: 4496c3d046a1bcf06963c313141a728d4f0d4ce8c96132e20d95e22c95237a0e
Instruction Fuzzy Hash: 9FF082B13047108BCB29A67D901A63D7296AFC8913B154129EC16CB3A1DF64CC03C7D6

Function 0153D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133982423.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_153d000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39cd564917b71690a94349a4746f58d3c3a81094ae5a876a6172f924ab2ad8d3
Instruction ID: 0fca697a9b55bffb3ae9b51da73829b55fc69ec2cb43979afa77da7dc4624baa
Opcode Fuzzy Hash: 39cd564917b71690a94349a4746f58d3c3a81094ae5a876a6172f924ab2ad8d3
Instruction Fuzzy Hash: 6CF0C2724043849AE7118E1AD884B66FFA8FB81634F18C05AED080F286C3799844CAB1

Function 0583DEF1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c566d16619a6e84d713595fc0b0ee96946c6b2996d34005f4a228b505e6055
Instruction ID: 2f62cc9cc629230f777dd631b210a243f69b732953b333bbfc3118335cf61844
Opcode Fuzzy Hash: b5c566d16619a6e84d713595fc0b0ee96946c6b2996d34005f4a228b505e6055
Instruction Fuzzy Hash: 60F044352566508FC705CB2CD5888987BF6BF0A71430644DAE00ACF772CB61EC41CB50

Function 0583DB10 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a7c98a562cf1d08871eb880574e4f7579a2fab57fcbaf7f09306a585cf2385
Instruction ID: 9681ebe911cc9a6f1884e34621859f375fb14e000e6ef14b1e8a5a87af82ba64
Opcode Fuzzy Hash: 98a7c98a562cf1d08871eb880574e4f7579a2fab57fcbaf7f09306a585cf2385
Instruction Fuzzy Hash: 10F054353007048FC7249B1AD454A1AB7ABFFC8761750055DE50A8B761DF71EC86C794

Function 0583AC68 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 058384B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3262c620da221ed6a46d5176928a6ccdc3692a054b31f7d42ec5fb5605cc3e09
Instruction ID: 1dec2c6aec02d96bb124f44057f9a33f4b1b07bbd3d5b2b2e87d20372e296cb3
Opcode Fuzzy Hash: 3262c620da221ed6a46d5176928a6ccdc3692a054b31f7d42ec5fb5605cc3e09
Instruction Fuzzy Hash: C1E01271B15B144B870CEBAEA44486BF7EBBFC8510318C1BED50DCB665EDB19C458AC4

Function 05836994 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f298eafbf5d41e67c97e4185ed981657ca0c9ed294c59f9e32956836e893fc
Instruction ID: c984104bb65e1289e4507b58de85b00bea623626806fea07d44c5665e003a0b1
Opcode Fuzzy Hash: 30f298eafbf5d41e67c97e4185ed981657ca0c9ed294c59f9e32956836e893fc
Instruction Fuzzy Hash: B1F0A91260E3D05FC32303B91C366A13FB08A1350978A40EFD999CF5A3E108881AC3A6

Function 0583DF00 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78842689e8fdb424320a1b063ca3d11f0f81c9fa81c0ab698e6ee2b00c964c9
Instruction ID: 158a64b1ae70268ccf4c78b1171408d9135bd39b97813537f473cde8964f704f
Opcode Fuzzy Hash: a78842689e8fdb424320a1b063ca3d11f0f81c9fa81c0ab698e6ee2b00c964c9
Instruction Fuzzy Hash: E6F0F231210610CFC718DB2CD588C59BBE6FF4AB1975245A9E50ACB772CB72EC41CB80

Function 058384A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d6927c59a8e730bc4fc9672b2ed91d059139b2e39f18949220c8638118e2b7
Instruction ID: a4e55aed1d3720933622b5f75ad4db1a04f6f2a096a72055a4c072baaf53b888
Opcode Fuzzy Hash: 19d6927c59a8e730bc4fc9672b2ed91d059139b2e39f18949220c8638118e2b7
Instruction Fuzzy Hash: 0CE020752087540FC715D6A554104937FBEBFCA100305D1EAD445CF657D9605C478BD0

Function 05831B40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb3f57c41d5f523d59b83ef158d611a9562591b8c9c7fdafd77a110f9288ec6
Instruction ID: 543d4fde943bc6b216acdc9c0d9ab759313497de8198ab0abbc56180b6dfdbda
Opcode Fuzzy Hash: cdb3f57c41d5f523d59b83ef158d611a9562591b8c9c7fdafd77a110f9288ec6
Instruction Fuzzy Hash: A6F02071A0530AEFEB02DFB8E94A18CFB79FF812007208189D804CB300EA32AE04CB50

Function 0583BC50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49eb0f3c0b03f497485a8dcd51d94201fc9048e35dc94946e92ea87495f039b7
Instruction ID: 5e1bd9dc66324be41438493be4941a470856f3369dcdb184beab615c213b3f7d
Opcode Fuzzy Hash: 49eb0f3c0b03f497485a8dcd51d94201fc9048e35dc94946e92ea87495f039b7
Instruction Fuzzy Hash: 2AE09A302197818FC328CB1CD440C857BF2AF4920031646EAE04ADBB62CA20EC0A8B94

Function 05838ABC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1ef96bcf3ca1411dc5d06a1c22e65297a4b9e766d414a98106accda6cf58c7
Instruction ID: 3dc13c4e118dcf2f83d7716be988f9f2c8322628a2995323ed6ce3a41bf173db
Opcode Fuzzy Hash: cd1ef96bcf3ca1411dc5d06a1c22e65297a4b9e766d414a98106accda6cf58c7
Instruction Fuzzy Hash: 70E0C2303146089FC328DB1CE8C0DAAB3EAEF883113148A6DF10AC3330DE60FC0A4684

Function 05836370 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b776074b7bf398b102e8e1e2d9e0a7a2381940de17c1125bbce595bcf6b6dcf2
Instruction ID: 7888a0b9d4877980d2ba00613b37c2bfab7f7e5e718f2b41df37c4980f984031
Opcode Fuzzy Hash: b776074b7bf398b102e8e1e2d9e0a7a2381940de17c1125bbce595bcf6b6dcf2
Instruction Fuzzy Hash: E5E04F36104588AFCB02CF59CC058953F71BF1A250B044086F944CB272D231C821DB91

Function 05836968 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c0558c93bc377d4ac1c8bbd9bde43389e75ec137d53d81fd7a057f1ee82cf5
Instruction ID: 32c204dfeabbef803c70aa7ef13be74060526b9f0733f68dce985572cc97d43f
Opcode Fuzzy Hash: b3c0558c93bc377d4ac1c8bbd9bde43389e75ec137d53d81fd7a057f1ee82cf5
Instruction Fuzzy Hash: E3D0A7323013345F4B2836B9742906D339DDE84676300007EFD1ECA650FE218C0183C5

Function 0583654B Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a70750389ed616c98ad5b3c4177f34130ffbf5e65b772950d7ee4063f805f33d
Instruction ID: 961b46b1fda8d993dec3ce923ef67a5c28601c92f48d008139ce674e523b5742
Opcode Fuzzy Hash: a70750389ed616c98ad5b3c4177f34130ffbf5e65b772950d7ee4063f805f33d
Instruction Fuzzy Hash: A8E01236A0120DABCF00DF84E945BDEBB32FB88316F208015EA016A290CB324E21DB91

Function 05831B50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e88658fdba1cad1191456a1de296fc67712f1db162f09d4af0623ddebf1296b
Instruction ID: bf83d1aa9e12c9ab8e5d50009437e2599e0039d8bec87263cd5e1cbe8e26fb16
Opcode Fuzzy Hash: 3e88658fdba1cad1191456a1de296fc67712f1db162f09d4af0623ddebf1296b
Instruction Fuzzy Hash: 45E08670B00309EFCB40EFA8F44455CBBBEFB84200B108558D80497300EA366F009F50

Function 058390D1 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37aa62934ded07cfe181a57f9d586e1edd6760dab8e87d40a75f67afd9eb6b08
Instruction ID: 573ef0e0faa17b8026391fe12a4037ad6a657310e2f51235ac24345771d596e1
Opcode Fuzzy Hash: 37aa62934ded07cfe181a57f9d586e1edd6760dab8e87d40a75f67afd9eb6b08
Instruction Fuzzy Hash: 0CD012756101504FC7015F78E559AA67FB5EF89B1170540EAE9598B326CA2288108B44

Function 058390E0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707461df3a18aa8e3f03c119bf957dd25b35e3e4558253515191f804ef71c90d
Instruction ID: 02e9293e1655a2a848fde9d1a95004e3216a96d04efe9b7de21e6e0717f972cc
Opcode Fuzzy Hash: 707461df3a18aa8e3f03c119bf957dd25b35e3e4558253515191f804ef71c90d
Instruction Fuzzy Hash: 88D0C9363202289F87049B68E849CAA7FEDEB4D7613118066FD09C7321CE71EC108BD8

Function 05836958 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 315bfafb621327d37ee2161ec401760f98ecc685184255e06091259e3ee9fc0a
Instruction ID: c7e00104ebbe507323185bc9769080d40f95a35ef2252b41900c977a1f3db30a
Opcode Fuzzy Hash: 315bfafb621327d37ee2161ec401760f98ecc685184255e06091259e3ee9fc0a
Instruction Fuzzy Hash: 76D0233630555007C35107B425367E17BF44F40925B4B40FEDC6CC7551E5044417854C

Function 05836380 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction ID: 103967bf13f508402a192ef6221732069224ae084a114efb1bafc53f37aadea3
Opcode Fuzzy Hash: c63055a45eeb4ae8ae8d6e3381b45a0748b663f32349da8a3f0a884f24e2bbca
Instruction Fuzzy Hash: BCD0C93614010CEFCB01CF95D844D9A3BBAFF48720F008054FA084B232C332E821EB90

Function 05836C10 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580481cf8996f3cbc27386042af9f10a9ea2c39105d6e71a02985ae52ddc8fe1
Instruction ID: 628634836bd86852b1231cb92e5a3df802e0553e75e5adca88dd50af150518dc
Opcode Fuzzy Hash: 580481cf8996f3cbc27386042af9f10a9ea2c39105d6e71a02985ae52ddc8fe1
Instruction Fuzzy Hash: 97B0129F9001001EFF14E135BD4774B5333EFD1209FE8E0105C81A4503F418824321C2

Function 05836542 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction ID: 79bf76b974e55adf5a226064e1a738254615455acf8f1383ec89e6682f1ec8c5
Opcode Fuzzy Hash: 8fc304a26ba6a9b8e09db51e88682a954301326f375d2764bec1dfa900b44145
Instruction Fuzzy Hash: 9EB09237A0400D99DB008A89B4423EEF720E780229F204023C611920419372016496D1

Function 05835894 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137076305.0000000005830000.00000040.00000800.00020000.00000000.sdmp, Offset: 05830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5830000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938125340af3cc952ce94633d92c5e43436d281831c008b692b3f85736ea71e1
Instruction ID: 70c6011dda8172a3c9d06c189d12b0ff380b4cbcd870a9b096bfe680857078d6
Opcode Fuzzy Hash: 938125340af3cc952ce94633d92c5e43436d281831c008b692b3f85736ea71e1
Instruction Fuzzy Hash: D9B0122470010161CF04E53E09CA53B4513EAC02003C0DC052D4284014C81488024189

Non-executed Functions

Function 0808B4D0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310d6555ceb0bffcdeb91c469820d3fc83e67748e4eb67adbae74403f6a0cec2
Instruction ID: 8d011d4e43a3a564d6af4f973be405b650c17a89ed14ab8b9c93db29a28147ab
Opcode Fuzzy Hash: 310d6555ceb0bffcdeb91c469820d3fc83e67748e4eb67adbae74403f6a0cec2
Instruction Fuzzy Hash: B2D1AC35700704CFDB29EB79C460BAE77E7AF89612F54846DD1858B3A1CB34E886CB61

Function 08084451 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3708689d7ffe3095be55577d145d35e12c64113cd029461b280a04a464878c
Instruction ID: 1a500fc8c841bfbc9c7aff8801d5ee96c7cb30639e8587e270867c81bf279711
Opcode Fuzzy Hash: 7e3708689d7ffe3095be55577d145d35e12c64113cd029461b280a04a464878c
Instruction Fuzzy Hash: B5E116B4E00619CFDB14DFA8C5909AEBBF2FF89305F248169D454AB316D730A942CF64

Function 05800040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137005719.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5800000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0687cfccb925225d4b279ad68d8fb70169f8c6a9fc9a8e61dfd5dd3e92085b7
Instruction ID: 6f26227937408ac40b2f468f4c8e9ed5b4fb1b7f2584cd7cfed39298caf2900f
Opcode Fuzzy Hash: e0687cfccb925225d4b279ad68d8fb70169f8c6a9fc9a8e61dfd5dd3e92085b7
Instruction Fuzzy Hash: 591299B0401745AAD330EF65FC4C199BBB1BB66324BB0E709D2615F2E9EBB8154ACF44

Function 08084898 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2abda88e9e5e7daa6457c830c2741e17a1dc98712c9733cfda061647b9d773
Instruction ID: 9b276a48deab8797cfb5a25d368cd8f7de49f4bd21fdce0fa8aa69e053bf48ca
Opcode Fuzzy Hash: 4a2abda88e9e5e7daa6457c830c2741e17a1dc98712c9733cfda061647b9d773
Instruction Fuzzy Hash: 53E10674E00619CFDB14DFA9C580AAEBBF6FF89301F248169D454AB356D730A982CF64

Function 08084CD0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4642d248551d84d6f3a24f54acd33a082c13758e1481fc4d4368a0833120c1
Instruction ID: 5091808f782e089df0b81fd9377d4dc5d17be109ac1041755ff1de87414a9f86
Opcode Fuzzy Hash: de4642d248551d84d6f3a24f54acd33a082c13758e1481fc4d4368a0833120c1
Instruction Fuzzy Hash: C8E1F674E00219CFDB14DFA9C9809AEBBF2FF89305F248169D454AB356D730A982CF64

Function 08086530 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f8e49805859fa5ee0ed44707f9ba89ac55c6e0c5d3793fe0ff3aceb321ce3bb
Instruction ID: 49b2e7eaecd66b5f32a0edbae2d650411ca94738b9c6b4270ebe04919e5bc797
Opcode Fuzzy Hash: 6f8e49805859fa5ee0ed44707f9ba89ac55c6e0c5d3793fe0ff3aceb321ce3bb
Instruction Fuzzy Hash: F8E118B4E00219CFCB14DFA9C5949AEBBF2FF89301F248269D455AB356D731A942CF60

Function 08086E08 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad33cedfa06a67c7d399458d08a7b46f1dd42e09b328d73fdbaa42ae80e901b4
Instruction ID: 72b51cac3c4323a93b9b3d4845781930980170bb9d0a23d6b2d47837b763e918
Opcode Fuzzy Hash: ad33cedfa06a67c7d399458d08a7b46f1dd42e09b328d73fdbaa42ae80e901b4
Instruction Fuzzy Hash: 22E1F574E00219CFDB14DFA8C594AAEFBF2BF89305F248169D454AB356D731A982CF60

Function 0320DEEC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134671679.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3200000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d328d75eaf5778f01f44b61c308f4ec618a1e375d39b2c44e25748321415b01
Instruction ID: 4b89138627e4d4b364d2f65a62e6095b9b1ca8039ddb5b8f550b8e17e05669f7
Opcode Fuzzy Hash: 9d328d75eaf5778f01f44b61c308f4ec618a1e375d39b2c44e25748321415b01
Instruction Fuzzy Hash: E2A17136E103069FCF15DFB4C9445DEB7B2FF85300B198569E805AB2A6DB71D94ACB40

Function 05800007 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2137005719.0000000005800000.00000040.00000800.00020000.00000000.sdmp, Offset: 05800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5800000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d407b6b642c4f8c5f47109e205610f90c50b679609c43f88e4d2347e170f92
Instruction ID: 2f1fd59e5abbee930f3620fa617ac6b4751ff65f9b1a13f4e22b6d14ca4e0084
Opcode Fuzzy Hash: 64d407b6b642c4f8c5f47109e205610f90c50b679609c43f88e4d2347e170f92
Instruction Fuzzy Hash: 1DC119B0401745ABD720EF65FC4C199BBB1BBA6324F70E709D1616B2E9EBB8144ACF44

Function 08084CC0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2138093764.0000000008080000.00000040.00000800.00020000.00000000.sdmp, Offset: 08080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8080000_UsoOuMVYCv8QrxG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3491bc3726565c93024ec09d9b1d2303cad070a84d8f4eb777f7e74e266b56b9
Instruction ID: 29031da1f20ca092cedd6e36a0f29feb1b23d85b623d7b97bf17d91c550a1886
Opcode Fuzzy Hash: 3491bc3726565c93024ec09d9b1d2303cad070a84d8f4eb777f7e74e266b56b9
Instruction Fuzzy Hash: 3151F874E0061A8FDB14DFA9C9805AEBBF2FF89305F24816AD458A7216D7309942CFA4

Analysis Process: UsoOuMVYCv8QrxG.exePID: 6508, Parent PID: 4016COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	1304
Total number of Limit Nodes:	58

Executed Functions

Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
GetProcAddress.KERNEL32(00000000), ref: 0041CB88
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
GetProcAddress.KERNEL32(00000000), ref: 0041CC11
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
GetProcAddress.KERNEL32(00000000), ref: 0041CC25
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
GetProcAddress.KERNEL32(00000000), ref: 0041CC39
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
GetProcAddress.KERNEL32(00000000), ref: 0041CC61
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
GetProcAddress.KERNEL32(00000000), ref: 0041CC75
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
GetProcAddress.KERNEL32(00000000), ref: 0041CC86
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040E9E1), ref: 0041CC97
GetProcAddress.KERNEL32(00000000), ref: 0041CC9A
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
GetProcAddress.KERNEL32(00000000), ref: 0041CCAA
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
GetProcAddress.KERNEL32(00000000), ref: 0041CCBA
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040E9E1), ref: 0041CCCC
GetProcAddress.KERNEL32(00000000), ref: 0041CCCF
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040E9E1), ref: 0041CCDC
GetProcAddress.KERNEL32(00000000), ref: 0041CCDF
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
GetProcAddress.KERNEL32(00000000), ref: 0041CCF3
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
GetProcAddress.KERNEL32(00000000), ref: 0041CD07
LoadLibraryA.KERNEL32(Rstrtmgr,RmStartSession,?,?,?,?,0040E9E1), ref: 0041CD19
GetProcAddress.KERNEL32(00000000), ref: 0041CD1C
LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040E9E1), ref: 0041CD29
GetProcAddress.KERNEL32(00000000), ref: 0041CD2C
LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040E9E1), ref: 0041CD39
GetProcAddress.KERNEL32(00000000), ref: 0041CD3C
LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040E9E1), ref: 0041CD49
GetProcAddress.KERNEL32(00000000), ref: 0041CD4C

Strings

RmEndSession, xrefs: 0041CD3E
NtUnmapViewOfSection, xrefs: 0041CBB8
user32, xrefs: 0041CBA9, 0041CC2C, 0041CC40, 0041CC54
SetProcessDEPPolicy, xrefs: 0041CC13
GetComputerNameExW, xrefs: 0041CBEB
NtQueryInformationProcess, xrefs: 0041CCE1
Kernel32, xrefs: 0041CB80
GetMonitorInfoW, xrefs: 0041CC4F
GetConsoleWindow, xrefs: 0041CC88
EnumDisplayMonitors, xrefs: 0041CC3B
RmGetList, xrefs: 0041CD2E
GlobalMemoryStatusEx, xrefs: 0041CBC8
EnumDisplayDevicesW, xrefs: 0041CC27
RmRegisterResources, xrefs: 0041CD1E
Psapi, xrefs: 0041CB60
Shell32, xrefs: 0041CC04
NtSuspendProcess, xrefs: 0041CC9C
GetFinalPathNameByHandleW, xrefs: 0041CCF5
SetProcessDpiAwareness, xrefs: 0041CB8F, 0041CB94, 0041CBA8
IsUserAnAdmin, xrefs: 0041CBFF
GetSystemTimes, xrefs: 0041CC63
RmStartSession, xrefs: 0041CD09
Shlwapi, xrefs: 0041CC79
GetExtendedUdpTable, xrefs: 0041CCD1
ntdll, xrefs: 0041CBBD, 0041CBC2, 0041CCA1, 0041CCB1, 0041CCE6
IsWow64Process, xrefs: 0041CBD7
shcore, xrefs: 0041CB95
kernel32, xrefs: 0041CBCD, 0041CBDC, 0041CBF0, 0041CC18, 0041CC68, 0041CC8D, 0041CCFA
Iphlpapi, xrefs: 0041CCC1, 0041CCCB, 0041CCD6
Rstrtmgr, xrefs: 0041CD0E, 0041CD18, 0041CD23, 0041CD33, 0041CD43
NtResumeProcess, xrefs: 0041CCAC
GetProcessImageFileNameW, xrefs: 0041CB5A, 0041CB5F, 0041CB7F
GetExtendedTcpTable, xrefs: 0041CCBC

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE

Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
InternetCloseHandle.WININET(00000000), ref: 0041B41C
InternetCloseHandle.WININET(00000000), ref: 0041B41F

Strings

http://geoplugin.net/json.gp, xrefs: 0041B3B7

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 4404311406b4a12e258bc180555c1bc499fb9e537e63fa9c5eb012b199318316
Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
Opcode Fuzzy Hash: 4404311406b4a12e258bc180555c1bc499fb9e537e63fa9c5eb012b199318316
Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA

Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
Part of subcall function 00413549: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,004752F0), ref: 00413587
Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592

Sleep.KERNEL32(00000BB8), ref: 0040F85B
ExitProcess.KERNEL32 ref: 0040F8CA

Strings

5.1.0 Pro, xrefs: 0040F836, 0040F8A3
pth_unenc, xrefs: 0040F7BD, 0040F804, 0040F871
override, xrefs: 0040F7CC

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 5.1.0 Pro$override$pth_unenc
API String ID: 2281282204-182549033
Opcode ID: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
Opcode Fuzzy Hash: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF

Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00404F94

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
Opcode Fuzzy Hash: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA

Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,010CD528), ref: 00433849
CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C

Function 0041B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750E4), ref: 0041B62A
GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8

Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.1.0 Pro), ref: 0040F8E5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1

Function 0040E9C5 Relevance: 53.3, APIs: 15, Strings: 15, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB88
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC11
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC25
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC39
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC61
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC75
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000104), ref: 0040E9EE

Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C

Strings

del, xrefs: 0040F2ED, 0040F36F
licence, xrefs: 0040EF88
exepath, xrefs: 0040EE92, 0040EF40
Administrator, xrefs: 0040F287
license_code.txt, xrefs: 0040EA4D
Rmc-TS121V, xrefs: 0040EB05, 0040EB62
User, xrefs: 0040F28E
Exe, xrefs: 0040EB0F
Inj, xrefs: 0040EBD5, 0040EBEC
Software\, xrefs: 0040EAC3
Remcos Agent initialized, xrefs: 0040EFEF
del, xrefs: 0040F2D1
Access Level: , xrefs: 0040F29F
Exe, xrefs: 0040EB14
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 0040E9E6, 0040EE0F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: Access Level: $Administrator$C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$Exe$Exe$Inj$Remcos Agent initialized$Rmc-TS121V$Software\$User$del$del$exepath$licence$license_code.txt
API String ID: 2830904901-2395622804
Opcode ID: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
Opcode Fuzzy Hash: 747d405c528f15ab38f340b499f6c8eb85ced7579b397f1517eaf58dd5f7f014
Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E

Function 00414F2A Relevance: 35.8, APIs: 5, Strings: 15, Instructions: 809
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
Sleep.KERNEL32(00000000,00000002), ref: 00415AD7

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

Connecting | , xrefs: 00415108
%I64u, xrefs: 004152F6
Rmc-TS121V, xrefs: 0041542C
hlight, xrefs: 00415393
TLS Off, xrefs: 004150E5
Connection Error: Unable to create socket, xrefs: 004151EA
Disconnected, xrefs: 00415A47
TLS On , xrefs: 004150F3
| , xrefs: 00415112, 00415253
5.1.0 Pro, xrefs: 004154CB
Connection Error: , xrefs: 0041519F
Connected | , xrefs: 0041524E
name, xrefs: 00415366
Exe, xrefs: 004153F5
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 004153C0

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Sleep$ErrorLastLocalTime
String ID: | $%I64u$5.1.0 Pro$C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$Rmc-TS121V$TLS Off$TLS On $hlight$name
API String ID: 524882891-3571125004
Opcode ID: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
Opcode Fuzzy Hash: 19ef7ff21120ce4d864f1b3937725887b2176c6c21eb35dbedaed6ac899dd5b6
Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D

Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(FFFFFFFF,?,?), ref: 004048E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
WSAGetLastError.WS2_32 ref: 00404A21

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

Connection Refused, xrefs: 00404A76
TLS Error 2, xrefs: 00404955
TLS Error 3, xrefs: 004049D8
TLS Error 1, xrefs: 00404937
Connection Failed: , xrefs: 00404A43
TLS Authentication Failed, xrefs: 00404999
TLS Handshake... | , xrefs: 00404904

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-2151626615
Opcode ID: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
Opcode Fuzzy Hash: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF

Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040DB9A

Strings

\system32, xrefs: 0040DAAE
WinDir, xrefs: 0040DA9B, 0040DABD, 0040DB0F
ProgramFiles, xrefs: 0040DB6E
AppData, xrefs: 0040DB51
UserProfile, xrefs: 0040DB58
SystemDrive, xrefs: 0040DA91
ProgramData, xrefs: 0040DB5F
\SysWOW64, xrefs: 0040DB00
Temp, xrefs: 0040DA66

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
Opcode Fuzzy Hash: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F

Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2

StrToIntA.SHLWAPI(00000000,0046C9F8,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0041B33C

Strings

(64 bit), xrefs: 0041B368
(32 bit), xrefs: 0041B36F
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041B2D7, 0041B2E1, 0041B322
ProductName, xrefs: 0041B2D2
CurrentBuildNumber, xrefs: 0041B31D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 782494840-2070987746
Opcode ID: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
Opcode Fuzzy Hash: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE

Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000,004752F0,?,?,0040F853,004674B8,5.1.0 Pro), ref: 004137A6
RegCloseKey.KERNEL32(?,?,?,0040F853,004674B8,5.1.0 Pro), ref: 004137B1

Strings

pth_unenc, xrefs: 00413773

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
Opcode Fuzzy Hash: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54

Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 00404DD2
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00404DDB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
Opcode Fuzzy Hash: 896836ce6e67791e20d0eed4e42f92f466038b3ea1b67db69a0d6ef4832fab86
Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666

Function 00415AEA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?), ref: 00415B0F
GetTickCount.KERNEL32 ref: 00415B86

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: !D@
API String ID: 180926312-604454484
Opcode ID: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
Opcode Fuzzy Hash: 8534da9eaa12ab86249594b2047bbf4fbef179ea81602a36c7078798381233d8
Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A

Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
GetLastError.KERNEL32 ref: 0040D083

Strings

Rmc-TS121V, xrefs: 0040D069

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Rmc-TS121V
API String ID: 1925916568-3234334023
Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519

Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 004135E7
RegCloseKey.KERNEL32(?), ref: 004135F2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4

Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,004752F0), ref: 00413714
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041372D
RegCloseKey.KERNEL32(00000000), ref: 00413738

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4

Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,004752F0), ref: 00413587
RegCloseKey.KERNEL32(?), ref: 00413592

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94

Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00000000,?,?,0040C19C,00466C48), ref: 00413516
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040C19C,00466C48), ref: 0041352A
RegCloseKey.KERNEL32(?,?,?,0040C19C,00466C48), ref: 00413535

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4

Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798

Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA

Strings

@, xrefs: 0041B7C0

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94

Function 00446185 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004461A6

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

HeapReAlloc.KERNEL32(00000000,00000000,?,?,0000000F,00000000,00432F02,00000000,0000000F,0042F90C,?,?,004319B3,?,?,00000000), ref: 004461E2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 0c50226df9aed064d9fc72c30ff8f5201140dd52271d3dd40973ea300b8a0024
Instruction ID: bbbbf11ac8836aedddebace835184d628c0e8eb9448606daf7135ff7baabef38
Opcode Fuzzy Hash: 0c50226df9aed064d9fc72c30ff8f5201140dd52271d3dd40973ea300b8a0024
Instruction Fuzzy Hash: ACF0683120051566BF212A16AD01B6F375D8F83B75F17411BF91466292DE3CD911916F

Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 00404852
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E

Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CreateEventStartupsocket
String ID:
API String ID: 1953588214-0
Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18

Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D

Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0041BAB8
GetWindowTextW.USER32(00000000,?,00000100), ref: 0041BACB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4

Function 00409DE4 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00409DFD

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
Opcode Fuzzy Hash: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98

Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF

Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,00000000), ref: 004048B3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA

Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00402E2B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
Instruction ID: a1ed0c2070530d0d1545540182683da5b3cb4a6c90a46b83737b9b29f97d9faa
Opcode Fuzzy Hash: 1728ba59e3f5797c2b26d6c1ec3f14ce13f4925b5309dcbb8e7c7e422a6d3f49
Instruction Fuzzy Hash: FFB092364442007ACA026640AC86F5EB762ABA4710F14C92ABA9A281E2D6B74268A647

Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00426CD2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26

Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 00426CBB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725

Non-executed Functions

Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004056E6

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

__Init_thread_footer.LIBCMT ref: 00405723
CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660C0,00000062,004660A4), ref: 004059E4
Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
TerminateProcess.KERNEL32(00000000), ref: 00405A17
CloseHandle.KERNEL32 ref: 00405A23
CloseHandle.KERNEL32 ref: 00405A2B
CloseHandle.KERNEL32 ref: 00405A3D
CloseHandle.KERNEL32 ref: 00405A45

Strings

0lG, xrefs: 00405988
0lG, xrefs: 00405A2D
0lG, xrefs: 00405954
SystemDrive, xrefs: 00405761
cmd.exe, xrefs: 0040574D
0lG, xrefs: 004056D0
0lG, xrefs: 0040585A
kG, xrefs: 004057DB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
API String ID: 2994406822-18413064
Opcode ID: c42f28ba644b97e37895e1f3ee2c7c884f8e483c3f5d678ab53032e062026d85
Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
Opcode Fuzzy Hash: c42f28ba644b97e37895e1f3ee2c7c884f8e483c3f5d678ab53032e062026d85
Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D

Function 00407C97 Relevance: 34.1, APIs: 10, Strings: 9, Instructions: 835filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00407CB9
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
DeleteFileW.KERNEL32(00000000), ref: 00407DA9

Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00408278
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
DeleteFileA.KERNEL32(?), ref: 00408652

Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF

Sleep.KERNEL32(000007D0), ref: 004086F8
StrToIntA.SHLWAPI(00000000,00000000), ref: 0040873A

Part of subcall function 0041C9E2: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7

Strings

open, xrefs: 00408191
Deleted file: , xrefs: 00407DC8
Failed to download file: , xrefs: 004080A5
Unable to delete: , xrefs: 00407E07
Unable to rename file!, xrefs: 00408413
Downloading file: , xrefs: 00407F7D
Executing file: , xrefs: 004081AD
Browsing directory: , xrefs: 00408238
Downloaded file: , xrefs: 0040802E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$open
API String ID: 1067849700-1507758755
Opcode ID: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
Opcode Fuzzy Hash: 1ff92908fb735a07688bd7b3bf3bf23fdc0ca7871faa2f0198a6c16e2433a594
Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B

Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00412106

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412146
CloseHandle.KERNEL32(00000000), ref: 00412155
CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A

Strings

WDH, xrefs: 004121B5, 004121BB, 00412420
rmclient.exe, xrefs: 004122EA
svchost.exe, xrefs: 004122C5
WinDir, xrefs: 0041221B, 00412270
\SysWOW64\, xrefs: 00412261
\system32\, xrefs: 00412209
Remcos restarted by watchdog!, xrefs: 00412160
Watchdog module activated, xrefs: 00412184, 004123DC
fsutil.exe, xrefs: 0041230F
Watchdog launch failed!, xrefs: 00412383

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
Opcode Fuzzy Hash: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E

Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
FindClose.KERNEL32(00000000), ref: 0040BBC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
FindClose.KERNEL32(00000000), ref: 0040BD12

Strings

\key3.db, xrefs: 0040BC76
[Firefox StoredLogins not found], xrefs: 0040BBD4
\logins.json, xrefs: 0040BC34
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BB52
UserProfile, xrefs: 0040BB60
[Firefox StoredLogins Cleared!], xrefs: 0040BCFF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
Opcode Fuzzy Hash: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89

Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004168C2
EmptyClipboard.USER32 ref: 004168D0
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
GlobalLock.KERNEL32(00000000), ref: 004168F9
GlobalUnlock.KERNEL32(00000000), ref: 0041692F
SetClipboardData.USER32(0000000D,00000000), ref: 00416938
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32(0000000D), ref: 0041696C
GlobalLock.KERNEL32(00000000), ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID: !D@
API String ID: 3520204547-604454484
Opcode ID: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
Opcode Fuzzy Hash: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A

Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
FindClose.KERNEL32(00000000), ref: 0040BDC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
FindClose.KERNEL32(00000000), ref: 0040BEAF
FindClose.KERNEL32(00000000), ref: 0040BED0

Strings

\cookies.sqlite, xrefs: 0040BE2C
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BD52
UserProfile, xrefs: 0040BD60
[Firefox Cookies not found], xrefs: 0040BDD4, 0040BE9C
[Firefox cookies found, cleared!], xrefs: 0040BEDF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
Opcode Fuzzy Hash: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E

Function 004132D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
GetFileSize.KERNEL32(?,00000000), ref: 00413432
UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
CloseHandle.KERNEL32(00000000), ref: 0041345F
CloseHandle.KERNEL32(?), ref: 00413465

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: 7389cf943c6bcf248480826047218ee6b0a919d85f38051736b06d81fd75e68c
Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
Opcode Fuzzy Hash: 7389cf943c6bcf248480826047218ee6b0a919d85f38051736b06d81fd75e68c
Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E

Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00475338), ref: 0040F4B9
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F563

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F66E

Strings

C:\Program Files(x86)\Internet Explorer\, xrefs: 0040F6BE
ieinstal.exe, xrefs: 0040F6D5
ielowutil.exe, xrefs: 0040F716
Inj, xrefs: 0040F769

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 3756808967-1743721670
Opcode ID: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
Opcode Fuzzy Hash: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A

Function 00419627 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 206COMMON

Download Yara Rule

Strings

6, xrefs: 00419813
7, xrefs: 0041982A
5, xrefs: 00419809
1, xrefs: 00419695
2, xrefs: 004196F4
0, xrefs: 00419651
3, xrefs: 00419754
4, xrefs: 004197B8

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
Opcode Fuzzy Hash: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96

Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00407521
CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

Strings

[+] CoGetObject SUCCESS, xrefs: 00407595
[-] CoGetObject FAILURE, xrefs: 0040758E
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00407516, 0040751B, 0040755A
[+] ucmAllocateElevatedObject, xrefs: 00407508
$, xrefs: 0040753B
Elevation:Administrator!new:, xrefs: 00407542
[+] CoGetObject, xrefs: 00407561

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA

Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
GetLastError.KERNEL32 ref: 0041A7BB
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: 8be6c0db88263c078c4d0e26e1b320dd21e80ff956e73d25d1154f48fd66f17a
Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
Opcode Fuzzy Hash: 8be6c0db88263c078c4d0e26e1b320dd21e80ff956e73d25d1154f48fd66f17a
Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A

Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
IsValidCodePage.KERNEL32(00000000), ref: 00452777
IsValidLocale.KERNEL32(?,00000001), ref: 00452786
GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED

Strings

lJD, xrefs: 00452745, 004526E7, 004526F2
lJD, xrefs: 00452626, 004527C5
lJD, xrefs: 00452639, 00452649, 00452709, 004526AB, 004526A0, 004526A3, 004526AE, 0045270C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: lJD$lJD$lJD
API String ID: 745075371-479184356
Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69

Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
FindClose.KERNEL32(00000000), ref: 0040C47D
FindClose.KERNEL32(00000000), ref: 0040C4A8

Strings

AppData, xrefs: 0040C358
\Mozilla\Firefox\Profiles\, xrefs: 0040C36E
\cookies.sqlite, xrefs: 0040C409

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
Opcode Fuzzy Hash: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D

Function 0040A2B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
GetLastError.KERNEL32 ref: 0040A2ED

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A33B
TranslateMessage.USER32(?), ref: 0040A34A
DispatchMessageA.USER32(?), ref: 0040A355

Strings

Keylogger initialization failure: error , xrefs: 0040A301
`#v, xrefs: 0040A2D3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error $`#v
API String ID: 3219506041-3226811161
Opcode ID: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
Opcode Fuzzy Hash: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA

Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B

Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371

GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68

Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 0040A416
GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
GetKeyboardLayout.USER32(00000000), ref: 0040A429
GetKeyState.USER32(00000010), ref: 0040A433
GetKeyboardState.USER32(?,?,00000000), ref: 0040A43E
ToUnicodeEx.USER32(00000054,?,?,?,00000010,00000000,00000000), ref: 0040A461
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
ToUnicodeEx.USER32(00000054,?,?,?,00000010,00000000,00000000), ref: 0040A4FA

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6

Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041409D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140A9

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 0041426A
GetProcAddress.KERNEL32(00000000), ref: 00414271

Strings

SHDeleteKeyW, xrefs: 00414260
Shlwapi.dll, xrefs: 00414265

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
Opcode Fuzzy Hash: 31f50e56d7f4f7f2575dbc53f49883a4967628fc93eddf4b35ee6b86778a76ed
Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA

Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00449212
_free.LIBCMT ref: 00449236
_free.LIBCMT ref: 004493BD
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: a0df98c9171fe928957a71b0f613fe22cde1b567892c52a540cd8d6d0b3e47ec
Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
Opcode Fuzzy Hash: a0df98c9171fe928957a71b0f613fe22cde1b567892c52a540cd8d6d0b3e47ec
Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758

Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D

ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 0041686B
GetProcAddress.KERNEL32(00000000), ref: 00416872

Strings

PowrProf.dll, xrefs: 00416866
!D@, xrefs: 00417089
SetSuspendState, xrefs: 00416861

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: !D@$PowrProf.dll$SetSuspendState
API String ID: 1589313981-2876530381
Opcode ID: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
Opcode Fuzzy Hash: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE

Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513

Strings

ACP, xrefs: 0045245A
['E, xrefs: 004524F3, 004524CA
OCP, xrefs: 00452490

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP$['E
API String ID: 2299586839-2532616801
Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398

Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
GetLastError.KERNEL32 ref: 0040BA58

Strings

UserProfile, xrefs: 0040BA1E
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
[Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
[Chrome StoredLogins not found], xrefs: 0040BA72

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
Opcode Fuzzy Hash: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE

Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
OpenProcessToken.ADVAPI32(00000000), ref: 00417966
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
GetLastError.KERNEL32 ref: 0041799D

Strings

SeShutdownPrivilege, xrefs: 00417972

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5

Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409258

Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,?,?), ref: 004048E0

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

__CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
FindClose.KERNEL32(00000000), ref: 004093C1

Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
Part of subcall function 00404E26: CloseHandle.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E4C

FindClose.KERNEL32(00000000), ref: 004095B9

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(00000000,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(00000000,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
String ID:
API String ID: 1824512719-0
Opcode ID: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
Opcode Fuzzy Hash: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98

Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9

Function 00451CD8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
_wcschr.LIBVCRUNTIME ref: 00451E4A
_wcschr.LIBVCRUNTIME ref: 00451E58
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB

Strings

sJD, xrefs: 00451DD1, 00451E19, 00451EC1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: sJD
API String ID: 4212172061-3536923933
Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769

Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B4B9
LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3

Strings

SETTINGS, xrefs: 0041B4AC

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8

Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040966A
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
Opcode Fuzzy Hash: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58

Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408811
FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
__CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
Opcode Fuzzy Hash: 8f16439d90f6ec0f7283b04e08810252f4f5a069acaf261fa4213b3c41c94a9d
Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99

Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0

Strings

open, xrefs: 00406FB6
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 00407007, 0040712F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$open
API String ID: 2825088817-1370690459
Opcode ID: bfa19ed26d2a849e876c6b977b2559079fafbd645fd55724d5dd89cb6e5b05b7
Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
Opcode Fuzzy Hash: bfa19ed26d2a849e876c6b977b2559079fafbd645fd55724d5dd89cb6e5b05b7
Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B

Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7

Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000,004752F0,?,?,0040F853,004674B8,5.1.0 Pro), ref: 004137A6
Part of subcall function 0041376F: RegCloseKey.KERNEL32(?,?,?,0040F853,004674B8,5.1.0 Pro), ref: 004137B1

Strings

Control Panel\Desktop, xrefs: 0041CA1D, 0041CA50, 0041CAA0
WallpaperStyle, xrefs: 0041CA22, 0041CA55, 0041CAA5
TileWallpaper, xrefs: 0041CAC1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF

Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58

Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0043BC1A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC24
UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48

Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
ExitProcess.KERNEL32 ref: 004432EF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98

Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040B711
GetClipboardData.USER32(0000000D), ref: 0040B71D
CloseClipboard.USER32 ref: 0040B725

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD

Function 0041BB09 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00415FFF,00000000), ref: 0041BB14
NtSuspendProcess.NTDLL(00000000), ref: 0041BB21
CloseHandle.KERNEL32(00000000,?,?,00415FFF,00000000), ref: 0041BB2A

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenSuspend
String ID:
API String ID: 1999457699-0
Opcode ID: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
Instruction ID: bc08a5c74f7a636e8823ed9fed2a710289fdff4cb0149baf3e3f1c1580a6a9c0
Opcode Fuzzy Hash: 65307f06ae4da2db5a73601f3478dcd91fa25f5db04ba40a4c100ff3b6d3014e
Instruction Fuzzy Hash: 96D05E36204231E3C32017AA7C0CE97AD68EFC5AA2705412AF804C26649B20CC01C6E8

Function 0041BB35 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00416024,00000000), ref: 0041BB40
NtResumeProcess.NTDLL(00000000), ref: 0041BB4D
CloseHandle.KERNEL32(00000000,?,?,00416024,00000000), ref: 0041BB56

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenResume
String ID:
API String ID: 3614150671-0
Opcode ID: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
Instruction ID: 907c56f48a3137ad3e5a70bb4b43f8813844e3fa30c0a1486a2e097c633c30d6
Opcode Fuzzy Hash: 2a3aa994b22e7efaa36e689b3453aa0ec17d897c0eb19943e791a895e5fd105b
Instruction Fuzzy Hash: B8D05E36104121E3C220176A7C0CD97AE69EBC5AA2705412AF904C32619B20CC01C6F4

Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0044EA0C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54

Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D

Strings

lJD, xrefs: 00451FA0

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: lJD
API String ID: 1084509184-3316369744
Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44

Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082

Strings

lJD, xrefs: 0045203B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID: lJD
API String ID: 1084509184-3316369744
Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604

Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940

Strings

GetLocaleInfoEx, xrefs: 00448908

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
Opcode Fuzzy Hash: 2d8ab5e4c08eb423885d267f31dc3d21c73ce0c4a0b39471804a4927225e8e03
Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E

Function 00419AF5 Relevance: 3.2, APIs: 2, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A843), ref: 0041C49E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID:
API String ID: 341183262-0
Opcode ID: 70a9e3f00708a443c6ca5e26428a05552e6f294bdb71f0817eb9d2ef8bf8d511
Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
Opcode Fuzzy Hash: 70a9e3f00708a443c6ca5e26428a05552e6f294bdb71f0817eb9d2ef8bf8d511
Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A

Function 0040783C Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID:
API String ID: 4113138495-0
Opcode ID: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
Opcode Fuzzy Hash: ef4afc18dc9d34da461ea20a285219582541565e32a666253127ded6bb227160
Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B

Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 004120EE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9f2d401c641a2cfb93471127350fb786a64fc0260f1ce6cfe78b140b0d52c749
Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
Opcode Fuzzy Hash: 9f2d401c641a2cfb93471127350fb786a64fc0260f1ce6cfe78b140b0d52c749
Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58

Function 00434C52 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434C6B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94

Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58

Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698

Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897

EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09

Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754

Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00034B53,0043487A), ref: 00434B4C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction Fuzzy Hash:

Function 00418E76 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
CreateCompatibleDC.GDI32(00000000), ref: 00418E9D

Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355

CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
DeleteDC.GDI32(00000000), ref: 00418F2A
DeleteDC.GDI32(00000000), ref: 00418F2D
DeleteObject.GDI32(00000000), ref: 00418F30
SelectObject.GDI32(00000000,00000000), ref: 00418F51
DeleteDC.GDI32(00000000), ref: 00418F62
DeleteDC.GDI32(00000000), ref: 00418F65
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
GetCursorInfo.USER32(?), ref: 00418FA7
GetIconInfo.USER32(?,?), ref: 00418FBD
DeleteObject.GDI32(?), ref: 00418FEC
DeleteObject.GDI32(?), ref: 00418FF9
DrawIcon.USER32(00000000,?,?,?), ref: 00419006
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
DeleteDC.GDI32(?), ref: 0041917C
DeleteDC.GDI32(00000000), ref: 0041917F
DeleteObject.GDI32(00000000), ref: 00419182
GlobalFree.KERNEL32(?), ref: 0041918D
DeleteObject.GDI32(00000000), ref: 00419241
GlobalFree.KERNEL32(?), ref: 00419248
DeleteDC.GDI32(?), ref: 00419258
DeleteDC.GDI32(00000000), ref: 00419263

Strings

DISPLAY, xrefs: 00418E89

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 4256916514-865373369
Opcode ID: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
Opcode Fuzzy Hash: fd3515ee385558d8e943bffbf3e4feffdcfed35a1f0292415d45ed89f267a670
Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A

Function 004180EF Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
GetProcAddress.KERNEL32(00000000), ref: 00418139
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
GetProcAddress.KERNEL32(00000000), ref: 0041814D
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
GetProcAddress.KERNEL32(00000000), ref: 00418161
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
GetProcAddress.KERNEL32(00000000), ref: 00418175
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
GetThreadContext.KERNEL32(?,00000000), ref: 00418245
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
TerminateProcess.KERNEL32(?,00000000), ref: 00418301
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
SetThreadContext.KERNEL32(?,00000000), ref: 00418428
ResumeThread.KERNEL32(?), ref: 00418435
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
GetCurrentProcess.KERNEL32(?), ref: 00418457
TerminateProcess.KERNEL32(?,00000000), ref: 00418472
GetLastError.KERNEL32 ref: 0041847A

Strings

ZwCreateSection, xrefs: 0041811C
ZwUnmapViewOfSection, xrefs: 0041814F
ZwClose, xrefs: 00418163
ntdll, xrefs: 00418121, 00418140, 00418154, 00418168
`#v, xrefs: 0041830B
ZwMapViewOfSection, xrefs: 0041813B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
API String ID: 4188446516-108836778
Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A

Function 0040D420 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D3F9,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
ExitProcess.KERNEL32 ref: 0040D7D0

Strings

"), xrefs: 0040D5D5
0qF, xrefs: 0040D78C, 0040D797
exepath, xrefs: 0040D4F7
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D5AA
0qF, xrefs: 0040D737, 0040D778, 0040D661, 0040D68E
wend, xrefs: 0040D689
while fso.FileExists(", xrefs: 0040D5EC
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D4C2
Temp, xrefs: 0040D580
fso.DeleteFolder ", xrefs: 0040D6AB
On Error Resume Next, xrefs: 0040D5B9
fso.DeleteFile ", xrefs: 0040D63A
\update.vbs, xrefs: 0040D57B
open, xrefs: 0040D7BE
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D701
""", 0, xrefs: 0040D6E7
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D773
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D471

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$0qF$0qF$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-466687293
Opcode ID: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
Opcode Fuzzy Hash: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E

Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B18E
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
SetEvent.KERNEL32 ref: 0041B219
WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
CloseHandle.KERNEL32 ref: 0041B23A
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266

Strings

alias audio, xrefs: 0041B0B8
status audio mode, xrefs: 0041B1F7
" type , xrefs: 0041B0D5
close audio, xrefs: 0041B261
stopped, xrefs: 0041B202
pause audio, xrefs: 0041B1CA
resume audio, xrefs: 0041B1E2
NG, xrefs: 0041B109, 0041B08B
stop audio, xrefs: 0041B257
play audio, xrefs: 0041B14B
open ", xrefs: 0041B0D0

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
API String ID: 738084811-2094122233
Opcode ID: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
Opcode Fuzzy Hash: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E

Function 0040D096 Relevance: 38.8, APIs: 6, Strings: 16, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
ExitProcess.KERNEL32 ref: 0040D419

Strings

"), xrefs: 0040D2B1
exepath, xrefs: 0040D181
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D285
wend, xrefs: 0040D364
while fso.FileExists(", xrefs: 0040D2C8
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D138
Temp, xrefs: 0040D246
fso.DeleteFolder ", xrefs: 0040D38A
.vbs, xrefs: 0040D201
On Error Resume Next, xrefs: 0040D294
fso.DeleteFile ", xrefs: 0040D315
open, xrefs: 0040D40C
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D3C1
hpF, xrefs: 0040D38F
pth_unenc, xrefs: 0040D09C
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D0E7

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-1898615514
Opcode ID: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
Opcode Fuzzy Hash: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E

Function 00412475 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
ExitProcess.KERNEL32(00000000), ref: 004124A0
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
CloseHandle.KERNEL32(00000000), ref: 0041253B
GetCurrentProcessId.KERNEL32 ref: 00412541
PathFileExistsW.SHLWAPI(?), ref: 00412572
GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
lstrcatW.KERNEL32(?,.exe), ref: 00412601

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D3F9,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
Sleep.KERNEL32(000001F4), ref: 00412682
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
CloseHandle.KERNEL32(00000000), ref: 004126A9
GetCurrentProcessId.KERNEL32 ref: 004126AF

Strings

WDH, xrefs: 00412548, 004126B6
open, xrefs: 0041263B
exepath, xrefs: 004124CC
temp_, xrefs: 004125E3
.exe, xrefs: 004125F5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$WDH$exepath$open$temp_
API String ID: 2649220323-3088914985
Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D

Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7

Strings

RIFF, xrefs: 00401AFD
fmt , xrefs: 00401B2D
data, xrefs: 00401BB1
WAVE, xrefs: 00401B1D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3

Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000001,0040764D,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
GetProcAddress.KERNEL32(00000000), ref: 0040728D
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
GetProcAddress.KERNEL32(00000000), ref: 004072A5
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
GetProcAddress.KERNEL32(00000000), ref: 004072B9
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
GetProcAddress.KERNEL32(00000000), ref: 004072CD
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
GetProcAddress.KERNEL32(00000000), ref: 004072E1
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
GetProcAddress.KERNEL32(00000000), ref: 004072F5

Strings

RtlAcquirePebLock, xrefs: 004072C4
RtlInitUnicodeString, xrefs: 0040727E
LdrEnumerateLoadedModules, xrefs: 004072EC
ntdll.dll, xrefs: 00407278, 00407283, 004072A1, 004072B5, 004072C9, 004072DD, 004072F1
NtFreeVirtualMemory, xrefs: 004072B0
NtAllocateVirtualMemory, xrefs: 0040729C
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 00407271
RtlReleasePebLock, xrefs: 004072D8

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-1427340672
Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D

Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040CE07
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
CopyFileW.KERNEL32(C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CED0
_wcslen.LIBCMT ref: 0040CEE6
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
CopyFileW.KERNEL32(C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000000,00000000), ref: 0040CF84
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
_wcslen.LIBCMT ref: 0040CFC6
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D02D
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
ExitProcess.KERNEL32 ref: 0040D062

Strings

6, xrefs: 0040CEDA
del, xrefs: 0040CFF5
open, xrefs: 0040D044
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 0040CE91, 0040CE96, 0040CEC9, 0040CF7E, 0040CF83, 0040CF8A, 0040CFEB

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$del$open
API String ID: 1579085052-3762195709
Opcode ID: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
Opcode Fuzzy Hash: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E

Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0041C036
_memcmp.LIBVCRUNTIME ref: 0041C04E
lstrlenW.KERNEL32(?), ref: 0041C067
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C0A2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
lstrcmpW.KERNEL32(?,?), ref: 0041C114
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
_wcslen.LIBCMT ref: 0041C13B
FindVolumeClose.KERNEL32(?), ref: 0041C15B
GetLastError.KERNEL32 ref: 0041C173
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
lstrcatW.KERNEL32(?,?), ref: 0041C1B9
lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
GetLastError.KERNEL32 ref: 0041C1D0

Strings

?, xrefs: 0041C0CD

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA

Function 0044F42D Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F4BF
_free.LIBCMT ref: 0044F4E5
_free.LIBCMT ref: 0044F50E
_free.LIBCMT ref: 0044F546
_free.LIBCMT ref: 0044F577
_free.LIBCMT ref: 0044F5B8
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0044F639
_free.LIBCMT ref: 0044F652
_wcschr.LIBVCRUNTIME ref: 0044F68F
_free.LIBCMT ref: 0044F6FB
_free.LIBCMT ref: 0044F721
_free.LIBCMT ref: 0044F74A
_free.LIBCMT ref: 0044F77F
_free.LIBCMT ref: 0044F7B0
_free.LIBCMT ref: 0044F7F1
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F876
_free.LIBCMT ref: 0044F88F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799

Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
LoadLibraryA.KERNEL32(?), ref: 00414E17
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
FreeLibrary.KERNEL32(00000000), ref: 00414E3E
LoadLibraryA.KERNEL32(?), ref: 00414E76
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
FreeLibrary.KERNEL32(00000000), ref: 00414E8F
GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
FreeLibrary.KERNEL32(00000000), ref: 00414EB5

Strings

\wship6, xrefs: 00414E5E
freeaddrinfo, xrefs: 00414DB2
\ws2_32, xrefs: 00414DFF
getnameinfo, xrefs: 00414DA2
getaddrinfo, xrefs: 00414D93, 00414E31, 00414E82

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-744132762
Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE

Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041C6F5
RegCloseKey.ADVAPI32(?), ref: 0041C9BF

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041C6A7
DisplayVersion, xrefs: 0041C768
InstallDate, xrefs: 0041C790
DisplayName, xrefs: 0041C73C
Publisher, xrefs: 0041C751
InstallLocation, xrefs: 0041C77C
UninstallString, xrefs: 0041C7A4

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A

Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
GetCursorPos.USER32(?), ref: 0041D5E9
SetForegroundWindow.USER32(?), ref: 0041D5F2
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
ExitProcess.KERNEL32 ref: 0041D665
CreatePopupMenu.USER32 ref: 0041D66B
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680

Strings

Close, xrefs: 0041D671

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D

Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00445DC6
_free.LIBCMT ref: 00445DDC
_free.LIBCMT ref: 00445DED
_free.LIBCMT ref: 00445DFE
_free.LIBCMT ref: 00445E15
GetCPInfo.KERNEL32(?,?), ref: 00445E5D

Part of subcall function 00452E74: _free.LIBCMT ref: 00452EDF

_free.LIBCMT ref: 00446009
_free.LIBCMT ref: 0044601C
_free.LIBCMT ref: 0044602A
_free.LIBCMT ref: 00446035
_free.LIBCMT ref: 00446077
_free.LIBCMT ref: 0044607F
_free.LIBCMT ref: 00446087
_free.LIBCMT ref: 0044608F
_free.LIBCMT ref: 0044609D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 9a1e8def710a50f9e802e5816f878b52a4fdf116ee4a506070fe770fe0ef34d2
Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
Opcode Fuzzy Hash: 9a1e8def710a50f9e802e5816f878b52a4fdf116ee4a506070fe770fe0ef34d2
Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65

Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045130A

Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
Part of subcall function 00450502: _free.LIBCMT ref: 00450531
Part of subcall function 00450502: _free.LIBCMT ref: 00450543
Part of subcall function 00450502: _free.LIBCMT ref: 00450555
Part of subcall function 00450502: _free.LIBCMT ref: 00450567
Part of subcall function 00450502: _free.LIBCMT ref: 00450579
Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
Part of subcall function 00450502: _free.LIBCMT ref: 004505F7

_free.LIBCMT ref: 004512FF

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00451321
_free.LIBCMT ref: 00451336
_free.LIBCMT ref: 00451341
_free.LIBCMT ref: 00451363
_free.LIBCMT ref: 00451376
_free.LIBCMT ref: 00451384
_free.LIBCMT ref: 0045138F
_free.LIBCMT ref: 004513C7
_free.LIBCMT ref: 004513CE
_free.LIBCMT ref: 004513EB
_free.LIBCMT ref: 00451403

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59

Function 00408B7A Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408CE3
GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
__aulldiv.LIBCMT ref: 00408D4D

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
CloseHandle.KERNEL32(00000000), ref: 00408F64
CloseHandle.KERNEL32(00000000,00000052), ref: 00408FAE
CloseHandle.KERNEL32(00000000), ref: 00408FFC

Strings

Uploading file to Controller: , xrefs: 00408DD5
ReadFile error, xrefs: 00408FC8
SetFilePointerEx error, xrefs: 00408FD4

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller:
API String ID: 3086580692-2596673759
Opcode ID: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
Opcode Fuzzy Hash: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B

Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450648
_free.LIBCMT ref: 0045066C
_free.LIBCMT ref: 00450679
_free.LIBCMT ref: 0045069E
_free.LIBCMT ref: 004506AB
_free.LIBCMT ref: 004506B4
_free.LIBCMT ref: 00450992
_free.LIBCMT ref: 0045099A

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798

Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
CloseHandle.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E4C
closesocket.WS2_32(000000FF), ref: 00404E5A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EC4
SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
CloseHandle.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED6

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID:
API String ID: 3658366068-0
Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58

Function 00412AB4 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 482sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587

Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
Sleep.KERNEL32(00000064), ref: 00412E94

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Strings

/stext ", xrefs: 00412BAA, 00412C4C, 00412CEE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "
API String ID: 1223786279-3856184850
Opcode ID: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
Opcode Fuzzy Hash: bc7e362d57d7670180143ae5cce880ef26dc034d902ff58de5e25bf17600ed29
Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A

Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000,?,00455C84,00000000,0000000C), ref: 004558C6

GetLastError.KERNEL32 ref: 00455CEF
__dosmaperr.LIBCMT ref: 00455CF6
GetFileType.KERNEL32(00000000), ref: 00455D02
GetLastError.KERNEL32 ref: 00455D0C
__dosmaperr.LIBCMT ref: 00455D15
CloseHandle.KERNEL32(00000000), ref: 00455D35
CloseHandle.KERNEL32(?), ref: 00455E7F
GetLastError.KERNEL32 ref: 00455EB1
__dosmaperr.LIBCMT ref: 00455EB8

Strings

H, xrefs: 00455E3D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59

Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
__alloca_probe_16.LIBCMT ref: 00453EEA
MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
__alloca_probe_16.LIBCMT ref: 00453F94
MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
__freea.LIBCMT ref: 00454003
__freea.LIBCMT ref: 0045400F

Strings

\@E, xrefs: 00453F37, 00453DF1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID: \@E
API String ID: 201697637-1814623452
Opcode ID: fb6195c260b9ae5d4324619eca1f95c452dc13a98459a94436f4153b7f964d62
Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
Opcode Fuzzy Hash: fb6195c260b9ae5d4324619eca1f95c452dc13a98459a94436f4153b7f964d62
Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768

Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450A94
_free.LIBCMT ref: 00450AA2
_free.LIBCMT ref: 00450BD0
_free.LIBCMT ref: 00450BDB

Strings

\&G, xrefs: 00450C24
\&G, xrefs: 00450C1C
`&G, xrefs: 00450C34

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free
String ID: \&G$\&G$`&G
API String ID: 269201875-253610517
Opcode ID: 3d3472b72281963140e8887de038e5b99b85b4a8b881428f5fb0b5852324da1c
Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
Opcode Fuzzy Hash: 3d3472b72281963140e8887de038e5b99b85b4a8b881428f5fb0b5852324da1c
Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98

Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

65535, xrefs: 00414BB3
udp, xrefs: 00414C60, 00414C68, 00414C6C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E

Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0040AD38
Sleep.KERNEL32(000001F4), ref: 0040AD43
GetForegroundWindow.USER32 ref: 0040AD49
GetWindowTextLengthW.USER32(00000000), ref: 0040AD52
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040AD86
Sleep.KERNEL32(000003E8), ref: 0040AE54

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

minutes }, xrefs: 0040AE7A
{ User has been idle for , xrefs: 0040AE86
], xrefs: 0040ADE8
[, xrefs: 0040ADEE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
Opcode Fuzzy Hash: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F

Function 0040D7FF Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873

Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,004752F0), ref: 00413714
Part of subcall function 004136F8: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041372D
Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
ExitProcess.KERNEL32 ref: 0040D9C4

Strings

CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0040D967
open, xrefs: 0040D9B2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D8F9
exepath, xrefs: 0040D831
""", 0, xrefs: 0040D8E1
Temp, xrefs: 0040D89A
.vbs, xrefs: 0040D85F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-2411266221
Opcode ID: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
Opcode Fuzzy Hash: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98

Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
__dosmaperr.LIBCMT ref: 0043A8A6
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
__dosmaperr.LIBCMT ref: 0043A8E3
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
__dosmaperr.LIBCMT ref: 0043A937
_free.LIBCMT ref: 0043A943
_free.LIBCMT ref: 0043A94A

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: dbaba6b5bf7e8e3101b206719032b6e5feaa877e1e5831e4faa096a05e69cc69
Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
Opcode Fuzzy Hash: dbaba6b5bf7e8e3101b206719032b6e5feaa877e1e5831e4faa096a05e69cc69
Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A

Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 004054BF
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
TranslateMessage.USER32(?), ref: 0040557E
DispatchMessageA.USER32(?), ref: 00405589
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Strings

CloseChat, xrefs: 00405609
DisplayMessage, xrefs: 004055EC
GetMessage, xrefs: 004055F8

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
Opcode Fuzzy Hash: 1596478972ce96747ca32779f183717890ad831c566256f19ff3d4655c30f502
Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A

Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00416941
EmptyClipboard.USER32 ref: 0041694F
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32(0000000D), ref: 0041696C
GlobalLock.KERNEL32(00000000), ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID: !D@
API String ID: 2172192267-604454484
Opcode ID: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
Opcode Fuzzy Hash: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69

Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA

Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00448135

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00448141
_free.LIBCMT ref: 0044814C
_free.LIBCMT ref: 00448157
_free.LIBCMT ref: 00448162
_free.LIBCMT ref: 0044816D
_free.LIBCMT ref: 00448178
_free.LIBCMT ref: 00448183
_free.LIBCMT ref: 0044818E
_free.LIBCMT ref: 0044819C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5

Function 00419FB4 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419FB9
GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
Sleep.KERNEL32(000003E8), ref: 0041A0FD
GetLocalTime.KERNEL32(?), ref: 0041A105
Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4

Strings

wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09A, 0041A0BB, 0041A129
time_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
API String ID: 489098229-3790400642
Opcode ID: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
Opcode Fuzzy Hash: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799

Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27

Strings

log, xrefs: 00455FCD, 00455FD9
log10, xrefs: 00455F71, 00455FC1
asin, xrefs: 00456093
sqrt, xrefs: 004560AB
pow, xrefs: 0045600B, 004560B7, 004560CA
acos, xrefs: 0045609F
exp, xrefs: 00455FEC, 0045604E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E

Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A843), ref: 0041C49E

Sleep.KERNEL32(00000064), ref: 00417521
DeleteFileW.KERNEL32(00000000), ref: 00417555

Strings

/t , xrefs: 004174D4
open, xrefs: 004174EF
dxdiag, xrefs: 004174EA
\sysinfo.txt, xrefs: 004174A0
temp, xrefs: 004174A5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
Opcode Fuzzy Hash: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C

Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe), ref: 0040749E

Strings

[+] NtAllocateVirtualMemory Success, xrefs: 00407410
\explorer.exe, xrefs: 00407400
windir, xrefs: 004073EA
[-] NtAllocateVirtualMemory Error, xrefs: 0040743D
PEB: %x, xrefs: 004074AF
explorer.exe, xrefs: 00407450, 0040747B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
Opcode Fuzzy Hash: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F

Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
int.LIBCPMT ref: 00410E81

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 00410EC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
__CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID: ,kG$0kG
API String ID: 3815856325-2015055088
Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D

Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476

Part of subcall function 0041D50F: RegisterClassExA.USER32(00000030), ref: 0041D55B
Part of subcall function 0041D50F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580

ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
TranslateMessage.USER32(?), ref: 0041D4E9
DispatchMessageA.USER32(?), ref: 0041D4F3
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D500

Strings

Remcos, xrefs: 0041D4B8

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98

Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d049b86027effad8d92042d9403d5bfe2ea3e93186a839875c543696ca89538
Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
Opcode Fuzzy Hash: 7d049b86027effad8d92042d9403d5bfe2ea3e93186a839875c543696ca89538
Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69

Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

_memcmp.LIBVCRUNTIME ref: 00445423
_free.LIBCMT ref: 00445494
_free.LIBCMT ref: 004454AD
_free.LIBCMT ref: 004454DF
_free.LIBCMT ref: 004454E8
_free.LIBCMT ref: 004454F4

Strings

C, xrefs: 004452E1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 0768c3d9e3dd940518f99a63cbcd3aeb961d046fc1a72f364ae26972a0ea9dca
Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
Opcode Fuzzy Hash: 0768c3d9e3dd940518f99a63cbcd3aeb961d046fc1a72f364ae26972a0ea9dca
Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44

Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

tcp, xrefs: 00414A73
udp, xrefs: 00414A46

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A

Function 004114F5 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00411514
inet_ntoa.WS2_32(?), ref: 004115AF

Strings

StopReverse, xrefs: 004116A1
StartForward, xrefs: 00411673
GetDirectListeningPort, xrefs: 004116B2
StartReverse, xrefs: 0041167F
StopForward, xrefs: 00411690

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse
API String ID: 3578746661-168337528
Opcode ID: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
Opcode Fuzzy Hash: 05c42a8275862105916410cb05f28230ec4bbfa298c3e0115c38b27023db1ff4
Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE

Function 00417CDF Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
CloseHandle.KERNEL32(00000000), ref: 00417DE5
DeleteFileA.KERNEL32(00000000), ref: 00417DF4
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

Strings

<, xrefs: 00417D83
@, xrefs: 00417D8A
Temp, xrefs: 00417D00

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
String ID: <$@$Temp
API String ID: 1704390241-1032778388
Opcode ID: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
Opcode Fuzzy Hash: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99

Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FA4,?,00000000,00407FFC,00000000), ref: 004079C5
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A0D

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

CloseHandle.KERNEL32(00000000,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A4D
MoveFileW.KERNEL32(00000000,00000000), ref: 00407A6A
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407A95
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5

Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00474EF8,00404C49,00000000,00000000,00000000,?,00474EF8,?), ref: 00404BA5
Part of subcall function 00404B96: SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3

Strings

.part, xrefs: 00407989

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A

Function 0041CD9B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(00475338), ref: 0041CDA4
GetConsoleWindow.KERNEL32 ref: 0041CDAA
ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

5.1.0 Pro, xrefs: 0041CE0B
CONOUT$, xrefs: 0041CDD0
Remcos v, xrefs: 0041CDFD

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Console$Window$AllocOutputShow
String ID: Remcos v$5.1.0 Pro$CONOUT$
API String ID: 4067487056-1043272453
Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E

Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
__alloca_probe_16.LIBCMT ref: 0044ACDB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
__alloca_probe_16.LIBCMT ref: 0044ADC0
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
__freea.LIBCMT ref: 0044AE30

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

__freea.LIBCMT ref: 0044AE39
__freea.LIBCMT ref: 0044AE5E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 118846f8b98fa7142c6fc34e08ba9c255994cc722e781db25b6080b075eb9fff
Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
Opcode Fuzzy Hash: 118846f8b98fa7142c6fc34e08ba9c255994cc722e781db25b6080b075eb9fff
Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A

Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199CC
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 004199ED
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A0D
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A21
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A37
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A54
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A6F
SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 00419A8B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97

Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00447679
__freea.LIBCMT ref: 00447723
__freea.LIBCMT ref: 00447741

Part of subcall function 00435E40: _free.LIBCMT ref: 00435E56

Strings

zD, xrefs: 004479AB
am/pm, xrefs: 004477A4
a/p, xrefs: 00447808

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm$zD
API String ID: 2936374016-2723203690
Opcode ID: 582b27bd1da2528f23ecf4cf811f425633019422103e053086a59298c2d48650
Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
Opcode Fuzzy Hash: 582b27bd1da2528f23ecf4cf811f425633019422103e053086a59298c2d48650
Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9

Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,0044BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B3FE
__fassign.LIBCMT ref: 0044B479
__fassign.LIBCMT ref: 0044B494
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000,?,?,?,?,?,?,?,?,?,0044BB31,?), ref: 0044B4D9
WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000,?,?,?,?,?,?,?,?,?,0044BB31,?), ref: 0044B512

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9

Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00456D49

Strings

D[E, xrefs: 00456D10
D[E, xrefs: 00456C6D, 00456D5E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free
String ID: D[E$D[E
API String ID: 269201875-3695742444
Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D

Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 0041363D
Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

_wcslen.LIBCMT ref: 0041B763

Strings

program files\, xrefs: 0041B749, 0041B750, 0041B762
http\shell\open\command, xrefs: 0041B69A
8SG, xrefs: 0041B709, 0041B70E
program files (x86)\, xrefs: 0041B75D
.exe, xrefs: 0041B6B5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
API String ID: 3286818993-122982132
Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269

Function 00401D0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00401D50

Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9

waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F

Strings

.wav, xrefs: 00401D69
%Y-%m-%d %H.%M, xrefs: 00401D41

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav
API String ID: 3809562944-3597965672
Opcode ID: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
Opcode Fuzzy Hash: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E

Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
PathFileExistsA.SHLWAPI(?), ref: 0040BF78

Strings

[IE cookies not found], xrefs: 0040BF40
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0040BF02
Cookies, xrefs: 0040BEFD
[IE cookies cleared!], xrefs: 0040BFC5, 0040BFEA

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
Opcode Fuzzy Hash: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE

Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15328f38de36e2236e67be376e02f2a3afc52644fcc3b23babb247561bddb00
Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
Opcode Fuzzy Hash: b15328f38de36e2236e67be376e02f2a3afc52644fcc3b23babb247561bddb00
Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8

Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D3F9,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C430
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
CloseHandle.KERNEL32(00000000), ref: 0041C459
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
CloseHandle.KERNEL32(00000000), ref: 0041C477

Strings

hpF, xrefs: 0041C3F2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID: hpF
API String ID: 1852769593-151379673
Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A

Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A

_free.LIBCMT ref: 00450F48

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00450F53
_free.LIBCMT ref: 00450F5E
_free.LIBCMT ref: 00450FB2
_free.LIBCMT ref: 00450FBD
_free.LIBCMT ref: 00450FC8
_free.LIBCMT ref: 00450FD3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745

Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00411170
int.LIBCPMT ref: 00411183

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 004111C3
std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
__CxxThrowException@8.LIBVCRUNTIME ref: 004111EA

Strings

(mG, xrefs: 0041117B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: (mG
API String ID: 2536120697-4059303827
Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9

Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D

Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe), ref: 004075D0

Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

CoUninitialize.OLE32 ref: 00407629

Strings

[+] before ShellExec, xrefs: 004075F1
[+] ShellExec success, xrefs: 0040760E
[+] ucmCMLuaUtilShellExecMethod, xrefs: 004075B5
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 004075B0, 004075B3, 00407605

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-1975979679
Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB

Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
GetLastError.KERNEL32 ref: 0040BAE7

Strings

[Chrome Cookies found, cleared!], xrefs: 0040BB0D
UserProfile, xrefs: 0040BAAD
[Chrome Cookies not found], xrefs: 0040BB01
\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
Opcode Fuzzy Hash: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE

Function 0041ADC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
Sleep.KERNEL32(00002710), ref: 0041AE07
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10

Strings

Alarm triggered, xrefs: 0041ADC9
`#v, xrefs: 0041ADF2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered$`#v
API String ID: 614609389-3049340936
Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB

Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0043AC69
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
__allrem.LIBCMT ref: 0043AC9C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
__allrem.LIBCMT ref: 0043ACD1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A

Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,0040D262), ref: 004044C4

Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C

Strings

FreeFrame, xrefs: 004045B0
GetFrame, xrefs: 0040459F
OpenCamera, xrefs: 00404582
CloseCamera, xrefs: 0040458E
HNG, xrefs: 004045E6

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
API String ID: 3469354165-3054508432
Opcode ID: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
Opcode Fuzzy Hash: 6f157006139ccf4b8d86a432b5633ede6fd06edeca8eb9c0ae1caa95c8564102
Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E

Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2

SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
GetNativeSystemInfo.KERNEL32(?,0040D2A2,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411DA5
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9

Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3

GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A

Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
Part of subcall function 00412077: HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 004120EE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID:
API String ID: 3950776272-0
Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9

Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00445925
__cftoe.LIBCMT ref: 00445957

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 9a4a9018df91bb80547d8cd227be064c11647db9cc7a9b7c485a3b8778a52ece
Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
Opcode Fuzzy Hash: 9a4a9018df91bb80547d8cd227be064c11647db9cc7a9b7c485a3b8778a52ece
Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C

Function 0040A726 Relevance: 9.2, APIs: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040A740

Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A81E

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A843), ref: 0041C49E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID:
API String ID: 3795512280-0
Opcode ID: 6f73b5aa983a983c729dc0a6f3b495559223a18d1a5043611dd20871b8f51584
Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
Opcode Fuzzy Hash: 6f73b5aa983a983c729dc0a6f3b495559223a18d1a5043611dd20871b8f51584
Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E

Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE

Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
_free.LIBCMT ref: 0044824C
_free.LIBCMT ref: 00448274
SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
_abort.LIBCMT ref: 00448293

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD

Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9

Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9

Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9

Function 0040186A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142threadCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004018BE
ExitThread.KERNEL32 ref: 004018F6
waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

Strings

PkG, xrefs: 00401888
NG, xrefs: 00401990

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
String ID: PkG$NG
API String ID: 1649129571-2686071003
Opcode ID: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
Opcode Fuzzy Hash: f17f11b8b39cffc117ffaa71cd5d18446726339bb65f1098d7a399b3bb622f5a
Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E

Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

Offline Keylogger Started, xrefs: 0040B16B
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0040B17B
], xrefs: 0040B180

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: 5930b91d6002e4bc173ab4be93e7cb7fd053249898d40d7797ac70fa62357d50
Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
Opcode Fuzzy Hash: 5930b91d6002e4bc173ab4be93e7cb7fd053249898d40d7797ac70fa62357d50
Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC

Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 0041D55B
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
GetLastError.KERNEL32 ref: 0041D580

Strings

MsgWindowClass, xrefs: 0041D526
0, xrefs: 0041D52B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4

Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
CloseHandle.KERNEL32(?), ref: 004077AA
CloseHandle.KERNEL32(?), ref: 004077AF

Strings

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
C:\Windows\System32\cmd.exe, xrefs: 00407796

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9

Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

Rmc-TS121V, xrefs: 004076DA
C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 004076C4

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe$Rmc-TS121V
API String ID: 0-857040892
Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E

Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044336D
FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390

Strings

CorExitProcess, xrefs: 00443365
mscoree.dll, xrefs: 00443353

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98

Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405140

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

KeepAlive | Disabled, xrefs: 004050F9

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A

Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD6F
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CDED), ref: 0041CD7C
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD8F

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5

Function 0040140A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
GetProcAddress.KERNEL32(00000000), ref: 0040141B

Strings

User32.dll, xrefs: 0040140F
GetCursorInfo, xrefs: 0040140A
`#v, xrefs: 00401414

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetCursorInfo$User32.dll$`#v
API String ID: 1646373207-1032071883
Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E

Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9

Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

_free.LIBCMT ref: 00444E06
_free.LIBCMT ref: 00444E1D
_free.LIBCMT ref: 00444E3C
_free.LIBCMT ref: 00444E57
_free.LIBCMT ref: 00444E6E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: d775a197f71d536e5d52874a7a30662ad33d8ad4d8240f212ad1ffb4432d1cba
Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
Opcode Fuzzy Hash: d775a197f71d536e5d52874a7a30662ad33d8ad4d8240f212ad1ffb4432d1cba
Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88

Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 004493BD

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58

Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
CloseHandle.KERNEL32(00000000), ref: 0040FB05

Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
Part of subcall function 0041BFE5: IsWow64Process.KERNEL32(00000000,?,?,?,00475338), ref: 0041C005

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 2180151492-0
Opcode ID: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
Opcode Fuzzy Hash: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A

Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443E6B
_free.LIBCMT ref: 00443E8B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84

Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
__alloca_probe_16.LIBCMT ref: 004511B1
MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
__freea.LIBCMT ref: 0045121D

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 176232f54f3ec98bfb029651777c0c6490447229ae5715771154ed3ce12be0f5
Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
Opcode Fuzzy Hash: 176232f54f3ec98bfb029651777c0c6490447229ae5715771154ed3ce12be0f5
Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94

Function 00401BE9 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
waveInStart.WINMM ref: 00401CFE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID:
API String ID: 1356121797-0
Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C

Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044F363
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
_free.LIBCMT ref: 0044F3BF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 5a321bf6ad982bb41f22afd847bffa7b7f2aa598f804dd442cdb837d811de21f
Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
Opcode Fuzzy Hash: 5a321bf6ad982bb41f22afd847bffa7b7f2aa598f804dd442cdb837d811de21f
Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9

Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
_free.LIBCMT ref: 004482D3
_free.LIBCMT ref: 004482FA
SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D

Function 0041C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041C228
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C233
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C23B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$FileImageName
String ID:
API String ID: 2951400881-0
Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679

Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004509D4

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 004509E6
_free.LIBCMT ref: 004509F8
_free.LIBCMT ref: 00450A0A
_free.LIBCMT ref: 00450A1C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C

Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00444066

Part of subcall function 00446782: RtlFreeHeap.NTDLL(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00444078
_free.LIBCMT ref: 0044408B
_free.LIBCMT ref: 0044409C
_free.LIBCMT ref: 004440AD

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF

Function 00413A55 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413B8B

Strings

[regsplt], xrefs: 00413C17

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]
API String ID: 3554306468-4262303796
Opcode ID: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
Opcode Fuzzy Hash: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9

Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0044E738
_free.LIBCMT ref: 0044E855

Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017,0043BCEB,00405103,?,00000000,00000000,004020A6,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000), ref: 0043BD1B
Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44

Strings

., xrefs: 0044EA0C
*?, xrefs: 0044E72C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54

Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3

Strings

`#D, xrefs: 00442400
`#D, xrefs: 004424ED

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: `#D$`#D
API String ID: 885266447-2450397995
Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44

Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe,00000104), ref: 00443475
_free.LIBCMT ref: 00443540
_free.LIBCMT ref: 0044354A

Strings

C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe, xrefs: 0044346C, 00443473, 004434A2, 004434DA

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\UsoOuMVYCv8QrxG.exe
API String ID: 2506810119-1240109467
Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98

Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6

PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C688

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C635
User Data\Default\Network\Cookies, xrefs: 0040C603

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698

Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559

PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C757

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C704
User Data\Default\Network\Cookies, xrefs: 0040C6D2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698

Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040A20E
CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040A21A

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Strings

Offline Keylogger Started, xrefs: 0040A19B, 0040A1A2, 0040A1CF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
Opcode Fuzzy Hash: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB

Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86

Strings

Online Keylogger Started, xrefs: 0040AF03, 0040AF0C, 0040AF36

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
Opcode Fuzzy Hash: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB

Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406A82
GetProcAddress.KERNEL32(00000000), ref: 00406A89

Strings

crypt32, xrefs: 00406A7D
CryptUnprotectData, xrefs: 00406A78

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4

Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
CloseHandle.KERNEL32(?), ref: 004051CA
SetEvent.KERNEL32(?), ref: 004051D9

Strings

Connection Timeout, xrefs: 00405198

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59

Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E833

Strings

ios_base::failbit set, xrefs: 0040E815
ios_base::badbit set, xrefs: 0040E7EF
ios_base::eofbit set, xrefs: 0040E822

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B

Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
RegSetValueExW.ADVAPI32(004752D8,?,00000000,00000001,00000000,00000000,004752F0,?,0040F823,pth_unenc,004752D8), ref: 0041384D
RegCloseKey.ADVAPI32(004752D8,?,0040F823,pth_unenc,004752D8), ref: 00413858

Strings

pth_unenc, xrefs: 00413818

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94

Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0

Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E016

Strings

bad locale name, xrefs: 0040E000

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C

Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
ShowWindow.USER32(00000009), ref: 00416C61
SetForegroundWindow.USER32 ref: 00416C6D

Part of subcall function 0041CD9B: AllocConsole.KERNEL32(00475338), ref: 0041CDA4
Part of subcall function 0041CD9B: GetConsoleWindow.KERNEL32 ref: 0041CDAA
Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Window$Console$Show$AllocCreateForegroundOutputThread
String ID: !D@
API String ID: 186401046-604454484
Opcode ID: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
Opcode Fuzzy Hash: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D

Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130

Strings

open, xrefs: 0041612A
cmd.exe, xrefs: 00416125
/C , xrefs: 0041610E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659

Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5

Strings

pth_unenc, xrefs: 0040B8AC

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: TerminateThread$HookUnhookWindows
String ID: pth_unenc
API String ID: 3123878439-4028850238
Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D

Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
GetProcAddress.KERNEL32(00000000), ref: 004014C0

Strings

User32.dll, xrefs: 004014B4
GetLastInputInfo, xrefs: 004014AF

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetLastInputInfo$User32.dll
API String ID: 2574300362-1519888992
Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F

Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044A08F
__alldvrm.LIBCMT ref: 0044A290
__alldvrm.LIBCMT ref: 0044A2B2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A

Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788

Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040C021
Sleep.KERNEL32(00001388), ref: 0040C0A9

Strings

[Cleared browsers logins and cookies.], xrefs: 0040C0E4
Cleared browsers logins and cookies., xrefs: 0040C0F5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF

Function 004194C4 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(00000000,00000000,004195CF,00000000), ref: 004194F5
EnumDisplayDevicesW.USER32(?), ref: 00419525
EnumDisplayDevicesW.USER32(?,?,?,00000000), ref: 0041959A
EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 004195B7

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DisplayEnum$Devices$Monitors
String ID:
API String ID: 1432082543-0
Opcode ID: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
Instruction ID: 9f89b1fc864c89aa53311e19646eec67f909338e1adf78e73a6452d568b12732
Opcode Fuzzy Hash: 87e58e3218148989140d0ffac94925d1ebdf8dad9c36676593952cebb4287d16
Instruction Fuzzy Hash: 6F218072108314ABD221DF26DC49EABBBECEBD1764F00053FF459D3190EB749A49C66A

Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C551: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C561
Part of subcall function 0041C551: GetWindowTextLengthW.USER32(00000000), ref: 0041C56A
Part of subcall function 0041C551: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C594

Sleep.KERNEL32(000001F4), ref: 0040A573
Sleep.KERNEL32(00000064), ref: 0040A5FD

Strings

], xrefs: 0040A57B
[ , xrefs: 0040A58F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
Opcode Fuzzy Hash: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB

Function 0041B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 0041B815
Sleep.KERNEL32(000003E8), ref: 0041B820
GetSystemTimes.KERNEL32(?,?,?), ref: 0041B835
__aulldiv.LIBCMT ref: 0041B89C

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: SystemTimes$Sleep__aulldiv
String ID:
API String ID: 188215759-0
Opcode ID: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
Instruction ID: 72b4c32e7059473e424b83a6cc96647c38f9827b21069785d395d2d8421d6a64
Opcode Fuzzy Hash: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
Instruction Fuzzy Hash: B0113D7A5083456BD304FAB5CC85DEB7BACEAC4654F040A3EF54A82051FE68EA4886A5

Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568

Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169

Function 0040A675 Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID:
API String ID: 1958988193-0
Opcode ID: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
Opcode Fuzzy Hash: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E

Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8

Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A843), ref: 0041C49E
GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041C4D7
CloseHandle.KERNEL32(00000000), ref: 0041C4E5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A

Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0043987A

Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC

_UnwindNestedFrames.LIBCMT ref: 00439891
___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
CallCatchBlock.LIBVCRUNTIME ref: 004398C7

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5

Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 004193F0
GetSystemMetrics.USER32(0000004D), ref: 004193F6
GetSystemMetrics.USER32(0000004E), ref: 004193FC
GetSystemMetrics.USER32(0000004F), ref: 00419402

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785

Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B

Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F

Function 00413D0D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D46

Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB

Part of subcall function 00404AA1: send.WS2_32(FFFFFFFF,00000000,00000000,00000000), ref: 00404B36

RegCloseKey.ADVAPI32(00000000,004660A4,004660A4,00466468,00466468,00000071), ref: 00413EB4

Strings

NG, xrefs: 00413E23

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoOpenQuerysend
String ID: NG
API String ID: 3114080316-1651712548
Opcode ID: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
Opcode Fuzzy Hash: fc7062b0e2d73897183f332ff677a088385e4ff99dcd0168fd06527908a237fe
Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E

Function 0040404C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A843), ref: 0041C49E

Sleep.KERNEL32(000000FA,00465E74), ref: 00404138

Strings

/sort "Visit Time" /stext ", xrefs: 004040B2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "
API String ID: 368326130-1573945896
Opcode ID: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
Opcode Fuzzy Hash: 765a2cec5dfc93fc14e6a06a83629ca65ec94325b3245c099cb6fcf10de14a30
Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99

Function 00418A92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00418ABE

Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A

SHCreateMemStream.SHLWAPI(00000000), ref: 00418B0B

Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD

Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682

Strings

image/jpeg, xrefs: 00418AD5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/jpeg
API String ID: 1291196975-3785015651
Opcode ID: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
Instruction ID: 71c7567624fb1f0fb67e5b365d5baafb3eed0516d04e2b9615b8e3d4f66a2876
Opcode Fuzzy Hash: 6e04f8ac358d86261f340c02fc4254ea4fa5b72d51dab4b51890127c9f8658cf
Instruction Fuzzy Hash: 13317F71504300AFC301EF65CC84DAFB7E9FF8A704F00496EF985A7251DB7999448BA6

Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 0040B797

Strings

[Text copied to clipboard], xrefs: 0040B7E6
[End of clipboard], xrefs: 0040B7D9

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
Opcode Fuzzy Hash: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C

Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12

Strings

ACP, xrefs: 00451B55
OCP, xrefs: 00451B8B

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C

Function 004162E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004162F5

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB

Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD

Strings

okmode, xrefs: 0041630F
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: _wcslen$CloseCreateValue
String ID: !D@$okmode
API String ID: 3411444782-1942679189
Opcode ID: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
Opcode Fuzzy Hash: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D

Function 00418B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00418BAA

Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A

SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 00418BCF

Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD

Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682

Strings

image/png, xrefs: 00418BC1

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/png
API String ID: 1291196975-2966254431
Opcode ID: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
Instruction ID: c6f894421d6f6d4ca6915e56eba1d7ff3797fde04a376feef2065c2e579c4a83
Opcode Fuzzy Hash: a27ec27d9e18f0a906ecaac1dc19e5732830617660cf953b76ad9b2867ca9ec8
Instruction Fuzzy Hash: 30219371204211AFC705EB61CC88CBFBBADEFCA754F10092EF54693161DB399945CBA6

Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087

Strings

KeepAlive | Enabled | Timeout: , xrefs: 0040501F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
Opcode Fuzzy Hash: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF

Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00416640
URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DownloadFileSleep
String ID: !D@
API String ID: 1931167962-604454484
Opcode ID: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
Opcode Fuzzy Hash: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A

Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

| , xrefs: 0041B53C
%02i:%02i:%02i:%03i , xrefs: 0041B51E

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i
API String ID: 481472006-2430845779
Opcode ID: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
Opcode Fuzzy Hash: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A

Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CloseHandle.KERNEL32(?), ref: 0040B0B4
UnhookWindowsHookEx.USER32 ref: 0040B0C7

Strings

Online Keylogger Stopped, xrefs: 0040B061, 0040B069, 0040B090

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
Opcode Fuzzy Hash: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE

Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32

Strings

JD, xrefs: 00448B29, 00448B16
IsValidLocaleName, xrefs: 00448AF7, 00448B01

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$JD
API String ID: 1901932003-2234456777
Opcode ID: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
Opcode Fuzzy Hash: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E

Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6

Strings

\AppData\Local\Google\Chrome\, xrefs: 0040C4E0
UserProfile, xrefs: 0040C4CA

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
Opcode Fuzzy Hash: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE

Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 0040C543
UserProfile, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
Opcode Fuzzy Hash: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE

Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5BC

Strings

\Opera Software\Opera Stable\, xrefs: 0040C5A6
AppData, xrefs: 0040C590

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
Opcode Fuzzy Hash: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA

Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0040B64B

Part of subcall function 0040A3E0: GetForegroundWindow.USER32(?,?,00000000), ref: 0040A416
Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
Part of subcall function 0040A3E0: GetKeyboardLayout.USER32(00000000), ref: 0040A429
Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
Part of subcall function 0040A3E0: GetKeyboardState.USER32(?,?,00000000), ref: 0040A43E
Part of subcall function 0040A3E0: ToUnicodeEx.USER32(00000054,?,?,?,00000010,00000000,00000000), ref: 0040A461
Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1

Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

[AltR], xrefs: 0040B681
[AltL], xrefs: 0040B68D

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
Opcode Fuzzy Hash: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF

Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E

Strings

uD, xrefs: 0044ED05

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID:
String ID: uD
API String ID: 0-2547262877
Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49

Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8

Strings

open, xrefs: 004161A2
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: !D@$open
API String ID: 587946157-1586967515
Opcode ID: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
Opcode Fuzzy Hash: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A

Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0040B6A5

Strings

[CtrlL], xrefs: 0040B6D3
[CtrlR], xrefs: 0040B6C2

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF

Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: ,kG$0kG
API String ID: 1881088180-2015055088
Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D

Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D144,00000000,004752D8,004752F0,?,pth_unenc), ref: 00413A31
RegDeleteValueW.ADVAPI32(?,?,?,pth_unenc), ref: 00413A45

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668

Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1

Strings

pth_unenc, xrefs: 0040B869

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: DeleteDirectoryFileRemove
String ID: pth_unenc
API String ID: 3325800564-4028850238
Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8

Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
WaitForSingleObject.KERNEL32(000000FF), ref: 00412873

Strings

pth_unenc, xrefs: 00412850

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ObjectProcessSingleTerminateWait
String ID: pth_unenc
API String ID: 1872346434-4028850238
Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59

Function 0041BAE6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetLastInputInfo.USER32(NG), ref: 0041BAF6
GetTickCount.KERNEL32 ref: 0041BAFC

Strings

NG, xrefs: 0041BAEB, 0041BAF5

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: CountInfoInputLastTick
String ID: NG
API String ID: 3478931382-1651712548
Opcode ID: 1072e3c2261f103fc32e137a75d3669dd2f4511b29ca1c5cc6daf9e0edaf2e7e
Instruction ID: 91b37e9d9b7f8f393223e5bf0be67cbbeb1ccf95644ad96dbec1e326022f3834
Opcode Fuzzy Hash: 1072e3c2261f103fc32e137a75d3669dd2f4511b29ca1c5cc6daf9e0edaf2e7e
Instruction Fuzzy Hash: 84D0C97180060CABDB04AFA5EC4D99DBBBCEB05212F1042A5E84992210DA71AA548A95

Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
GetLastError.KERNEL32 ref: 00440D35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759

Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 00411B8C
IsBadReadPtr.KERNEL32(?,00000014), ref: 00411C58
SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91

Memory Dump Source

Source File: 00000004.00000002.4573219338.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.4573219338.0000000000474000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_UsoOuMVYCv8QrxG.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UsoOuMVYCv8QrxG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UsoOuMVYCv8QrxG.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
UsoOuMVYCv8QrxG.exe

Function 05838ADC Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Function 05839A11 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Function 08087655 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 08087660 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0320B0E8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 0320AFC8 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 0320590C Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 05801284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 03204514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 080873D0 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 080873D8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 08087238 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Function 0320AFD4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre