Edit tour

Windows Analysis Report
RmbF3635xY.exe

Overview

General Information

Sample name:	RmbF3635xY.exe renamed because original name is a hash value
Original sample name:	f488b4eb65d5f5339401fc0869e614433719e64a5156945b530f98c7d39452e1.exe
Analysis ID:	1525800
MD5:	31059e7394b880f017e83804d9b716ab
SHA1:	2c0057c276d7d2020d1e5a60ca6d44e2fb91674e
SHA256:	f488b4eb65d5f5339401fc0869e614433719e64a5156945b530f98c7d39452e1
Tags:	bestmagazineforanimalsunicum-ruexeuser-JAMESWT_MHT
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

RmbF3635xY.exe (PID: 6828 cmdline: "C:\Users\user\Desktop\RmbF3635xY.exe" MD5: 31059E7394B880F017E83804D9B716AB)

explorer.exe (PID: 3504 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

jtruajj (PID: 4284 cmdline: C:\Users\user\AppData\Roaming\jtruajj MD5: 31059E7394B880F017E83804D9B716AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x38c9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3491:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\jtruajj, CommandLine: C:\Users\user\AppData\Roaming\jtruajj, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\jtruajj, NewProcessName: C:\Users\user\AppData\Roaming\jtruajj, OriginalFileName: C:\Users\user\AppData\Roaming\jtruajj, ParentCommandLine: , ParentImage: , ParentProcessId: 1124, ProcessCommandLine: C:\Users\user\AppData\Roaming\jtruajj, ProcessId: 4284, ProcessName: jtruajj

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:10:05.191461+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49710	193.46.217.78	80	TCP
2024-10-04T15:10:06.535004+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:06.922982+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:32.226080+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49713	193.46.217.78	80	TCP
2024-10-04T15:10:32.432388+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:32.829421+0200	2039103	1	A Network Trojan was detected	192.168.2.9	49711	188.40.141.211	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RmbF3635xY.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\jtruajj

Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\jtruajj

ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: RmbF3635xY.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\jtruajj

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RmbF3635xY.exe

Joe Sandbox ML: detected

Source: RmbF3635xY.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\RmbF3635xY.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.9:49710 -> 193.46.217.78:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.9:49711 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.9:49713 -> 193.46.217.78:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 193.46.217.78 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://unicexpertmagazine.pw/index.php
Source: Malware configuration extractor	URLs: http://ceoconstractionstore.pl/index.php
Source: Malware configuration extractor	URLs: http://openclehardware.ru/index.php
Source: Malware configuration extractor	URLs: http://informcoopirationunicolceo.ru/index.php

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: CUBENODEES CUBENODEES

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gtatfotvrgw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://duiiukhvfawcnf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://trpngknppeg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xtihbxaqoab.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rljealjxpbaxswq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 363Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qburaxgwiulsnc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: ceoconstractionstore.pl

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: unicexpertmagazine.pw
Source: global traffic	DNS traffic detected: DNS query: ceoconstractionstore.pl

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gtatfotvrgw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: unicexpertmagazine.pw

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 13:10:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:10:06 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:10:06 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 13:10:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:10:32 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:10:32 GMT

Source: explorer.exe, 00000002.00000002.2717195196.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000002.00000003.2291027999.000000000BEC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2725388565.0000000010390000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2725441570.0000000010460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.php
Source: explorer.exe, 00000002.00000002.2717195196.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000002.00000002.2717195196.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000002.00000002.2717195196.00000000087BB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.00000000087BB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qburaxgwiulsnc.com/
Source: explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://qburaxgwiulsnc.com/l
Source: explorer.exe, 00000002.00000000.1573131905.00000000082D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.2716113298.0000000007670000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1570267826.0000000002C60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000002.00000000.1573255731.00000000085D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2292146114.00000000085E0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp(
Source: explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSJM
Source: explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSZM
Source: explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSp
Source: explorer.exe, 00000002.00000000.1573369849.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008796000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/rT
Source: explorer.exe, 00000002.00000000.1573369849.000000000862F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc
Source: explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?z$
Source: explorer.exe, 00000002.00000000.1573369849.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008796000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/~T
Source: explorer.exe, 00000002.00000000.1570427978.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2713649615.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark
Source: explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1eBTmz.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AATs0AB.img
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1e6XdQ.img
Source: explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://parade.com/61481/toriavey/where-did-hamburgers-originate
Source: explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000002.00000002.2717195196.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2292315664.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.000000000899E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/bat
Source: explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-wo
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-f
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hI
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-expresses-worry-about-congressional
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.stacker.com/arizona/phoenix
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_de
Source: explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.yelp.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401529
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	0_2_00402FFA
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401541
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401545
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401553
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00402379 NtQuerySystemInformation,	0_2_00402379
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040237B NtQuerySystemInformation,	0_2_0040237B
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040332A RtlInitUnicodeString,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,	0_2_0040332A
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401534
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DB
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_004020EA NtQuerySystemInformation,	0_2_004020EA
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00402387 NtQuerySystemInformation,	0_2_00402387
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00402397 NtQuerySystemInformation,	0_2_00402397
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040239B NtQuerySystemInformation,	0_2_0040239B
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040239E NtQuerySystemInformation,	0_2_0040239E
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401529
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	4_2_00402FFA
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401541
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401545
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401553
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00402379 NtQuerySystemInformation,	4_2_00402379
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0040237B NtQuerySystemInformation,	4_2_0040237B
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0040332A RtlInitUnicodeString,NtEnumerateKey,	4_2_0040332A
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401534
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014DB
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_004020EA NtQuerySystemInformation,	4_2_004020EA
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00402387 NtQuerySystemInformation,	4_2_00402387
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00402397 NtQuerySystemInformation,	4_2_00402397
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0040239B NtQuerySystemInformation,	4_2_0040239B
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0040239E NtQuerySystemInformation,	4_2_0040239E

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040332A	0_2_0040332A
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00418A70	0_2_00418A70
Source: C:\Windows\explorer.exe	Code function: 2_2_029928D0	2_2_029928D0
Source: C:\Windows\explorer.exe	Code function: 2_2_085828D0	2_2_085828D0
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00418A70	4_2_00418A70

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\jtruajj F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1

Source: RmbF3635xY.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: RmbF3635xY.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: jtruajj.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/2@2/2

Source: C:\Users\user\Desktop\RmbF3635xY.exe

Code function: 0_2_006804BF CreateToolhelp32Snapshot,Module32First,

0_2_006804BF

Source: C:\Windows\explorer.exe

Code function: 2_2_02993678 CoCreateInstance,

2_2_02993678

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jtruajj

Jump to behavior

Source: RmbF3635xY.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RmbF3635xY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RmbF3635xY.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\RmbF3635xY.exe "C:\Users\user\Desktop\RmbF3635xY.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\jtruajj C:\Users\user\AppData\Roaming\jtruajj

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\RmbF3635xY.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Unpacked PE file: 0.2.RmbF3635xY.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\jtruajj	Unpacked PE file: 4.2.jtruajj.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0040237B push 000023C2h; retn 0023h	0_2_0040238B
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_004025DC push ebp; ret	0_2_004025FC
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00401284 pushad ; iretd	0_2_00401286
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_005E2643 push ebp; ret	0_2_005E2663
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_005E12EB pushad ; iretd	0_2_005E12ED
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_005E23E2 push 000023C2h; retn 0023h	0_2_005E23F2
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0067D864 pushad ; retf 0067h	0_2_0067D865
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00684439 push ebx; ret	0_2_0068443C
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00682D09 push es; retf	0_2_00682D20
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00687A1C push esp; ret	0_2_00687A1D
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_006811E4 pushad ; iretd	0_2_006811E6
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0040237B push 000023C2h; retn 0023h	4_2_0040238B
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_004025DC push ebp; ret	4_2_004025FC
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00401284 pushad ; iretd	4_2_00401286
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_006A2643 push ebp; ret	4_2_006A2663
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_006A12EB pushad ; iretd	4_2_006A12ED
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_006A23E2 push 000023C2h; retn 0023h	4_2_006A23F2
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_0084161C pushad ; iretd	4_2_0084161E
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00843141 push es; retf	4_2_00843158
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00847E54 push esp; ret	4_2_00847E55
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00844871 push ebx; ret	4_2_00844874

Source: RmbF3635xY.exe	Static PE information: section name: .text entropy: 7.486630625699931
Source: jtruajj.2.dr	Static PE information: section name: .text entropy: 7.486630625699931

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jtruajj

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\jtruajj

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\rmbf3635xy.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\jtruajj:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\AppData\Roaming\jtruajj	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_4-4067
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_0-4120

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\RmbF3635xY.exe	API/Special instruction interceptor: Address: 7FF90818E814
Source: C:\Users\user\Desktop\RmbF3635xY.exe	API/Special instruction interceptor: Address: 7FF90818D584
Source: C:\Users\user\AppData\Roaming\jtruajj	API/Special instruction interceptor: Address: 7FF90818E814
Source: C:\Users\user\AppData\Roaming\jtruajj	API/Special instruction interceptor: Address: 7FF90818D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: jtruajj, 00000004.00000002.1850091879.000000000082E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: RmbF3635xY.exe, 00000000.00000002.1583122166.000000000066E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKS%XE'

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 417	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 366	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 889	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 861	Jump to behavior

Source: C:\Windows\explorer.exe TID: 1864	Thread sleep count: 417 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6940	Thread sleep count: 366 > 30			Jump to behavior

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		0_2_00418A70
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		4_2_00418A70

Source: explorer.exe, 00000002.00000000.1573369849.000000000888E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}=
Source: explorer.exe, 00000002.00000000.1573369849.0000000008979000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00`
Source: explorer.exe, 00000002.00000000.1573369849.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000002.00000000.1573369849.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008796000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.00000000087C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.1569753972.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000^F1O
Source: explorer.exe, 00000002.00000000.1573369849.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000d
Source: explorer.exe, 00000002.00000000.1573369849.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000002.00000000.1573369849.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}l
Source: explorer.exe, 00000002.00000000.1569753972.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000002.00000000.1573369849.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.1573369849.00000000088E6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000002.00000000.1569753972.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\RmbF3635xY.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\RmbF3635xY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\RmbF3635xY.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	System information queried: CodeIntegrityInformation			Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\jtruajj	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_4-4067
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_0-4120

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_005E092B mov eax, dword ptr fs:[00000030h]	0_2_005E092B
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_005E0D90 mov eax, dword ptr fs:[00000030h]	0_2_005E0D90
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Code function: 0_2_0067FD9C push dword ptr fs:[00000030h]	0_2_0067FD9C
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_006A092B mov eax, dword ptr fs:[00000030h]	4_2_006A092B
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_006A0D90 mov eax, dword ptr fs:[00000030h]	4_2_006A0D90
Source: C:\Users\user\AppData\Roaming\jtruajj	Code function: 4_2_008401D4 push dword ptr fs:[00000030h]	4_2_008401D4

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: jtruajj.2.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 193.46.217.78 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Thread created: C:\Windows\explorer.exe EIP: 29919F0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Thread created: unknown EIP: 85819F0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\RmbF3635xY.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\RmbF3635xY.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\jtruajj	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000002.00000002.2713075850.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1569996493.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000002.2713075850.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1569996493.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.00000000087C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000002.2713075850.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1569996493.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000002.00000002.2713075850.0000000001071000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1569996493.0000000001071000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000002.2712756787.0000000000A44000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1569753972.0000000000A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanq

Source: C:\Users\user\Desktop\RmbF3635xY.exe

Code function: 0_2_00418A70 InterlockedCompareExchange,GetFocus,ReadConsoleA,FindAtomA,SearchPathA,SetConsoleMode,SearchPathW,GetDefaultCommConfigA,CopyFileExW,CreatePipe,GetEnvironmentStringsW,WriteConsoleOutputA,GetModuleFileNameA,GetSystemTimeAdjustment,ObjectPrivilegeAuditAlarmW,WaitForSingleObject,SetCommState,GetConsoleAliasesLengthW,GetComputerNameA,CopyFileW,GetFileAttributesA,GetConsoleAliasExesLengthW,GetBinaryType,FormatMessageA,GetLongPathNameA,PurgeComm,LoadLibraryA,MoveFileW,InterlockedCompareExchange,

0_2_00418A70

Source: C:\Windows\explorer.exe

Code function: 2_2_02993520 GetUserNameW,

2_2_02993520

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	32 Process Injection	11 Masquerading	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	22 Virtualization/Sandbox Evasion	LSASS Memory	611 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	32 Process Injection	Security Account Manager	22 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RmbF3635xY.exe	82%	ReversingLabs	Win32.Trojan.SmokeLoader
RmbF3635xY.exe	100%	Avira	HEUR/AGEN.1312567
RmbF3635xY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\jtruajj	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\jtruajj	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\jtruajj	82%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://outlook.com	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ceoconstractionstore.pl	188.40.141.211	true	true		unknown
unicexpertmagazine.pw	193.46.217.78	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://openclehardware.ru/index.php	true	unknown
http://ceoconstractionstore.pl/index.php	true	unknown
http://informcoopirationunicolceo.ru/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/a-second-war-could-easily-erupt-in-europe-while-everyone-s-dist	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns.windows.com/bat	explorer.exe, 00000002.00000002.2717195196.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2292315664.000000000899E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1573369849.000000000899E000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.stacker.com/arizona/phoenix	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000002.00000000.1570427978.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2713649615.0000000002F10000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.starsinsider.com/n/154870?utm_source=msn.com&utm_medium=display&utm_campaign=referral_de	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000002.00000000.1573131905.00000000082D0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000002.2716113298.0000000007670000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.1570267826.0000000002C60000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp(	explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://parade.com/61481/toriavey/where-did-hamburgers-originate	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://qburaxgwiulsnc.com/	explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/~T	explorer.exe, 00000002.00000000.1573369849.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008796000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOSp	explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=A1668CA4549A443399161CE8D2237D12&timeOut=5000&oc	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/foodanddrink/foodnews/the-best-burger-place-in-phoenix-plus-see-the-rest-o	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/rT	explorer.exe, 00000002.00000000.1573369849.0000000008796000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008796000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.1573255731.00000000085D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2292146114.00000000085E0000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://word.office.com	explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOSJM	explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.com	explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8-dark	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/england-considers-raising-smoking-age-until-cigarettes-are-bann	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com	explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2722215051.000000000BDEA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://qburaxgwiulsnc.com/l	explorer.exe, 00000002.00000003.2292625257.000000000BD22000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2721431889.000000000BD22000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOSZM	explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/trump-whines-to-cameras-in-ny-fraud-case-before-fleeing-to-f	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/companies/kaiser-permanente-and-unions-for-75-000-striking-health-wo	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000002.00000002.2722215051.000000000BE19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.1575532214.000000000BDC8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291599189.000000000BE16000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2291027999.000000000BDE7000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.yelp.com	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPi8	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/nobel-prize-in-literature-to-be-announced-in-stockholm/ar-AA1hI	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKhb-dark	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/accuweather-el-ni	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?z$	explorer.exe, 00000002.00000000.1573369849.0000000008685000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2717195196.0000000008685000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gPfv-dark	explorer.exe, 00000002.00000000.1571485581.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.2714876298.0000000007065000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.2293060361.0000000007065000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	ceoconstractionstore.pl	Germany		24940	HETZNER-ASDE	true
193.46.217.78	unicexpertmagazine.pw	Spain		203178	CUBENODEES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525800
Start date and time:	2024-10-04 15:08:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RmbF3635xY.exe renamed because original name is a hash value
Original Sample Name:	f488b4eb65d5f5339401fc0869e614433719e64a5156945b530f98c7d39452e1.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: RmbF3635xY.exe

Simulations

Behavior and APIs

Time	Type	Description
09:10:01	API Interceptor	865x Sleep call for process: explorer.exe modified
14:10:05	Task Scheduler	Run new task: Firefox Default Browser Agent C33671130B42FF4D path: C:\Users\user\AppData\Roaming\jtruajj

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	gmpeople.com/upload/
	vwaoMjcyAw.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005_dump.exe	Get hash	malicious	SmokeLoader	Browse	host-data-coin-11.com/
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	LisectAVT_2403002B_303.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	aucmoney.com/upload/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unicexpertmagazine.pw	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse	185.219.7.204
unicexpertmagazine.pw	3312.PDF.scr	Get hash	malicious	SmokeLoader	Browse	45.143.201.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	85.10.195.17
	https://iasitvlife.ro	Get hash	malicious	Unknown	Browse	49.12.228.110
	https://iasitvlife.ro/stiri/local/a-sunat-la-call-center-anticoruptie-si-a-denuntat-un-functionar-public/	Get hash	malicious	HTMLPhisher	Browse	49.12.228.110
	Zxooek.exe	Get hash	malicious	FormBook	Browse	88.198.46.204
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	144.76.53.154
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	176.9.171.101
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	49.12.197.9
	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse	178.63.248.56
	msvcp110.dll	Get hash	malicious	RHADAMANTHYS	Browse	135.181.4.162
CUBENODEES	https://public-usa.mkt.dynamics.com/api/orgs/656e8c66-5e77-ef11-ac1e-6045bd080c27/r/lmUG5F4EgUesqGwuJA5PigEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fcrm.interactivaclic.com%252Fn%252F%253Fc3Y9bzM2NV8xX29uZSZyYW5kPVNUVjBVakk9JnVpZD1VU0VSMjMwOTIwMjRVMjYwOTIzMjE%253DN0123N%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=HTFuI1dWNsWznL3K1x2s1mvQbKix%2BdykwHJYfkmm7o4%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Unknown	Browse	89.44.32.18
	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	83.147.55.182
	New_Document-660111409161.wsf	Get hash	malicious	XWorm	Browse	83.147.55.182
	sora.arm.elf	Get hash	malicious	Mirai	Browse	83.147.57.108
	F24_023.pdf (1).js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf (1).js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf_1.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf_1.js	Get hash	malicious	Unknown	Browse	83.147.53.197

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\jtruajj	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\jtruajj

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: 3388.PDF.hta, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\jtruajj:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.497652873737398
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RmbF3635xY.exe
File size:	222'720 bytes
MD5:	31059e7394b880f017e83804d9b716ab
SHA1:	2c0057c276d7d2020d1e5a60ca6d44e2fb91674e
SHA256:	f488b4eb65d5f5339401fc0869e614433719e64a5156945b530f98c7d39452e1
SHA512:	a31e40888fc80ce8e138833155a63eddc7ea9d4a37bceb95a46e2ce937e42dfc74df34fc9869f95940ee0f73d00f3a72839f220f09499b4f28aa1b91e5b706f9
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
TLSH:	CF244911B9E59025EEF75B75197486942E7BBCF2AA30804E3290321F9E733D36962723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie...

File Icon


Icon Hash:	03a1879b9b6565d6

Static PE Info

General

Entrypoint:	0x401716
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6549601E [Mon Nov 6 21:52:30 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	7529a394fc2aae97d1d4dcd49f0468b5

Entrypoint Preview

Instruction
call 00007F2EE87B8DCCh
jmp 00007F2EE87B4EEEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0041D888h], eax
mov dword ptr [0041D884h], ecx
mov dword ptr [0041D880h], edx
mov dword ptr [0041D87Ch], ebx
mov dword ptr [0041D878h], esi
mov dword ptr [0041D874h], edi
mov word ptr [0041D8A0h], ss
mov word ptr [0041D894h], cs
mov word ptr [0041D870h], ds
mov word ptr [0041D86Ch], es
mov word ptr [0041D868h], fs
mov word ptr [0041D864h], gs
pushfd
pop dword ptr [0041D898h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041D88Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0041D890h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041D89Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0041D7D8h], 00010001h
mov eax, dword ptr [0041D890h]
mov dword ptr [0041D78Ch], eax
mov dword ptr [0041D780h], C0000409h
mov dword ptr [0041D784h], 00000001h
mov eax, dword ptr [0041C008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0041C00Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000D4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a744	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x115000	0x1a1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1a458	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17edf	0x18000	574a29c67171712a5ff2381296a30bab	False	0.7909444173177084	data	7.486630625699931	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x2022	0x2200	681a31faacd60791d3dfc5b6676241ab	False	0.35592830882352944	data	5.421584991551131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c000	0xf7ff8	0x1800	8866369ebf07e3343622354c6c1cc052	False	0.2591145833333333	data	2.6775651395317706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x114000	0x51d	0x600	53e979547d8c2ea86560ac45de08ae25	False	0.013020833333333334	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x115000	0x1a1e0	0x1a200	c9c1cc244b5a96be47b6bccc7c1df270	False	0.4988598983253589	data	5.462891080418723	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x127d08	0x2	data			5.0
ROCOCUPACOZODACAJAJ	0x126d10	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6010447273914463
SUZIZOXALIDEVODUGIDUVOJAPIPUCOFA	0x127908	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6267190569744597
RT_CURSOR	0x127d10	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x127e40	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x115a20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5748933901918977
RT_ICON	0x1168c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6484657039711191
RT_ICON	0x117170	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.6981566820276498
RT_ICON	0x117838	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7536127167630058
RT_ICON	0x117da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5244813278008299
RT_ICON	0x11a348	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6282833020637899
RT_ICON	0x11b3f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6409836065573771
RT_ICON	0x11bd78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.774822695035461
RT_ICON	0x11c258	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.39712153518123666
RT_ICON	0x11d100	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5613718411552346
RT_ICON	0x11d9a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6244239631336406
RT_ICON	0x11e070	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6372832369942196
RT_ICON	0x11e5d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.4448874296435272
RT_ICON	0x11f680	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4364754098360656
RT_ICON	0x120008	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.48404255319148937
RT_ICON	0x1204d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5655650319829424
RT_ICON	0x121380	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6128158844765343
RT_ICON	0x121c28	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.4769585253456221
RT_ICON	0x1222f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.5953757225433526
RT_ICON	0x122858	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5773858921161825
RT_ICON	0x124e00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6437617260787992
RT_ICON	0x125ea8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6323770491803279
RT_ICON	0x126830	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.7056737588652482
RT_STRING	0x12a5b8	0x424	data			0.44622641509433963
RT_STRING	0x12a9e0	0x6c4	data			0.4255196304849885
RT_STRING	0x12b0a8	0x620	data			0.4406887755102041
RT_STRING	0x12b6c8	0x514	data			0.4576923076923077
RT_STRING	0x12bbe0	0x660	data			0.4375
RT_STRING	0x12c240	0x66e	data			0.4307411907654921
RT_STRING	0x12c8b0	0x7b2	data			0.42233502538071066
RT_STRING	0x12d068	0x7e6	data			0.42037586547972305
RT_STRING	0x12d850	0x5f4	data			0.4416010498687664
RT_STRING	0x12de48	0x6d0	data			0.4288990825688073
RT_STRING	0x12e518	0x790	data			0.42613636363636365
RT_STRING	0x12eca8	0x464	data			0.45462633451957296
RT_STRING	0x12f110	0xcc	data			0.5490196078431373
RT_GROUP_CURSOR	0x12a3e8	0x22	data			1.088235294117647
RT_GROUP_ICON	0x126c98	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x11c1e0	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x120470	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x12a410	0x1a8	data			0.5825471698113207

Imports

DLL	Import
KERNEL32.dll	SetPriorityClass, GetConsoleAliasesLengthW, CopyFileExW, GetNumaProcessorNode, ReadConsoleA, GetEnvironmentStringsW, WaitForSingleObject, InterlockedCompareExchange, FreeEnvironmentStringsA, GetModuleHandleW, FormatMessageA, SetCommState, GetCommandLineA, GlobalAlloc, GetVolumeInformationA, CopyFileW, GetConsoleAliasExesLengthW, GetSystemTimeAdjustment, WriteConsoleOutputA, GetFileAttributesA, HeapCreate, SetConsoleMode, GetBinaryTypeA, SearchPathW, GetLastError, GetProcAddress, GetLongPathNameA, MoveFileW, SearchPathA, LoadLibraryA, LocalAlloc, QueryDosDeviceW, FindAtomA, CreatePipe, GetModuleFileNameA, GetDefaultCommConfigA, GetModuleHandleA, BuildCommDCBA, PurgeComm, FatalAppExitA, WriteConsoleOutputAttribute, GetStdHandle, GetComputerNameA, HeapFree, Sleep, ExitProcess, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapAlloc, VirtualAlloc, HeapReAlloc, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, WriteFile, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, FreeEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize
USER32.dll	GetFocus
ADVAPI32.dll	ObjectPrivilegeAuditAlarmW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T15:10:05.191461+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49710	193.46.217.78	80	TCP
2024-10-04T15:10:06.535004+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:06.922982+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:32.226080+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49713	193.46.217.78	80	TCP
2024-10-04T15:10:32.432388+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49711	188.40.141.211	80	TCP
2024-10-04T15:10:32.829421+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.9	49711	188.40.141.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:10:04.259187937 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:04.269984961 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:04.270087004 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:04.270289898 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:04.270308018 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:04.280179024 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:04.283152103 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:05.190660000 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:05.191396952 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:05.191461086 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:05.275589943 CEST	49710	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:05.280560970 CEST	80	49710	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:05.880999088 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:05.885906935 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:05.886143923 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:05.886143923 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:05.886300087 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:05.891274929 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:05.891285896 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:06.529943943 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:06.535003901 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:06.535003901 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:06.543158054 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:06.544327021 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:06.871114016 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:06.922981977 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:31.200464010 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:31.210211992 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:31.210988998 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:31.217560053 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:31.217560053 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:31.228225946 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:31.228241920 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:32.225739956 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:32.226079941 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:32.226176977 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:32.226233006 CEST	49713	80	192.168.2.9	193.46.217.78
Oct 4, 2024 15:10:32.228328943 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:32.228328943 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:32.235580921 CEST	80	49713	193.46.217.78	192.168.2.9
Oct 4, 2024 15:10:32.238871098 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.238882065 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.427405119 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.432388067 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:32.432388067 CEST	49711	80	192.168.2.9	188.40.141.211
Oct 4, 2024 15:10:32.437237978 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.437283993 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.774131060 CEST	80	49711	188.40.141.211	192.168.2.9
Oct 4, 2024 15:10:32.829421043 CEST	49711	80	192.168.2.9	188.40.141.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:10:03.960601091 CEST	62272	53	192.168.2.9	1.1.1.1
Oct 4, 2024 15:10:04.257939100 CEST	53	62272	1.1.1.1	192.168.2.9
Oct 4, 2024 15:10:05.278145075 CEST	65233	53	192.168.2.9	1.1.1.1
Oct 4, 2024 15:10:05.880098104 CEST	53	65233	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 15:10:03.960601091 CEST	192.168.2.9	1.1.1.1	0x8372	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:05.278145075 CEST	192.168.2.9	1.1.1.1	0x5836	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:10:04.257939100 CEST	1.1.1.1	192.168.2.9	0x8372	No error (0)	unicexpertmagazine.pw		193.46.217.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:05.880098104 CEST	1.1.1.1	192.168.2.9	0x5836	No error (0)	ceoconstractionstore.pl		188.40.141.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gtatfotvrgw.org

unicexpertmagazine.pw

duiiukhvfawcnf.org

ceoconstractionstore.pl

trpngknppeg.com

xtihbxaqoab.com

rljealjxpbaxswq.net

qburaxgwiulsnc.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49710	193.46.217.78	80	3504	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:10:04.270289898 CEST	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gtatfotvrgw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 250 Host: unicexpertmagazine.pw
Oct 4, 2024 15:10:04.270308018 CEST	250	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e2 28 60 c8 Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JrC)(`;v(IU'5@48BG);P5ZQ\^`q&bCCv~r.]`N+}-=<-fgULi@Ca)qel"aqr:rg?OY2
Oct 4, 2024 15:10:05.190660000 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 13:10:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49711	188.40.141.211	80	3504	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:10:05.886143923 CEST	291	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://duiiukhvfawcnf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: ceoconstractionstore.pl
Oct 4, 2024 15:10:05.886300087 CEST	173	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ac 5d 70 d4 Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JrC)]pVlE.vkzS;841e)4iT]3Bs/p{2!oFdp}D
Oct 4, 2024 15:10:06.529943943 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:10:06 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 15:10:06.535003901 CEST	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://trpngknppeg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 246 Host: ceoconstractionstore.pl
Oct 4, 2024 15:10:06.535003901 CEST	246	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be 98 31 44 9c Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JsC)1DKgua~;Z8;RQ^1-,RQERx#][Jb^]p}eqfd4<Y%`dA-k;`7]mkBaUo&Hcu;b8
Oct 4, 2024 15:10:06.871114016 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:10:06 GMT
Oct 4, 2024 15:10:32.228328943 CEST	292	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rljealjxpbaxswq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 363 Host: ceoconstractionstore.pl
Oct 4, 2024 15:10:32.228328943 CEST	363	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 84 55 49 ba Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JrC)UI8T juhHWL@EDEY>#S0>xxkQq<}Av8?h@qq#fuUsnz`u5T>\|pZP!u2ws{U)C2AQn<yM
Oct 4, 2024 15:10:32.427405119 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:10:32 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 15:10:32.432388067 CEST	291	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qburaxgwiulsnc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 261 Host: ceoconstractionstore.pl
Oct 4, 2024 15:10:32.432388067 CEST	261	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be 84 24 68 b9 Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JsC)$hmi7K#`HZ4fQ.N8Cp+i#FioNd%v2vvj^#r?gqz+/i={0miP;[e)6fY5@8a
Oct 4, 2024 15:10:32.774131060 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:10:32 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49713	193.46.217.78	80	3504	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:10:31.217560053 CEST	286	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xtihbxaqoab.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: unicexpertmagazine.pw
Oct 4, 2024 15:10:31.217560053 CEST	356	OUT	Data Raw: a1 5f 0e 5e 84 44 5f b9 c8 49 a6 cd 8c c3 2d 38 50 44 b5 2d 15 bd 36 23 dd 54 cb 18 7a fd 07 26 c5 24 ac 8c 4f ab 7b 4d 2c b0 cd 11 b3 45 16 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e4 17 6d a8 Data Ascii: _^D_I-8PD-6#Tz&$O{M,EM`(2m-^JrC)m;BIUbIU un+;o;a`%\V\aSPx{jb)N7^Oi\|'z]SD1L~Lc8!pXmglW>s
Oct 4, 2024 15:10:32.225739956 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 13:10:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Target ID:	0
Start time:	09:09:34
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\RmbF3635xY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RmbF3635xY.exe"
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1583016209.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1583091687.0000000000621000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:09:45
Start date:	04/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff633410000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:10:05
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Roaming\jtruajj
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\jtruajj
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1849964354.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1850069040.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	49.4%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

k`, xrefs: 00418E2D
}$, xrefs: 00418E55

Memory Dump Source

Source File: 00000000.00000002.1582631929.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_RmbF3635xY.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 006804BF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006804E7
Module32First.KERNEL32(00000000,00000224), ref: 00680507

Memory Dump Source

Source File: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0a94162f8ea40fd4552f0e6d09cce9a9bb0cee5f61274add8b36c88ff7ed7e41
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7BF06232140714ABE7603AF5A88DAAE76EDAF49725F100A28E742921C0DAB0E8494B61

Function 005E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005E024D

Strings

cess, xrefs: 005E018D
kernel32.dll, xrefs: 005E008F, 005E0095

Memory Dump Source

Source File: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 8d9f06940a44e2be45beeee2e4bbecad622b7844b54902dca0b4f5182f6b35db
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: A9526874A00269DFDB64CF59C984BA8BBB1BF09304F1480D9E94DAB391DB70AE85DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 00000000.00000002.1582631929.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_RmbF3635xY.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 005E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005E0223,?,?), ref: 005E0E19
SetErrorMode.KERNELBASE(00000000,?,?,005E0223,?,?), ref: 005E0E1E

Memory Dump Source

Source File: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cea14cca2211f37e0d6e011ac58af5d885f71300399aca2e74a7d4b784c7d1e3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A95DC09BCD7F1CDF05B62F008421FB0DD9080C7B0994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 0068017E Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006801CF

Memory Dump Source

Source File: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 681223a5f44de88a19816fad90bdcaa4198014a3f9805301805da2ff7cfe14f3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 08113C79A00208EFDB41DF98C999E99BFF5AF08350F0580A4F9489B362D371EA50DF80

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 00000000.00000002.1582631929.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_RmbF3635xY.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 005E092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 005E095F
l, xrefs: 005E0966
GetProcAddress., xrefs: 005E09DC, 005E09DF, 005E09E4

Memory Dump Source

Source File: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 81c2925e89bdf666cdb0646dd3adc5f1af4359d47b30a98dde1142d258809ff2
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: FE318DB6900609CFDB14CF99C880AAEBBF5FF48324F14504AD441E7352D7B1EA85CBA4

Function 004020EA Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction ID: 1fe14f3d08a5ad6b2b8af3127fa4f425e7ffb0c359c280517f11db711c116789
Opcode Fuzzy Hash: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction Fuzzy Hash: 0A716C32400264DADB28EFBCC6CAE557370FB02F00B550BB6C5812F58ADB75B6198B96

Function 0040332A Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

us<, xrefs: 00403356

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID: us<
API String ID: 0-3812821218
Opcode ID: 308e0de05fb1414eaad262c19b90270c30373029b4f8ecd9a4105f675d28d4fe
Instruction ID: 620728a3fa2a34273f960e8624460b3ff27e753c36e61949abd3c72be656f3e6
Opcode Fuzzy Hash: 308e0de05fb1414eaad262c19b90270c30373029b4f8ecd9a4105f675d28d4fe
Instruction Fuzzy Hash: E541125280D7C08ED7235F3849964663F78AE17312B0901EFC891AA6E7D67C9E0AC35A

Function 0067FD9C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1583256735.000000000067D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0067D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67d000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 0402723631d47c2327ed075c761917cdbd163f041e8e8a4d82b8b6fd244f9dc8
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9F115B72340100AFDB54DF55DC91FA673EAEB89320B298569ED09CB326E675EC42CB60

Function 00402379 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction ID: e7a2f1e1f2d18035c496875c0c2bba996cc0d18765e75913e3c7fd8bcbe23822
Opcode Fuzzy Hash: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction Fuzzy Hash: CA11533600420ADFD715EE219A89AA9BB21FB45704B5400BADE562B0C2A2BD7123970B

Function 0040237B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction ID: d9f06ca26037506423ecc87bc330270b3b45d0e2ffab50e6a8e269eb556b0e13
Opcode Fuzzy Hash: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction Fuzzy Hash: 7411533640820ADFD715EE21AA89AA6BB31FB45704F5400BBDE562B0C1E2BD7123D74B

Function 00402387 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction ID: 8ab6e973ac2bde56534b905b9a6112487ad567182bc04a9cefd4a17b3c0f3d42
Opcode Fuzzy Hash: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction Fuzzy Hash: A6113636504206CFDB15DF20D9895A8B722FB45704B1400BACE522B0C1E37D7113D70B

Function 00402397 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction ID: 10c1f8c9815bd1bae344db256f26ecf9b321a2c49f9f40fa9571263b21f216dd
Opcode Fuzzy Hash: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction Fuzzy Hash: 17113636404206CFD715DF10AA895A8B721BB55704B14007ACE521B0C1A3BD6113970B

Function 0040239B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction ID: f3401649f1529dc56ca8e0e6371485d35b9042d0b2056da4c8f47593e1f5965b
Opcode Fuzzy Hash: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction Fuzzy Hash: 7701263644420ACFDB1AEF11E9896E8B732FB55704B5401BACE565B0C1E37D6113D70B

Function 0040239E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582608813.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RmbF3635xY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction ID: ab8b863e00b9434e1dbf8970a3beebb42fa128e0550c32edf730788d57ebd560
Opcode Fuzzy Hash: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction Fuzzy Hash: 1001263640434ACFCB16EF11E9895E4BB32BF45708B4801A6CE565B092E3793122D70B

Function 005E0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1582993231.00000000005E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_RmbF3635xY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: e79c77a33d3e2958be64fda7cb60edd6142e77e0db177738c83660cdaacb83ea
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 1E01F272A006408FDF25DF61CD04BAB37E9FB86306F0544B4D94AD72C2E3B0A8818F80

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 00000000.00000002.1582631929.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_RmbF3635xY.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 00000000.00000002.1582631929.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_RmbF3635xY.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Analysis Process: explorer.exePID: 3504, Parent PID: 6828COMMON

Execution Graph

Execution Coverage:	39.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	201
Total number of Limit Nodes:	21

Executed Functions

Function 02993678 Relevance: 1.9, APIs: 1, Instructions: 404comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 029936C5

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction ID: 2c546d8ae9526978a185af421171d218c8b40e700f390bd9745acf46c1c879d4
Opcode Fuzzy Hash: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction Fuzzy Hash: 07E1E734608A488FCF94EF28C895EA9B7F5FFA9304F114699E44ACB265DB70E944CB41

Function 02993520 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 02993574

Part of subcall function 02993678: CoCreateInstance.COMBASE ref: 029936C5

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstanceNameUser
String ID:
API String ID: 3213660374-0
Opcode ID: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction ID: 8f916ed3562d96b1b0af78c0e8a2525cd6ceb62f9bfe65420aba460d0bc3def0
Opcode Fuzzy Hash: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction Fuzzy Hash: 34110A70718B4C8FCF90EF6C901876EB6D2EBDC320F950A6EA84EC3255DA7489458B81

Function 02991A60 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 02991B77
CreateThread.KERNEL32 ref: 02991D32
CloseHandle.KERNEL32 ref: 02991D3B
CreateThread.KERNEL32 ref: 02991D59
CloseHandle.KERNEL32 ref: 02991D62

Strings

iP+, xrefs: 02991CC2

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThread$Heap
String ID: iP+
API String ID: 1490796931-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: ab01b1a4762de24e4e1ecc7dd0720205e0d18f4480877edad0775f257b958bbb
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: 4A91A230618E0A8FDF54EF2CD8916A573D6FF98311B44017E9C4ECB156EB34D9418B96

Function 0858239C Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 08582703
DeleteFileW.KERNEL32 ref: 08582710
SleepEx.KERNEL32 ref: 08582771
RtlExitUserThread.NTDLL ref: 08582779

Strings

|:|, xrefs: 085824BC

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: 9d529b197564fc65beabca8b4ae8e162bab05668f4080655d57a412ecd31d5a8
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: 5CE1A230718F49CBDB19BB6884597BA76D1FB98312F10062FD49FD3280DF74A9428B86

Function 0299239C Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 02992703
DeleteFileW.KERNEL32 ref: 02992710
SleepEx.KERNEL32 ref: 02992771
RtlExitUserThread.NTDLL ref: 02992779

Strings

|:|, xrefs: 029924BC

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: 459191823c6eb2359c2f158bc68bf55ee4d6d82bf64cb84f6d75c60703c5ff21
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: BAE1A830718F488BDB19AB6C84597BA77D6FB98325F50062ED89FC3240DF74E9428786

Function 02991F94 Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 0299201E
CopyFileW.KERNEL32 ref: 0299202D
DeleteFileW.KERNEL32 ref: 0299203E
DeleteFileW.KERNEL32 ref: 02992089

Part of subcall function 029949B0: SetFileAttributesW.KERNEL32 ref: 029949FF
Part of subcall function 029949B0: CreateFileW.KERNEL32 ref: 02994A29
Part of subcall function 029949B0: SetFileTime.KERNEL32 ref: 02994A54

CreateFileW.KERNEL32 ref: 02992115

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: c68c616ab317af92968f79b3b0c7a5cba74ab61473fd2ce442f231bba00a148a
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: 4E414930718A4C4FDFA9AFAC945836E76D2EBCC320F54457EA80EC3285DE349D068B85

Function 02993C84 Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 02993CA6
Process32First.KERNEL32 ref: 02993CC5
Process32Next.KERNEL32 ref: 02993D10
CloseHandle.KERNEL32 ref: 02993D1D
SleepEx.KERNEL32 ref: 02993D28

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: 3ea950034da55c5ea781f07bc4357f306840e9bde7d599f9b92749dc35bbde7e
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: 4521B730118A098FDF18EF6CC0987AA72E2FF88325F140ABAE84FDE155EB358545C715

Function 08581A60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 08581B77
CreateThread.KERNEL32 ref: 08581D32
CreateThread.KERNEL32 ref: 08581D59

Strings

iP+, xrefs: 08581CC2

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: 59dd8eba0a8a96ad0b4faa55182fdb2a44d8d4ffb935b636bfe2208e05cf1dfe
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: E091C230618E09CFCF54FF28D891AA573D6FB98302F0441BE9C4EDB256EA34D5428B96

Function 029949B0 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 029949FF
CreateFileW.KERNEL32 ref: 02994A29
SetFileTime.KERNEL32 ref: 02994A54

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction ID: 1d1bd6a820973ecfda9322e3c635c34c4c8f9000e4b91eeee50b4fe2f8990d89
Opcode Fuzzy Hash: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction Fuzzy Hash: 3D212F3070CA488FDF64EF68988979EB6E2FBD8701F10456EA84EC7245DA34DA058782

Function 02994E90 Relevance: 3.1, APIs: 2, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32 ref: 02994F15
ObtainUserAgentString.URLMON ref: 02994F7E

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: AgentObtainQueryStringUserValue
String ID:
API String ID: 4107646653-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: fae0cd4fc871c46ad610fcf7cb8e665ea3131d80b91300a92c3664bcbe87132f
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 1F318431608A4D8FDF19EF6CD8896EA77D6FB98324B04427AE84EC3545EF70D8068791

Function 08581E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 08584D20: GetVolumeInformationA.KERNEL32 ref: 08584D8D

CreateMutexExA.KERNEL32 ref: 08581E8F
CreateFileMappingA.KERNEL32 ref: 08581F41

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: 33c2998c103300dffa3cf3bd1557a2e1234bb84ef2dc45fe3bd9f2bff01a861d
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: AF413D30714F09CFEB64FF3880587AA76D2FB98707F104A2E845EE6244DF7496069B85

Function 02991E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02994D20: GetVolumeInformationA.KERNEL32 ref: 02994D8D

CreateMutexExA.KERNEL32 ref: 02991E8F
CreateFileMappingA.KERNEL32 ref: 02991F41

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: b4a21053f043027a211f57d5536fcee26d316f27ef11ba6cf67253956f903fb3
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 0A415F30714F0C8FDB65EB3880187AE76D2FB98726F504A3E905EC6184CF7496029B81

Function 08584AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 08584B24
GetTokenInformation.KERNELBASE ref: 08584B5B

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: 8bf392e97913917a24da158dfa70e584b2e304af3eea98838c95fc224281f669
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: 06213E34608B098FC754FF28C49866AB7E1FBD9311B044A6EA49AD7364DE30D845DB82

Function 02994AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 02994B24
GetTokenInformation.KERNELBASE ref: 02994B5B

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: 61d484cae4bda54fe213f90ae095f7fcfc616a98ee0b260ff2e186b95d8fcefe
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: 10213334608A088FCB55EB2CC45866AB7E2FBD9311B054A6EA49AC7254DB30D845DB42

Function 08583C84 Relevance: 3.1, APIs: 2, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 08583CA6
SleepEx.KERNEL32 ref: 08583D28

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSleepSnapshotToolhelp32
String ID:
API String ID: 684154974-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: 42e53e7daaf73dbce8ef9b2b9c6ad56129e1256e325a4509adf39e3d9e405e05
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: 56219330218A09CFDB14FF64C0987EA76D2FF88356F140A7ED84BEA255DB7495458711

Function 08583D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 08583D7C
SleepEx.KERNEL32 ref: 08583D87

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 6d855e1563995670fc1348433018a6d1e5401944f836b680748c42234916f2c6
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 00E04F30505A09CFEB28ABA4C0DCBF036A1FB18246F1401BFDC0EED295CB7A4945CB20

Function 02993D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 02993D7C
SleepEx.KERNEL32 ref: 02993D87

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 8264e15d8b57d81164fd090b3a15cf603a1a21f7372fbd8d2b3e9906dc2c7998
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 6AE04F30505A098FEF28AFA8C0DCBB032A5EB18256F1401BADC0EDD295CB764945C724

Function 0299400C Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction ID: 8454c1eaa0fa940ca990caeb2c1ba2378f54329218fdaabf3f41a054468833e9
Opcode Fuzzy Hash: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction Fuzzy Hash: 19D17E30718B098BDF65EF6C94467AEB7E6FB98711F10452EE44AD3241DF74E8428B82

Function 08581F94 Relevance: 1.7, APIs: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 08582115

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: a1c683ce3b278adf1e69514ddda66e4030ecdef3b1c1efa143a7d4506311b6a4
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: E0413930718A4D8FDBA8BFAC945836E76D2FBC8212F14457EA80ED3385DE749D068785

Function 0858337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 085833C2

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: ed35abaa17558035c0e75123278e37d883c4dc9c7372b06e796ad6d8cc25f435
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: 8D41B23471CB0D8FD758BB6C94593BAB6C2FBC8612F14022EA89BD3355EE64980243C2

Function 0299337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 029933C2

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: b99120e54768543fa6ab25e6d38b9b32ead36e264b8bac80dc6af71364ab55d3
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: E941EE3031CF0D4FDB59AA2C98593BEB2D6EBC9321F55026EA89FC3240DE64980347C6

Function 08584D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 08584D8D

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: b5d83f16a419a5516db6def047a2f47a0f22bbcdea869c37580e460e9e402f05
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: 0A312131618A4C8FDB64FF68C448BAA77E1FBD8311F10466E984ED7264EE70D945CB82

Function 02994D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 02994D8D

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: bc9fe309621fa8cc02b86886469c61753f036044b33da74c0f41e3ad43a4ea53
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: DF316530618A4C8FDB64EF68C449BAA77E2FBD8311F10466E984EC7264DE70D945CB82

Function 08581A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 08581A60: RtlCreateHeap.NTDLL ref: 08581B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,08581A03), ref: 08581A30

Memory Dump Source

Source File: 00000002.00000002.2716946130.0000000008581000.00000020.80000000.00040000.00000000.sdmp, Offset: 08581000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8581000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 14b8d86e69eed2fde64ac6a308d2f19e9c80488acac673b88b1e385378acb21b
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 12E04F24754E09CBDB98BBB8D4C432C7591FBC8252F90197FA91EDB285E824C9838391

Function 02991A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 02991A60: RtlCreateHeap.NTDLL ref: 02991B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,02991A03), ref: 02991A30

Memory Dump Source

Source File: 00000002.00000002.2713238316.0000000002991000.00000020.80000000.00040000.00000000.sdmp, Offset: 02991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2991000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 9ef4ba2ec605f4677f4192b03451c5bc4481b0c3e8e3bf685c0f3c256c3ac0b5
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 3AE04F30718A0A5BDF98BBBC94C432C6195FBC8370F901979691ECA285E924CD858731

Analysis Process: jtruajjPID: 4284, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	0%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

}$, xrefs: 00418E55
k`, xrefs: 00418E2D

Memory Dump Source

Source File: 00000004.00000002.1849711788.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_jtruajj.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 006A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006A024D

Strings

cess, xrefs: 006A018D
kernel32.dll, xrefs: 006A008F, 006A0095

Memory Dump Source

Source File: 00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a0000_jtruajj.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: edfa6b35737d46774f892f9e838a511c53124eeea6e349ba935a860513cbf214
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 0A526874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 00000004.00000002.1849711788.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_jtruajj.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 008408F7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0084091F
Module32First.KERNEL32(00000000,00000224), ref: 0084093F

Memory Dump Source

Source File: 00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_83d000_jtruajj.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: be5306d69ea61fbc5e9f7634e2c491a9b06848746d32d905b8ba5743e169b0e8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E8F0C231200318ABE7203AB9988DB6BBAE8FF48721F140529E742D51C1CB70EC058E61

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006A0223,?,?), ref: 006A0E19
SetErrorMode.KERNELBASE(00000000,?,?,006A0223,?,?), ref: 006A0E1E

Memory Dump Source

Source File: 00000004.00000002.1849937727.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6a0000_jtruajj.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a812bd8a4e5226da291cda7890492f087020d928e330f1a56def5d4e73e5cff5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 90D0123114512877DB003A94DC09BCD7B1CDF09B62F008451FB0DD9180C770994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 008405B6 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00840607

Memory Dump Source

Source File: 00000004.00000002.1850164583.000000000083D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_83d000_jtruajj.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9db1500acaea3910694f4b77489e2ecb119e3de9b1d077b6176067c5f6bc4e7d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A0113F79A00208EFDB01DF98C985E99BBF5EF08350F058095FA489B361D771EA50DF91

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.1849680308.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_jtruajj.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 00000004.00000002.1849711788.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_jtruajj.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 00000004.00000002.1849711788.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_jtruajj.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 00000004.00000002.1849711788.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_jtruajj.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RmbF3635xY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\jtruajj

C:\Users\user\AppData\Roaming\jtruajj:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
RmbF3635xY.exe

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 006804BF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 005E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Function 005E0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Function 0068017E Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON