Edit tour

Windows Analysis Report
build.exe

Overview

General Information

Sample name:	build.exe
Analysis ID:	1526421
MD5:	76a22609f559db1a73201b95a09053e7
SHA1:	56d1d8da4e5cea24045cfadc46df0d01be4f161c
SHA256:	b39fc625927448fa634bf0241a8eabd228d9acffb3e66e1091eb1a7cb3f9d719
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Explorer NOUACCHECK Flag

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion NT Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

build.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\build.exe" MD5: 76A22609F559DB1A73201B95A09053E7)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 6360 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cvtres.exe (PID: 6316 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 193.142.146.64 2015 VOerOCQof MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

explorer.exe (PID: 2472 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 4940 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: build.exe PID: 7040	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cvtres.exe PID: 6316	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 2472, ProcessName: explorer.exe

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\build.exe, ProcessId: 7040, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: build.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: build.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: build.exe

Joe Sandbox ML: detected

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: build.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\build.exe	Code function: 4x nop then jmp 009D2F4Dh		0_2_009D2AE0
Source: C:\Users\user\Desktop\build.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]		0_2_009D64E8

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 193.142.146.64:2015

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.146.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipinfo.io

Source: cvtres.exe, 00000003.00000002.4167328220.0000000002958000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4167328220.0000000002950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: build.exe, 00000000.00000002.1717332096.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4166213175.0000000000977000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4167328220.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4166008887.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4167328220.000000000292C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: cvtres.exe, 00000003.00000002.4166213175.0000000000977000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ipbP
Source: cvtres.exe, 00000003.00000002.4167328220.0000000002958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.iod
Source: cvtres.exe, 00000003.00000002.4167328220.0000000002941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cvtres.exe, 00000003.00000002.4166008887.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://i.imgur.com/A6jEbUB.png

Source: C:\Users\user\Desktop\build.exe

Code function: 0_2_009D2F70 CreateDesktopW,

0_2_009D2F70

System Summary

.NET source code contains very large array initializations

Source: build.exe, HVNC.cs	Large array initialization: StartHVNC: array initializer size 19424
Source: TxTKzZWFO.exe.0.dr, HVNC.cs	Large array initialization: StartHVNC: array initializer size 19424
Source: 0.2.build.exe.2707d9c.1.raw.unpack, HVNC.cs	Large array initialization: StartHVNC: array initializer size 19424

Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_009D0848	0_2_009D0848
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_009D3409	0_2_009D3409
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_009D07A9	0_2_009D07A9
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_009D07E8	0_2_009D07E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 3_2_026C62A3	3_2_026C62A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 3_2_026C984B	3_2_026C984B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 3_2_026C9858	3_2_026C9858

Source: build.exe, 00000000.00000002.1717332096.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDLL.exe" vs build.exe
Source: build.exe, 00000000.00000002.1717332096.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs build.exe
Source: build.exe, 00000000.00000002.1715709027.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs build.exe
Source: build.exe, 00000000.00000000.1711052198.000000000037C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs build.exe
Source: build.exe	Binary or memory string: OriginalFilenameStub.exe" vs build.exe

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: build.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TxTKzZWFO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: build.exe, HVNC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TxTKzZWFO.exe.0.dr, HVNC.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.build.exe.2707d9c.1.raw.unpack, HVNC.cs	Cryptographic APIs: 'CreateDecryptor'

Source: build.exe, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'
Source: TxTKzZWFO.exe.0.dr, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'
Source: 0.2.build.exe.2707d9c.1.raw.unpack, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'

Source: classification engine

Classification label: mal100.evad.winEXE@8/3@1/2

Source: C:\Users\user\Desktop\build.exe

File created: C:\Users\user\AppData\Roaming\fOWeBGYAp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: \Sessions\1\BaseNamedObjects\VOerOCQof
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: build.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: build.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build.exe

ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\build.exe

File read: C:\Users\user\Desktop\build.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\build.exe "C:\Users\user\Desktop\build.exe"
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 193.142.146.64 2015 VOerOCQof
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 193.142.146.64 2015 VOerOCQof	Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: build.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: build.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: build.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

.NET source code contains potential unpacker

Source: build.exe, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: TxTKzZWFO.exe.0.dr, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 0.2.build.exe.2707d9c.1.raw.unpack, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])

Source: build.exe

Static PE information: 0xC09B1206 [Wed May 25 07:49:26 2072 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Code function: 3_2_026C0D37 push esp; retn 00D8h

3_2_026C0D61

Source: build.exe	Static PE information: section name: .text entropy: 7.321757044315469
Source: TxTKzZWFO.exe.0.dr	Static PE information: section name: .text entropy: 7.321757044315469

Source: 0.2.build.exe.26dfec4.0.raw.unpack, ecWdQLGLZPEpl.cs	High entropy of concatenated method names: '_003CRandomString_003Eb__9_0', 'Main', 'nnaCNjrtItkZV', 'SAYEJqanTozA', 'ohQdkyWwQMgV', 'OsZKpDphEzib', 'EnYNDRmmEKB', 'nqrExhNnadhIL', 'sVvLgDNrOREdG', 'OZkUrptaNPEwXus'
Source: 0.2.build.exe.26dfec4.0.raw.unpack, akXgkkFEexOmF.cs	High entropy of concatenated method names: '_003CFindHandle_003Eb__67_0', '_003CRenderScreenshot_003Eb__0', 'tdqyiiqlHqwkl', 'rJBcJYqRAGFo', 'cbGHnVuPSCfFXbHK', 'gZNlqUJMdIjWRF', 'qqnVVdTGHS', 'eXkpxzbmwONsIg', 'IHSUUtsSqtaGuA', 'jdZdGnxdvcgbm'

Source: C:\Users\user\Desktop\build.exe

File created: C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\build.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Memory allocated: 9D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 4690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Window / User API: threadDelayed 5739			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Window / User API: threadDelayed 4256			Jump to behavior

Source: C:\Users\user\Desktop\build.exe TID: 6148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6440	Thread sleep count: 5739 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6440	Thread sleep time: -57390000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6440	Thread sleep count: 4256 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 6440	Thread sleep time: -42560000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\build.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: cvtres.exe, 00000003.00000002.4166213175.0000000000977000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?

Source: C:\Users\user\Desktop\build.exe

Code function: 0_2_009D68A2 LdrInitializeThunk,

0_2_009D68A2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: build.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 6316, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: build.exe, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: build.exe, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: build.exe, RunPE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: build.exe, RunPE.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: build.exe, RunPE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\build.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\build.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\build.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 692008	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 193.142.146.64 2015 VOerOCQof

Jump to behavior

Source: build.exe, 00000000.00000002.1717332096.00000000026D6000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4166008887.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Users\user\Desktop\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Create Account	312 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
build.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.Xhvnc
build.exe	100%	Avira	TR/Dropper.Gen
build.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.Xhvnc

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.59.81	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ipinfo.io/ip	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ipinfo.iod	cvtres.exe, 00000003.00000002.4167328220.0000000002958000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ipinfo.io/ipbP	cvtres.exe, 00000003.00000002.4166213175.0000000000977000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cvtres.exe, 00000003.00000002.4167328220.0000000002941000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ipinfo.io	cvtres.exe, 00000003.00000002.4167328220.0000000002958000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000003.00000002.4167328220.0000000002950000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://i.imgur.com/A6jEbUB.png	cvtres.exe, 00000003.00000002.4166008887.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.142.146.64	unknown	Netherlands		208046	HOSTSLICK-GERMANYNL	false
34.117.59.81	ipinfo.io	United States		139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526421
Start date and time:	2024-10-05 16:37:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	build.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@8/3@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 73 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target cvtres.exe, PID 6316 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: build.exe

Simulations

Behavior and APIs

Time	Type	Description
10:38:03	API Interceptor	8890399x Sleep call for process: cvtres.exe modified
15:38:02	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.142.146.64	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse
193.142.146.64	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse
34.117.59.81	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	mjOiDa1hrN.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	8ym4cxJPyl.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	GKrKPXOkdF.zsb.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	JuhnladbIs.qao.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	bdsBbxwPyV.ena.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	setup.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	34.117.59.81
	sqlite.dll	Get hash	malicious	Unknown	Browse	34.117.59.81
	T3xpD9ZaYu.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse	34.117.59.81
	Passport and card.vbs	Get hash	malicious	Unknown	Browse	34.117.59.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTSLICK-GERMANYNL	ub16vsLP6y.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	ISehgzqm2V.zip	Get hash	malicious	Remcos	Browse	193.142.146.203
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	Form-8879_PDF.jar	Get hash	malicious	Unknown	Browse	193.142.146.64
	bot_library.exe	Get hash	malicious	Unknown	Browse	193.142.146.43
	SecuriteInfo.com.ELF.Mirai-CQT.17542.12898.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQU.1502.23988.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	arm7.elf	Get hash	malicious	Unknown	Browse	193.142.146.10
	SecuriteInfo.com.ELF.Mirai-CQU.22530.21245.elf	Get hash	malicious	Mirai	Browse	193.142.146.10
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://s3.amazonaws.com/r3e1272/Rco.html#4eyOul3510eTKK19nejdimaazo189TBUDIERNFIMTFBQ264510CRSG907S11	Get hash	malicious	Phisher	Browse	34.117.39.58
	http://nirothniroth.site/?p=22&fbclid=IwY2xjawFs_DdleHRuA2FlbQIxMQABHTdgZU6ok722L5RxKPR-zh7Gkm6BqZ8BcT950y1bxf6l0LKz0zslg7KJHw_aem__ldVm1UUndXAkwYRakjBzg	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://lil-loveeeees.blogspot.com/	Get hash	malicious	Unknown	Browse	34.117.77.79
	ethaertharety.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	34.117.59.81
	TsxJNxhxMJfQTd.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	setup.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	hJABTqngKoJnTgLh.ps1	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://go.hginsights.com/rs/214-HYO-692/images/HG	Get hash	malicious	Unknown	Browse	34.117.177.207
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	34.117.59.81

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:MLU84qpE4KlKDE4KhKiKhIE4Ks
MD5:	8378C2E2DA2FDD2FB813AA6E18705667
SHA1:	EFA4CF7D0E19099EB95C3BCA32F6A5D111BFFF30
SHA-256:	C12EA9B40BA290B624BB2DDAFD4CB2CDC1C05AE1F5F142899D53CF9C54DFFA06
SHA-512:	69C0E61617DFD6F843ECBA8D9328D6737BADAFB622236D3AC79E03590AFAFC5523E10D5E52AD8ACABD71EF9F4B202A654A386E1DF799CC9219CA4678145CDFDD
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	7.1308990174588125
Encrypted:	false
SSDEEP:	768:m10OhbWGFX9QY2A8ZaTJeXARCaib2Fgc44dxSi59J8:m1j7eYiZK1Lib2WGbSi59y
MD5:	76A22609F559DB1A73201B95A09053E7
SHA1:	56D1D8DA4E5CEA24045CFADC46DF0D01BE4F161C
SHA-256:	B39FC625927448FA634BF0241A8EABD228D9ACFFB3E66E1091EB1A7CB3F9D719
SHA-512:	1E334D876B6EE6E1DB1D8E7C4587F33096FB2476AD755E5D9C7329D00C4C9A35010B09912B85342811CEFB612E80B540548F4FD21126E49D86C13CA4468E48FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0................. ........@.. ....................................`.....................................K.......\|............................................................................ ............... ..H............text....... ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B.......................H........z...+......A....................................................0..................}..........j(....}....r...p.j(.....j(..... ....~....(................................(....(....}".....r...p}$...........~.....%(......o....r...p(.........~.........o5...& .K.......%.7...(....(....(.........rG..p(......,G.r...p......%...%.r...p.%...%.r...p.%...(....~......r...p~....(....&.+Ur...p(........,E.ry..p......%...%.r...p.%...%.r...p.%...(....~......r...p~....(....&..........*..

C:\Users\user\AppData\Roaming\temp0923

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.446439344671015
Encrypted:	false
SSDEEP:	3:MKV/z:MKBz
MD5:	E27D47991851642F9EDCBA5827441DD5
SHA1:	D2D3C1B59CDE8CA587E7AF6AA565D0B3A6AD69AB
SHA-256:	0736DC7C3FEFD085EC17D24EF7BE290E4447B87A1196397DD3203D7C19EEACED
SHA-512:	BEA4525CFC84C6C666628810723D2A28A2184AEC4F16F8F189425A2D669F62B5F89B00B5035D3B38A94629CF5B0EA5F3A4FD2B224A69C19B4450636AE9989205
Malicious:	false
Reputation:	low
Preview:	10/05/2024

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.1308990174588125
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	build.exe
File size:	37'376 bytes
MD5:	76a22609f559db1a73201b95a09053e7
SHA1:	56d1d8da4e5cea24045cfadc46df0d01be4f161c
SHA256:	b39fc625927448fa634bf0241a8eabd228d9acffb3e66e1091eb1a7cb3f9d719
SHA512:	1e334d876b6ee6e1db1d8e7c4587f33096fb2476ad755e5d9c7329d00c4c9a35010b09912b85342811cefb612e80b540548f4fd21126e49d86c13ca4468e48ff
SSDEEP:	768:m10OhbWGFX9QY2A8ZaTJeXARCaib2Fgc44dxSi59J8:m1j7eYiZK1Lib2WGbSi59y
TLSH:	49F2C01463ED9E46E56D0DB84FF38A008BF0E6D11963E74F28C48089D7A37694AA17B6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40a6ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC09B1206 [Wed May 25 07:49:26 2072 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x57c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa684	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x86f4	0x8800	d0c9073e4bde4f13ccd64a67e418df2f	False	0.8003791360294118	data	7.321757044315469	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x57c	0x600	a97a34508c12d857871a91f00cd2479f	False	0.4075520833333333	data	3.9774317822717205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	81416023e10a096458e5fbc41a4bf984	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc090	0x2ec	data			0.4344919786096257
RT_MANIFEST	0xc38c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 16:38:02.442990065 CEST	49730	2015	192.168.2.4	193.142.146.64
Oct 5, 2024 16:38:02.448379993 CEST	2015	49730	193.142.146.64	192.168.2.4
Oct 5, 2024 16:38:02.448492050 CEST	49730	2015	192.168.2.4	193.142.146.64
Oct 5, 2024 16:38:03.349845886 CEST	49731	80	192.168.2.4	34.117.59.81
Oct 5, 2024 16:38:03.354971886 CEST	80	49731	34.117.59.81	192.168.2.4
Oct 5, 2024 16:38:03.355037928 CEST	49731	80	192.168.2.4	34.117.59.81
Oct 5, 2024 16:38:03.356287956 CEST	49731	80	192.168.2.4	34.117.59.81
Oct 5, 2024 16:38:03.361126900 CEST	80	49731	34.117.59.81	192.168.2.4
Oct 5, 2024 16:38:03.839647055 CEST	80	49731	34.117.59.81	192.168.2.4
Oct 5, 2024 16:38:03.887738943 CEST	49730	2015	192.168.2.4	193.142.146.64
Oct 5, 2024 16:38:03.893629074 CEST	49731	80	192.168.2.4	34.117.59.81
Oct 5, 2024 16:38:03.894247055 CEST	2015	49730	193.142.146.64	192.168.2.4
Oct 5, 2024 16:38:03.894311905 CEST	49730	2015	192.168.2.4	193.142.146.64
Oct 5, 2024 16:38:03.900902033 CEST	2015	49730	193.142.146.64	192.168.2.4
Oct 5, 2024 16:39:43.848033905 CEST	49731	80	192.168.2.4	34.117.59.81
Oct 5, 2024 16:39:43.853061914 CEST	80	49731	34.117.59.81	192.168.2.4
Oct 5, 2024 16:39:43.853146076 CEST	49731	80	192.168.2.4	34.117.59.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2024 16:38:03.225924015 CEST	53050	53	192.168.2.4	1.1.1.1
Oct 5, 2024 16:38:03.269551992 CEST	53	53050	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 5, 2024 16:38:03.225924015 CEST	192.168.2.4	1.1.1.1	0x376e	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 5, 2024 16:38:03.269551992 CEST	1.1.1.1	192.168.2.4	0x376e	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipinfo.io

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	34.117.59.81	80	6316	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Timestamp	Bytes transferred	Direction	Data
Oct 5, 2024 16:38:03.356287956 CEST	61	OUT	GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive
Oct 5, 2024 16:38:03.839647055 CEST	240	IN	HTTP/1.1 200 OK date: Sat, 05 Oct 2024 14:38:03 GMT content-type: text/plain; charset=utf-8 Content-Length: 11 access-control-allow-origin: * via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	10:37:59
Start date:	05/10/2024
Path:	C:\Users\user\Desktop\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\build.exe"
Imagebase:	0x370000
File size:	37'376 bytes
MD5 hash:	76A22609F559DB1A73201B95A09053E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:37:59
Start date:	05/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:37:59
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:38:00
Start date:	05/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 193.142.146.64 2015 VOerOCQof
Imagebase:	0x5a0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:38:00
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:38:02
Start date:	05/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	23.3%
Total number of Nodes:	73
Total number of Limit Nodes:	6

Executed Functions

Function 009D2F70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopW.USER32(?,?,?,?,?), ref: 009D3061

Strings

2*:y, xrefs: 009D2F92

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: CreateDesktop
String ID: 2*:y
API String ID: 3054513912-1120680929
Opcode ID: 9ac5eb4b35313624f32088399950649fc46b29647b8a26f722a32843d927e698
Instruction ID: 467c0926ee4358370bb3a00f8fa24794cc5bb16e7440e607196fc5b73d37d4bf
Opcode Fuzzy Hash: 9ac5eb4b35313624f32088399950649fc46b29647b8a26f722a32843d927e698
Instruction Fuzzy Hash: 914198B5D002188FCF10CFA9D884A9EFBB5BF59310F14902AE819BB320D775AA45CF94

Function 009D3409 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

(, xrefs: 009D3CA9

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: f7844fd8fab9ff5e9eb5461bfcf76a30092dc970b98bf4440494c72ce618729b
Instruction ID: dffadeb7a4eaf59247f5064c478f0da99bddd417d86579fca38eecc299e2d187
Opcode Fuzzy Hash: f7844fd8fab9ff5e9eb5461bfcf76a30092dc970b98bf4440494c72ce618729b
Instruction Fuzzy Hash: 5062D0749012298FDB64DF25C994BEDBBB2BF89305F1084EAD40DA7291DB349E85CF41

Function 009D64E8 Relevance: 1.7, APIs: 1, Instructions: 248COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 009D6543

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ce9fea5597d4746caa5278e351f6eeb604e4036a23517127f083f9491e2f0e84
Instruction ID: 0a764cb650b916478a82f4e3d227e22b85a7c860ae581d54708f5906d9f186ec
Opcode Fuzzy Hash: ce9fea5597d4746caa5278e351f6eeb604e4036a23517127f083f9491e2f0e84
Instruction Fuzzy Hash: 6EC1B078E01218CFDB54DFA4D994A9DBBB2FF49304F2085AAD809AB365DB309D81CF50

Function 009D2AE0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d54a396f12512817dc8cb6ff1b46d3a5892041e5cdc129c6c90d8ac9db63b9
Instruction ID: 11bf5ec4fb1f783ef1a5866a5abbc932364cf3ee5879d51dcf8d55b574d0d871
Opcode Fuzzy Hash: 82d54a396f12512817dc8cb6ff1b46d3a5892041e5cdc129c6c90d8ac9db63b9
Instruction Fuzzy Hash: 46C12474A00229DFEB25DF64CC50BADBBB6FB89300F1085AAE509A7395DB305A85DF50

Function 009D07A9 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c098fc0dc8b449de343735e62bf12f65c6edcb3695b2037d1a07c2e12ad222ec
Instruction ID: 59b0698f642d368137badb6d2492457a36c9d8e9678d07150130633df718e6ab
Opcode Fuzzy Hash: c098fc0dc8b449de343735e62bf12f65c6edcb3695b2037d1a07c2e12ad222ec
Instruction Fuzzy Hash: DE515E70D093999FCB06DF69D890ADEBFF2AF8A210F1980ABD454E7266D7300845CF91

Function 009D07E8 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e29abcaa6d02feb90939b1a64a7a754130ae40e28cdfdc020a445e547fcc57
Instruction ID: 891c9e48f8d8b82bdf551e5dbb710420d02524e61cf6fe4091172fda1ef8e4a6
Opcode Fuzzy Hash: 13e29abcaa6d02feb90939b1a64a7a754130ae40e28cdfdc020a445e547fcc57
Instruction Fuzzy Hash: 3C512A70D053589FCB45DFA9D890ADEBFF2AF8A210F1881ABD458E7265E7300846CF91

Function 009D0848 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572e649d386164635321dc5754a97099d6e4afa47b44b8dda7cb4bc6b29652ce
Instruction ID: 9067503ba6b474ee0e768b4c695197fbd83c5305f038d80c87fb3a84170def10
Opcode Fuzzy Hash: 572e649d386164635321dc5754a97099d6e4afa47b44b8dda7cb4bc6b29652ce
Instruction Fuzzy Hash: AE4175B4D01208AFDB48DFAAD991AADBBF6BB8D300F14D56AD818B3318E7345945CF50

Function 009D68A2 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab3998aeed6df0b9c6b45779916709e5bd0235dc547877bb10657037ecc1d4b
Instruction ID: 1ac142a2b10458021cd29fe7d89d8c1a6f7db16a9f6f339d7193c8038182eec5
Opcode Fuzzy Hash: 5ab3998aeed6df0b9c6b45779916709e5bd0235dc547877bb10657037ecc1d4b
Instruction Fuzzy Hash: FE31DF78E05208DFCB44DFA9D590ADDBBB2FF89300F14846AE814AB325DB35A942CF50

Function 009D264E Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 009D2927

Strings

2*:y, xrefs: 009D26C2
2*:y, xrefs: 009D2693

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: CreateProcess
String ID: 2*:y$2*:y
API String ID: 963392458-4186917192
Opcode ID: 3e8cf88e802336f0da1c08ed6948a3568357cefda7f02f9e80a725bbf8397356
Instruction ID: 579969e850e215bcdcfb79309c46d92f6e38e57e9e12e2a610002b62f4fcc458
Opcode Fuzzy Hash: 3e8cf88e802336f0da1c08ed6948a3568357cefda7f02f9e80a725bbf8397356
Instruction Fuzzy Hash: E6C13571D002198FCB25CFA8C841BEEBBF1BF59310F1091AAD859B7250DB749A85CF85

Function 009D2658 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 337
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 009D2927

Strings

2*:y, xrefs: 009D26C2
2*:y, xrefs: 009D2693

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: CreateProcess
String ID: 2*:y$2*:y
API String ID: 963392458-4186917192
Opcode ID: 659ec8c38625421e8b5253b8ed10d3c9bf6ee1c3dc237524fd9bd502938abfa6
Instruction ID: 5ee251888d70dc76849dac174476df597b3b2bafb183098622012bd619c83e7b
Opcode Fuzzy Hash: 659ec8c38625421e8b5253b8ed10d3c9bf6ee1c3dc237524fd9bd502938abfa6
Instruction Fuzzy Hash: 4AC12571D002198FDB25CFA8C841BEDBBB1BF59300F1091AAD859B7240DB749A85CF85

Function 009D2F69 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopW.USER32(?,?,?,?,?), ref: 009D3061

Strings

2*:y, xrefs: 009D2F92

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: CreateDesktop
String ID: 2*:y
API String ID: 3054513912-1120680929
Opcode ID: 6f339315683065f4a59777233e1d1fcc612887bdc3345232ac506906bec5f39e
Instruction ID: eaf3eefc21378d209f783db63a744cae4d630540c47d3223ceb69d6ef8668fec
Opcode Fuzzy Hash: 6f339315683065f4a59777233e1d1fcc612887bdc3345232ac506906bec5f39e
Instruction Fuzzy Hash: 9A4199B5D002588FCB10CFA9D884ADEFBB1BF59310F14912AE819BB221D775A949CF54

Function 009D22D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D23A3

Strings

2*:y, xrefs: 009D22F2

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: 2*:y
API String ID: 3559483778-1120680929
Opcode ID: a665c92cd77825774b2c19faa3e3469f1a44fa1d4ed834c2832cc080709e155b
Instruction ID: e415c907514af1f63a51f8d958ec3e2de7dcdd053c5e25aef58fb0d9cdd7d2f5
Opcode Fuzzy Hash: a665c92cd77825774b2c19faa3e3469f1a44fa1d4ed834c2832cc080709e155b
Instruction Fuzzy Hash: 744199B4D012589FCB10CFA9D984ADEFBF1FB59310F24942AE819B7240D739AA45CF64

Function 009D22C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D23A3

Strings

2*:y, xrefs: 009D22F2

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: 2*:y
API String ID: 3559483778-1120680929
Opcode ID: 0596e0bd1913725fb82b735b5b70dde60bd725a198fa6bf4d9e8e2ea933178b0
Instruction ID: 4186f43cc9460fa0049210274bfc6be69cbd4d4f8f9933885d7130a178c5b01b
Opcode Fuzzy Hash: 0596e0bd1913725fb82b735b5b70dde60bd725a198fa6bf4d9e8e2ea933178b0
Instruction Fuzzy Hash: 4D41BCB4D012588FCF00CFA9D984ADEFBF1BB59310F24942AE819B7240D739AA45CF54

Function 009D2421 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D24DA

Strings

2*:y, xrefs: 009D244A

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 2*:y
API String ID: 1726664587-1120680929
Opcode ID: 5d1d79c4444f4e6fba2a6ff2ebc3d164f92d3c8d01b75b10b326225eae4758f9
Instruction ID: c4903082b04cb640b533988cb6a0685b7fc41210e669bf77ccccdd2f91b99590
Opcode Fuzzy Hash: 5d1d79c4444f4e6fba2a6ff2ebc3d164f92d3c8d01b75b10b326225eae4758f9
Instruction Fuzzy Hash: 6341AAB9D002589FCF10CFAAD884AEEFBB1BB59310F14942AE819B7250D735A945CF64

Function 009D2428 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 009D24DA

Strings

2*:y, xrefs: 009D244A

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: MemoryProcessRead
String ID: 2*:y
API String ID: 1726664587-1120680929
Opcode ID: 34d2063756d8709b81c13ff75fdec8b2638ee9548cf97cfa0706e93c2f9e2a71
Instruction ID: d3111f69753586847ba5989028349a400f4aa33b19e95792f654c62a7fd6bad3
Opcode Fuzzy Hash: 34d2063756d8709b81c13ff75fdec8b2638ee9548cf97cfa0706e93c2f9e2a71
Instruction Fuzzy Hash: ED41ABB5D002589FCF10CFAAD884ADEFBB1FB59310F10942AE815B7250D735A945CF68

Function 009D21B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 009D225A

Strings

2*:y, xrefs: 009D21CA

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: AllocVirtual
String ID: 2*:y
API String ID: 4275171209-1120680929
Opcode ID: f6bb8172739e1606d6838896c8ba5d70a0380b578a155f0524e3d1fd3977421e
Instruction ID: e20b00271457be5648ff0ed295189b74d588f28721642e7b8fd9a9e43f84bb3a
Opcode Fuzzy Hash: f6bb8172739e1606d6838896c8ba5d70a0380b578a155f0524e3d1fd3977421e
Instruction Fuzzy Hash: F83198B8D002589FCF14CFA9D884A9EFBB1FB59310F10942AE825B7300D735A946CF58

Function 009D21A9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 009D225A

Strings

2*:y, xrefs: 009D21CA

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: AllocVirtual
String ID: 2*:y
API String ID: 4275171209-1120680929
Opcode ID: d1d6f540515bd0df8f7c02d8ec14bbf6c9a058345ec3f54503ebc907af6a0a20
Instruction ID: 588b1805192fdcd666d4ef23f4ec6342442054d3d97c6955b0215c5c32c1a6e3
Opcode Fuzzy Hash: d1d6f540515bd0df8f7c02d8ec14bbf6c9a058345ec3f54503ebc907af6a0a20
Instruction Fuzzy Hash: 3E31A8B8D002589FCF14CFA9D980A9EFBB1FB59310F20941AE829B7210D735A942CF58

Function 009D2081 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009D2137

Strings

2*:y, xrefs: 009D20A7

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ContextThreadWow64
String ID: 2*:y
API String ID: 983334009-1120680929
Opcode ID: 78a8fa8db7863293ef3026c3224628fe29bb4871997045d3287c33a18cc93c9d
Instruction ID: be12444e847baaf6795f60052a4010b07ece920694319e1a5de09e294f3968f5
Opcode Fuzzy Hash: 78a8fa8db7863293ef3026c3224628fe29bb4871997045d3287c33a18cc93c9d
Instruction Fuzzy Hash: 7441BCB4D042589FCB14CFAAD884AEEFBF1BB59310F24802AE419B7340D7399945CF54

Function 009D2088 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 009D2137

Strings

2*:y, xrefs: 009D20A7

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ContextThreadWow64
String ID: 2*:y
API String ID: 983334009-1120680929
Opcode ID: 85dad5102c144b335abda0e248fd793dc0fd974898c7f3a9db24a9fc0047bc9a
Instruction ID: 90be1a5c8f8b949c895f79504f067708439a3ed8ca85a791cf225e784776df29
Opcode Fuzzy Hash: 85dad5102c144b335abda0e248fd793dc0fd974898c7f3a9db24a9fc0047bc9a
Instruction Fuzzy Hash: AA31B9B4D042589FCB10DFAAD884AEEFBF1BB59310F24802AE419B7340D739A985CF54

Function 009D1228 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 009D12AE

Strings

2*:y, xrefs: 009D124A

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ResumeThread
String ID: 2*:y
API String ID: 947044025-1120680929
Opcode ID: c498c23a7c419bbe0a1f354af6a5dc77f0d45e25390079d32370734020b474c0
Instruction ID: 8fbd5b30bf4fe0dae529b7ad2bfee86d7d30daf69d8259ed4a6606c97679d02b
Opcode Fuzzy Hash: c498c23a7c419bbe0a1f354af6a5dc77f0d45e25390079d32370734020b474c0
Instruction Fuzzy Hash: A531BBB4D012589FCB14CFA9D985ADEFBB1AB49310F24951AE819B7340C735A941CF98

Function 009D1230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 009D12AE

Strings

2*:y, xrefs: 009D124A

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ResumeThread
String ID: 2*:y
API String ID: 947044025-1120680929
Opcode ID: 454214ec5cf6004dd359aed9554f4d160508a74bc2af9d1babb09e9d0fcba80e
Instruction ID: 0a711ba3fe2019a88a1e069290d25ac604dab651159e26b5d3bc2e1e4019511f
Opcode Fuzzy Hash: 454214ec5cf6004dd359aed9554f4d160508a74bc2af9d1babb09e9d0fcba80e
Instruction Fuzzy Hash: BA31CCB4D002189FCB14CFAAD984A9EFBF5FB49310F10942AE919B7340C735A941CF98

Function 009D04DC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 009D09F0

Strings

2*:y, xrefs: 009D099D

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID: 2*:y
API String ID: 2863861424-1120680929
Opcode ID: a7d48140ce61797a8e06f8ba61e3976bb93231f77ab53c802692a3758fa3903a
Instruction ID: f06ddfb862c40c3c8053b1f41108f7af7faca317959827d2262576617a012445
Opcode Fuzzy Hash: a7d48140ce61797a8e06f8ba61e3976bb93231f77ab53c802692a3758fa3903a
Instruction Fuzzy Hash: CD219AB8D002189FCB10CFA9D984A9EBBF4FB49310F20906AE819B7351D775A945CFA4

Function 009D0978 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 009D09F0

Strings

2*:y, xrefs: 009D099D

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID: 2*:y
API String ID: 2863861424-1120680929
Opcode ID: e104eebb8d1d7f6c65b838fca77f65ddc74d1d9ccf08bfbbada4ef41407cc845
Instruction ID: 17d09cad09535e91a4041f6dacbaf2d291798d5f2d5e87858ef2a436ea47637b
Opcode Fuzzy Hash: e104eebb8d1d7f6c65b838fca77f65ddc74d1d9ccf08bfbbada4ef41407cc845
Instruction Fuzzy Hash: AD21CCB8D042589FCB10CFA9D984ACEBBF4FB49310F20906AE818B7351D375A945CFA5

Function 009D6194 Relevance: 2.1, APIs: 1, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b971dd2d228f17cb693f99eea002d8903726265494d1e06326f8a65f84deb378
Instruction ID: 4051e1b03fa803170ea10b5fc5c60e8bea2b8835748bf3d19ad67b850e7018ed
Opcode Fuzzy Hash: b971dd2d228f17cb693f99eea002d8903726265494d1e06326f8a65f84deb378
Instruction Fuzzy Hash: 2B617974905218CFCB55DF68C884B99BBB2FF8A304F1484EAD408A7366D7309E85CF51

Function 009D62F0 Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 009D6543

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7f591b211fee5bd7486bd6e83ed404061dbd5f2eae88a531f9a9a0be05fa0d86
Instruction ID: 07d163d09de23d3cc917d430ff3e21b1082290e13ae2b44c02c0b75c5ef5c858
Opcode Fuzzy Hash: 7f591b211fee5bd7486bd6e83ed404061dbd5f2eae88a531f9a9a0be05fa0d86
Instruction Fuzzy Hash: 9051DF78A01218CFDB54DF69C994B9DBBB2BF89304F1084EAD408A7366DB349E85CF11

Function 009D62C0 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715663653.00000000009D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9d0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7852b3690d0cf33fa0a78257433b3bd040d593f001e56a4a834ab79f0c8d8f3d
Instruction ID: a632b709b88405a2f591eeeca42d76c02cd489ec59ecb528ec3a65b9ca0d8413
Opcode Fuzzy Hash: 7852b3690d0cf33fa0a78257433b3bd040d593f001e56a4a834ab79f0c8d8f3d
Instruction Fuzzy Hash: 6651C178A01218CFDB54DF69C994B9DBBB2FF89304F1094EAD408A7365DB309A85CF11

Analysis Process: cvtres.exePID: 6316, Parent PID: 7040COMMON

Executed Functions

Function 026C62A3 Relevance: 4.1, Strings: 3, Instructions: 354COMMON

Download Yara Rule

Strings

$^q, xrefs: 026C683E
Xbq, xrefs: 026C62C7
Xbq, xrefs: 026C6857

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$$^q
API String ID: 0-3405775106
Opcode ID: 7b560292e478e931953e0d23bf166fd72195f66fe39f2e260c1f832bef1ebf56
Instruction ID: 080020cc72f8f051f0fa6954ff7251991e38c35f00df08c0a8ad1f7c8971da39
Opcode Fuzzy Hash: 7b560292e478e931953e0d23bf166fd72195f66fe39f2e260c1f832bef1ebf56
Instruction Fuzzy Hash: DFC1CF74B042588BDB18AFB8985427E7FBBFFC5700B18C46ED84AD7395DE34880687A5

Function 026CB5D8 Relevance: 5.2, Strings: 4, Instructions: 242COMMON

Download Yara Rule

Strings

$^q, xrefs: 026CB6D8
C\Ep^, xrefs: 026CB697
xbq, xrefs: 026CB665
$^q, xrefs: 026CB6E4

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: xbq$$^q$$^q$C\Ep^
API String ID: 0-1370529950
Opcode ID: aea75958bece0b74ae66186cecfdba358ee6bb2abb5f3138a73ceaf9670b0961
Instruction ID: 84c7d02c7def0c0e21b6001817ec288c705666158474ed943c45215342bd59e1
Opcode Fuzzy Hash: aea75958bece0b74ae66186cecfdba358ee6bb2abb5f3138a73ceaf9670b0961
Instruction Fuzzy Hash: FC917E347116149FCB09EB78D454B2E77E3EB88315F2084ADE80A9B3A8DF359C52CB91

Function 026CB645 Relevance: 4.0, Strings: 3, Instructions: 223COMMON

Download Yara Rule

Strings

$^q, xrefs: 026CB6D8
C\Ep^, xrefs: 026CB697
xbq, xrefs: 026CB665

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: xbq$$^q$C\Ep^
API String ID: 0-9597767
Opcode ID: 9994d1d717025c94963f49a043286def41efafeb5e80264f5ebb8789bbfa2fca
Instruction ID: 29f45954231dc75796a7aa40a48fd90304c0826ff129e8d035a7efa577d9bcda
Opcode Fuzzy Hash: 9994d1d717025c94963f49a043286def41efafeb5e80264f5ebb8789bbfa2fca
Instruction Fuzzy Hash: 3E818B347116149FCB09FB78D454B2E77A3EB88315F2084ADE80A9B3A9DF359C52CB91

Function 026C57D0 Relevance: 2.8, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

nKvq, xrefs: 026C59C8
nKvq, xrefs: 026C59A9

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: nKvq$nKvq
API String ID: 0-2223595353
Opcode ID: 599c1b6b6cc2002611ce51f5df8c99677d7bb63ace58d2474c3c695414765d7b
Instruction ID: 617400dd347f9e4541d6166f22d0847d2cb4748b714127ad016ff443f0487ecc
Opcode Fuzzy Hash: 599c1b6b6cc2002611ce51f5df8c99677d7bb63ace58d2474c3c695414765d7b
Instruction Fuzzy Hash: DEC17275E006168FCB18DF68C8919AEBBB2FF88310B258649DD456B355DB30FC86CB90

Function 026C57BF Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

nKvq, xrefs: 026C59C8
nKvq, xrefs: 026C59A9

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: nKvq$nKvq
API String ID: 0-2223595353
Opcode ID: 17f4ad18218acfd8c128298774bfd588de2cbf4d40062841236b0f6aa6a59345
Instruction ID: e666a1e6630a8a24c2495b54b5d0c74c09516f91df8b21b315200b569e1caf12
Opcode Fuzzy Hash: 17f4ad18218acfd8c128298774bfd588de2cbf4d40062841236b0f6aa6a59345
Instruction Fuzzy Hash: F2B11B75E006168FCB18DF58C8919AEB7B2FF88310B258659ED45AB355DB30FC86CB90

Function 026C6010 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

dbq, xrefs: 026C602B
dbq, xrefs: 026C6081

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: dbq$dbq
API String ID: 0-2758190078
Opcode ID: d1240339b065ab9b0dc8f4f89c0cd33951105ef76317c7b44df5d033cd6d91f0
Instruction ID: d229e049839eb51039ba7b73be76992bfb957d4204876040bc36feaef5448f9a
Opcode Fuzzy Hash: d1240339b065ab9b0dc8f4f89c0cd33951105ef76317c7b44df5d033cd6d91f0
Instruction Fuzzy Hash: 95513B74E11254DFCB04EFA8E9889ADBBF6FF88305B108469E406EB365DB319805CF51

Function 026CC2D8 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026CC34F

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: cfdf95a4313bd9bb6bc9ec182b3b772643afb088505d6d30da9544f20268b8f5
Instruction ID: 56d687c31ad76b4c870110cb75fa1d54d71a6cbc9661b3437c7adb407fe79de7
Opcode Fuzzy Hash: cfdf95a4313bd9bb6bc9ec182b3b772643afb088505d6d30da9544f20268b8f5
Instruction Fuzzy Hash: B2414A70B102149FDB18EB69D894B6DB7E6EF88714F2480AAE505EB3A1DB71DC41CB90

Function 026C6000 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

dbq, xrefs: 026C602B

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: dbq
API String ID: 0-1887291361
Opcode ID: 23b600f73c842c944eb8b30f09018929fcea8412316897fab3dafa377e2fac4d
Instruction ID: 5d7b4b77cdcc4f80c7a1a52d2d9933501ce36bba0189812b6241de40151cb11c
Opcode Fuzzy Hash: 23b600f73c842c944eb8b30f09018929fcea8412316897fab3dafa377e2fac4d
Instruction Fuzzy Hash: AF514A78E11255CFCB04EFA8E98896CBBF6FF89305B2085A9E406DB365DB319905CF50

Function 026C132D Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

XPrq, xrefs: 026C1334

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID: XPrq
API String ID: 0-2034928703
Opcode ID: 13eb290df96c1772576405ddd6b52888a725fd0b054e84ca1b4ba0cb79667c8f
Instruction ID: 4e21500b3bdd887ee5dbf4ceb55d7de46945aa43b9098a3c1fce1356c3e21a47
Opcode Fuzzy Hash: 13eb290df96c1772576405ddd6b52888a725fd0b054e84ca1b4ba0cb79667c8f
Instruction Fuzzy Hash: 3D11D671A083498FCB05EB68D4506BEBBB1EF87314B2580AAD408DB352EB309D06C7D5

Function 026C0D37 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa901188ac3e7a42654f29f5deb7725960f30a55b96d8ebe00f17c0559d81539
Instruction ID: 25f3f390f5458793d838be89c0a460a32bb51bd93e267add7503740d849c18c7
Opcode Fuzzy Hash: fa901188ac3e7a42654f29f5deb7725960f30a55b96d8ebe00f17c0559d81539
Instruction Fuzzy Hash: 1F81D3705023568FCB06FF68EC50AAD7BB1FB85301B1049A9E0459B3B9DB74295ACFA1

Function 026C6CC8 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea53d7f50b12762615a564bb6524c7ed6392615b1127a303e9de814281b706fc
Instruction ID: e7c80a075ac2f00a4cc974e8ea6f3c5da84b675bd15cca5bd8ac741a83171699
Opcode Fuzzy Hash: ea53d7f50b12762615a564bb6524c7ed6392615b1127a303e9de814281b706fc
Instruction Fuzzy Hash: 7E51F371A002158FCB18AF7DC8942BE7BF6EFC9204B24846EC409DB395EB359C42CB95

Function 026C0DB0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1892135b99acc7385ede655ab751139000cfe9aafd7006f9ffa384c1be5a6a96
Instruction ID: d7d7f1be880712861588e0a11d0abcc82da4b7054aecc2e194bdffd8532c5368
Opcode Fuzzy Hash: 1892135b99acc7385ede655ab751139000cfe9aafd7006f9ffa384c1be5a6a96
Instruction Fuzzy Hash: 3B517374601716DFCB09FF69EC54AAD7BB2FB84301B0049A9E00597378DBB42956CFA1

Function 026C52E1 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b866689d4023f2edf84b9cc7a64727e676fab10d0e29f845806cd3cb0cb9a0b2
Instruction ID: 5b4e7dbceed03a4a7c729ec31abc6dd30ca804ae69e0d8239cc131ea8cd61ca6
Opcode Fuzzy Hash: b866689d4023f2edf84b9cc7a64727e676fab10d0e29f845806cd3cb0cb9a0b2
Instruction Fuzzy Hash: 654139B0D003498FCB10EFA9D944AAEBBF5FF89710F60452DD44AB7381E77469058B61

Function 026CA528 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332163d935e81805b7f3bebed771d6799c5623801bfb07e14043a881e331e42b
Instruction ID: 6e3f0c932faf3f3b083f9a406e2190a9689fc20984b5b42378b88214c08785a8
Opcode Fuzzy Hash: 332163d935e81805b7f3bebed771d6799c5623801bfb07e14043a881e331e42b
Instruction Fuzzy Hash: F6512075A00609CFCB14EF68C4849AABBF5FF88310B14C669D809DB345EB74E955CFA0

Function 026C9638 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f6e730b6fd9864e04e371e141776007aed64b43e1088a829cd5b8c13606804a
Instruction ID: d7e7c04ac780f90864878fc2f6e26a385acf34e0338b882baa7180675f9dca54
Opcode Fuzzy Hash: 6f6e730b6fd9864e04e371e141776007aed64b43e1088a829cd5b8c13606804a
Instruction Fuzzy Hash: BE41D47460A3908FD706EF38C454A657BA1EF97304B1484EEE145CF6A7EB64DC0ACBA1

Function 026CADD0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12af5197df13f6a2ded0c2d9249557316558fa41d9237f74002cf0b6cea28c2a
Instruction ID: 3c883066abcd46041af12d315d71e77f3f9496966ee021e7c60530daf913654d
Opcode Fuzzy Hash: 12af5197df13f6a2ded0c2d9249557316558fa41d9237f74002cf0b6cea28c2a
Instruction Fuzzy Hash: 7C419B78A80744CFE705DF65E448BAA7BBAFB49305F108879E9018B3C5DB309929CF60

Function 026C96C8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0260fba666453702a18bf3e298edf46b80844880603e0b98fc5e193e30f49a34
Instruction ID: e49c149745592a93e252b3fbce9a3f8d10fa83b0ab1fd24178b822112b7bfb66
Opcode Fuzzy Hash: 0260fba666453702a18bf3e298edf46b80844880603e0b98fc5e193e30f49a34
Instruction Fuzzy Hash: C7319E786012149FC704FF28C454A6A77A6FFC5705F548969E10A8F3A9EFB1EC05CBA0

Function 026C559C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940d6135a004c8c35a442dea3e0a98ad6ec261f1da613c3ba5900b46939524d8
Instruction ID: b9533adb0e0524fff08f761e53b985300956ec6fa02ab7745a858d2075a8e8dc
Opcode Fuzzy Hash: 940d6135a004c8c35a442dea3e0a98ad6ec261f1da613c3ba5900b46939524d8
Instruction Fuzzy Hash: 9A41E2B1D00309CBDB14EFA9C984AEDBBB5FF48304F648429D409BB254D7756A46CF90

Function 026C55A8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cdfe366fdf0e8558d7cf885f8ab2b0a1c48b98f2204557c85f722cd1d982f9
Instruction ID: 46527e9e6d4821cd0d3d92837400c7bb2a70c01ceac3f409ffa208e66554a3fa
Opcode Fuzzy Hash: 50cdfe366fdf0e8558d7cf885f8ab2b0a1c48b98f2204557c85f722cd1d982f9
Instruction Fuzzy Hash: 0F41B0B1D003098BDB14EFAAC984ADEBBB5AF49304F648029D409BB255D7756A45CF90

Function 026C96A8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c79c05016045badd7b522fd02ca32de97707051df8894014f57b722f41d155
Instruction ID: 114c2d15a7fded2b94eb01b98c20f3534c9da71cd2720116ed01897662df2eac
Opcode Fuzzy Hash: a6c79c05016045badd7b522fd02ca32de97707051df8894014f57b722f41d155
Instruction Fuzzy Hash: A531C1342052509FC706EF38C454A697BE2EF82704F1488ADE049CF3A6DB71EC0ACBA1

Function 026C1418 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a977c17cfd29ffa45770a5a144bada0bd10516278372b3c531d43f286b4a51
Instruction ID: 1d314d6c5212064a700e795476fc9559cac64f2a88358b5af002c72c6f77885b
Opcode Fuzzy Hash: e0a977c17cfd29ffa45770a5a144bada0bd10516278372b3c531d43f286b4a51
Instruction Fuzzy Hash: 7011C271A0464A8FCB05EB68D4506BEBBB1EF87310B1181AAD408DB352EB30DD01CBD1

Function 026C5490 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446a66e903e469829b35ba5ba8201e97afcc3ff8361bfdf775954d18f30d497e
Instruction ID: 1a64aab5ed272dbbea4febe84b48c4438b699dbcfa754c240d55f32a1af216f0
Opcode Fuzzy Hash: 446a66e903e469829b35ba5ba8201e97afcc3ff8361bfdf775954d18f30d497e
Instruction Fuzzy Hash: 1931D975A043458FC701EF78C8045AABBE6EFD5314795C8ADD00AEB751EB71EC098BA1

Function 026CA348 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3897b9875999202d54ebff0af2acedef6e30584add7a703944167a1d5497ff47
Instruction ID: 994949ea4b965ca26cac515efbc0007b850e5b83825bed39cf95b7f11671747f
Opcode Fuzzy Hash: 3897b9875999202d54ebff0af2acedef6e30584add7a703944167a1d5497ff47
Instruction Fuzzy Hash: EB210436A042588FCB009FA9D894AEEBFF5EF88220F38815AE454D7252C735DC12DB60

Function 026C161C Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b020e433d95058596f15c2f95e484843756139a08b109ddf14cb52d636813196
Instruction ID: 4cc8a5fa4aeaec208ba446554733a0e17f35bef9f0db241793b6e05da1ee2823
Opcode Fuzzy Hash: b020e433d95058596f15c2f95e484843756139a08b109ddf14cb52d636813196
Instruction Fuzzy Hash: 6631F2B0D012489FDB24EF99D588B9EBBF5EF49310F248069E408AB351CB74A945CBA0

Function 026C14F4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bff977e602853685acbca9d4f3b30952f75f818c3dfd61f8b8136a3676f57bf6
Instruction ID: 494ece20f71a7a00febd843c0139217b27b76ceb12bc4eb8b0b58172ea2cfb71
Opcode Fuzzy Hash: bff977e602853685acbca9d4f3b30952f75f818c3dfd61f8b8136a3676f57bf6
Instruction Fuzzy Hash: 743101B0D012489FDB14EF98D584BADBBF5EF49300F248069E409BB3A5CB74A945CFA1

Function 026C13C5 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a30cfc4d2ef01c558af8e9a5bd376b8b23c4b974cd9229c4eaefd53a51b41c
Instruction ID: 995ff8fdf8ab2ab25a4b5b351e2a1d9996530c495c53efd3727159fc605d8772
Opcode Fuzzy Hash: 37a30cfc4d2ef01c558af8e9a5bd376b8b23c4b974cd9229c4eaefd53a51b41c
Instruction Fuzzy Hash: D611E271A0838A8FCB02EB68D4106BEBFB1EF87310B1581EAC448DB352E7309D05C7A1

Function 026C1628 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c30584f4f8098b6afa5eba4696accf3311cba66f2b37642f05589466921e8a
Instruction ID: 3c142273e3b4e14f955b453ebb65128ab908240f6bf46cca9becb6519b86dc80
Opcode Fuzzy Hash: 25c30584f4f8098b6afa5eba4696accf3311cba66f2b37642f05589466921e8a
Instruction Fuzzy Hash: 4E31E1B0D012489FDB24EF99D584B9DBFF5EF49310F248069E409BB355CB74A949CBA0

Function 00D8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4166763108.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d8d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2acbc8a75ba7a8668ec88e107a4b00da47d921838bbdb97621387d82a211fc7
Instruction ID: 0580d47bdd07e4586f757dbaa9a0eda1f822f82f99f437385d0420156a1327e4
Opcode Fuzzy Hash: f2acbc8a75ba7a8668ec88e107a4b00da47d921838bbdb97621387d82a211fc7
Instruction Fuzzy Hash: F1210471604204AFCB10EF14D9C4B26BBA6FB94324F24C569D8490B2C1C33AD847CB72

Function 00D8D1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4166763108.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d8d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20bdae816542e9fa65e2b12b34e39c95928043f13680c96d6cadd5c8f13b459a
Instruction ID: d4d1f5e7ec769ad823c21493ddb39483eb1e3f4e131be27a0016810c5147c8a1
Opcode Fuzzy Hash: 20bdae816542e9fa65e2b12b34e39c95928043f13680c96d6cadd5c8f13b459a
Instruction Fuzzy Hash: E621F5B5604304AFDB04EF14D5C4B26BBA6FB94314F24CA6DD84A4B2C6C736D806CB71

Function 026C1500 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de56c5e8de45daaf2745fb160b83b24ff0e2219c462979f1e8ef41f21b77f64
Instruction ID: 0e48c0d2a95dfbaec5e1bc95f144a8e3b691877a900b22746bd25a7c8eb25035
Opcode Fuzzy Hash: 9de56c5e8de45daaf2745fb160b83b24ff0e2219c462979f1e8ef41f21b77f64
Instruction Fuzzy Hash: B231EFB0D012489FDB14DFA9C584B9DBBF5EF49310F248069E409AB355CB74A945CB94

Function 026C13D5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1efc52a663a5f4dd3e35cc14ee4fb71ea44dd8e0a57db851560b164ee68e3812
Instruction ID: 0e0b5516b72ae948fd87c094faa7f351c677909e95aef2f82463bed0458b5e52
Opcode Fuzzy Hash: 1efc52a663a5f4dd3e35cc14ee4fb71ea44dd8e0a57db851560b164ee68e3812
Instruction Fuzzy Hash: 2C11B271A0934A8FCB06EB68D4506BEBFB5EF87310B1581EAC449DB352E7309D05C7A1

Function 00D8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4166763108.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d8d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cd355172c118af9de3d1ca3cbe6d91db4e982bc83c1944bc5dd3f0e7537be8
Instruction ID: 45eedba1f64b111f71880631d247a6b82fec3d5ad71324a051dadb5c5b6f7d07
Opcode Fuzzy Hash: 50cd355172c118af9de3d1ca3cbe6d91db4e982bc83c1944bc5dd3f0e7537be8
Instruction Fuzzy Hash: 272192755093C08FCB12DF20D994715BF71EB46314F29C1EAD8898B6D3C33A980ACB62

Function 026C13E5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a43cbb1566ef6b8a17809d0046e9a6d3d1fb77f775e318708f084f25fd6ac2
Instruction ID: 86aa31848eead0d2c0aa91e5082468e56fe2a3a0ce857c64bbf5a3cec81a3479
Opcode Fuzzy Hash: 55a43cbb1566ef6b8a17809d0046e9a6d3d1fb77f775e318708f084f25fd6ac2
Instruction Fuzzy Hash: 0011B271A0824A9FCB06EB68D4506BEBFB1EF87314B2581AAD448DB352DB309905C796

Function 026CADE0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d826caf1c29ae0a15336ff4b819360548695432399d19ef39d07492e33abef7
Instruction ID: a205c67fc7ebe5f11975c5c991bc471fe21d5548cbc7b10413fe0a965c375680
Opcode Fuzzy Hash: 3d826caf1c29ae0a15336ff4b819360548695432399d19ef39d07492e33abef7
Instruction Fuzzy Hash: 3621E93CAC1650CFE305AF21E54CA6937AAF789705F10C879AE114B7C8DB749929CF20

Function 026CB078 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daac47e9076205eb6c8acab9080d6e701ef4ccd4ee2b6448349ea459e5c26355
Instruction ID: 277700c922f8dc4fe8d2b5cef5979776c57d605b5ecce49e30f4b49617e00ca0
Opcode Fuzzy Hash: daac47e9076205eb6c8acab9080d6e701ef4ccd4ee2b6448349ea459e5c26355
Instruction Fuzzy Hash: 9811363060A7D49FCB039B28D4545AABFB0EF86310B1540ABE9409B392C7749815CB90

Function 00D8D1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4166763108.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d8d000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 61d051ba3cbba0ad7ba32b2062b0edca58b52d3c80a7f0037abb3adc765d7da7
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 6311DD75904280DFDB01DF14D5C4B15BBB2FB88324F28C6ADD8094B296C33AD80ACB61

Function 026CA6B0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97c6930c59c1b00f0318f620db214bbd7c87c9046a57fe5696cd0a36e89d0ae
Instruction ID: f96d9b060fbd9bcc564cc9d0a6259e57b36e87eb72f235543d1bc5f52ef1a578
Opcode Fuzzy Hash: a97c6930c59c1b00f0318f620db214bbd7c87c9046a57fe5696cd0a36e89d0ae
Instruction Fuzzy Hash: DD014471A101449FDB45EF75D8885BABBF6EBD4314738C4AAD40CCB256DA34C946CB60

Function 026CA2AF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e780241f56bc08247d1cad249482dc71c8ea8e6b506fa2c40b8bc0d614d07a79
Instruction ID: 01870fe569b59b193d629c11c38f1c2c075c04361730a3ceca269827d6035b26
Opcode Fuzzy Hash: e780241f56bc08247d1cad249482dc71c8ea8e6b506fa2c40b8bc0d614d07a79
Instruction Fuzzy Hash: 7D111B35901209DFDB10DFAAC4949AEBFF5EF4D220F248199E958AB361CB309D40CBA4

Function 026CA2B8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de1660cf00ca24521b19862c8d8257b9f9c4fd529622153c557783c5ae96ee21
Instruction ID: 10a17cc4ea88fdfe069dab096f14f94b776b91e6a58e04481d4a150835849ddf
Opcode Fuzzy Hash: de1660cf00ca24521b19862c8d8257b9f9c4fd529622153c557783c5ae96ee21
Instruction Fuzzy Hash: 3E010875A00209DFDB10DFAAC4949AEBBF5EF4D320F24C159E929A7361CA309D40DFA4

Function 026C7148 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bbb94eab97015d0f0957f4723830656bf90e53bce05cc7f77a8d8006c774dc
Instruction ID: db369469929feaff05db04454c430486068117e2d73c21695e6a322e8a00c4e6
Opcode Fuzzy Hash: f4bbb94eab97015d0f0957f4723830656bf90e53bce05cc7f77a8d8006c774dc
Instruction Fuzzy Hash: 37F02B3AB4053007C315AEACA4043BEB78DD7816A8F1DC06EE64DDBBC5E661DC164BE0

Function 026CA398 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931a30f49553aa280df22e51169dcaa5fbaa5dc7ca127fd5e0843a44eaef9e85
Instruction ID: 81c4161932f2eb61533e6410f182a480822294ab1c38e3c6ee52cd94e1db6c98
Opcode Fuzzy Hash: 931a30f49553aa280df22e51169dcaa5fbaa5dc7ca127fd5e0843a44eaef9e85
Instruction Fuzzy Hash: BAF02BB77041505FC3015F6DD854866BFE9EFD926131940ABF609CB362EA71EC15C760

Function 026CACA0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930d709d287b601542d8f1a326ef2c8e2f51ab2a42e3172462304d7226a3844c
Instruction ID: db7bbd6adcc9111e3fca7328031895c03269777d27e52b0c0dd1799d0d1e5eaa
Opcode Fuzzy Hash: 930d709d287b601542d8f1a326ef2c8e2f51ab2a42e3172462304d7226a3844c
Instruction Fuzzy Hash: DBF027342046949FDB03BFA9C80876A3F96EF82314B6448E5EB458F296D921DC2687C1

Function 026C5438 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3962db36f2a5275f83fb6484ab8792c1d8d2a2dacd6cd28c012277b0086e7276
Instruction ID: eb3a02e42acaabb2fd77a3cc5341d00abf50b75afdc3dd27caaa8fe5108c6f20
Opcode Fuzzy Hash: 3962db36f2a5275f83fb6484ab8792c1d8d2a2dacd6cd28c012277b0086e7276
Instruction Fuzzy Hash: 29F0A771546604EFC701EFA8DD0086DBBB6EB8A30176085DAE805D7351EB305E109B71

Function 026C713B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6087c09c61395401278708888e2cb26e2fe28f812e655dcb7f2a91d6a13d1a8
Instruction ID: 4ffa6f94aedc32a13d8c17cc703077c4daa4850b3524e0657f8b08508a9e0120
Opcode Fuzzy Hash: e6087c09c61395401278708888e2cb26e2fe28f812e655dcb7f2a91d6a13d1a8
Instruction Fuzzy Hash: 84F020346082A05FC3139F6890082697FAEDF47648B0E80D9D988CFBC7C321E8568BE1

Function 026CA358 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ac742ff112b1285e0a32b47b48e513ec8fbfc0f2dd45848c4019fce3845042
Instruction ID: e7730277865b9e4f8c14d1498c11be81fa3f626b4938cfd3e0d26285f52b2d06
Opcode Fuzzy Hash: 30ac742ff112b1285e0a32b47b48e513ec8fbfc0f2dd45848c4019fce3845042
Instruction Fuzzy Hash: 1AE04F7A7005205BC3049F5EE848D5BBBEEEBCD760715812AF609C7361D9B2EC158BB0

Function 026CACB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f03e56bd015c63cae1052f9b517b58b56479f0fd80b9f2834d26c45e386aa4a
Instruction ID: c5071afb14b012e2a21f9f70bb08166bd6a0c1479a8594477fcf2e56df74f4a5
Opcode Fuzzy Hash: 0f03e56bd015c63cae1052f9b517b58b56479f0fd80b9f2834d26c45e386aa4a
Instruction Fuzzy Hash: AAE0C2393001549BDB01B76AD808A1A3B5BEB8535CF058064E60A8B284DA36D8359BD5

Function 026C5448 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4167015486.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8c08ab411099c7542ecad4eec0211be3fee4dfc20555b2ec4f148278057c9e
Instruction ID: 693a766d644631e3b70ef325df19821c3dc37d70612a108b4e4406dfb444fb2a
Opcode Fuzzy Hash: 6b8c08ab411099c7542ecad4eec0211be3fee4dfc20555b2ec4f148278057c9e
Instruction Fuzzy Hash: 9FE04F74A02208EFC700FFA4E90145CBBB6EB493017108595EC0893314DB311F209BA1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report build.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log

C:\Users\user\AppData\Roaming\fOWeBGYAp\TxTKzZWFO.exe

C:\Users\user\AppData\Roaming\temp0923

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
build.exe

Function 009D2F70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMON

Function 009D264E Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 339
processCOMMON

Function 009D2658 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 337
processCOMMON

Function 009D2F69 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
COMMON

Function 009D22D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Function 009D22C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 115
injectionCOMMON

Function 009D2421 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107
COMMON

Function 009D2428 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
COMMON

Function 009D21B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Function 009D21A9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100
memoryCOMMON

Function 009D2081 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
threadCOMMON

Function 009D2088 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadCOMMON

Function 009D1228 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
threadCOMMON

Function 009D1230 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73
threadCOMMON

Function 009D04DC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre