Edit tour

Windows Analysis Report
6foBmRMlDy.exe

Overview

General Information

Sample name:	6foBmRMlDy.exe renamed because original name is a hash value
Original sample name:	e4352f63724267bed81e8c199bd8ca0f.exe
Analysis ID:	1531711
MD5:	e4352f63724267bed81e8c199bd8ca0f
SHA1:	ce9c69ca36920f076fe1369be4d9001085ca8602
SHA256:	5ffda142aa321a2b5546c426a28403d7f19b51b88985c8617f11c04411489e30
Tags:	32exe
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

6foBmRMlDy.exe (PID: 3180 cmdline: "C:\Users\user\Desktop\6foBmRMlDy.exe" MD5: E4352F63724267BED81E8C199BD8CA0F)

cmd.exe (PID: 5480 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqbqwogt\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2924 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnmlavab.exe" C:\Windows\SysWOW64\gqbqwogt\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5644 cmdline: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3916 cmdline: "C:\Windows\System32\sc.exe" description gqbqwogt "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3472 cmdline: "C:\Windows\System32\sc.exe" start gqbqwogt MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1808 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 772 MD5: C31336C1EFC2CCB44B4326EA793040F2)

lnmlavab.exe (PID: 5840 cmdline: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d"C:\Users\user\Desktop\6foBmRMlDy.exe" MD5: 415D8A2F273DA3EB07A38C1E95C0BB82)

svchost.exe (PID: 6812 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6852 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 568 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3984 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5440 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 712 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3180 -ip 3180 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 6932 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xfd1d:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xfd95:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: 6foBmRMlDy.exe PID: 3180	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: lnmlavab.exe PID: 5840	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6812	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.6foBmRMlDy.exe.630000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.6foBmRMlDy.exe.630000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.lnmlavab.exe.dd0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.lnmlavab.exe.dd0000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.dd0000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.6foBmRMlDy.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.6foBmRMlDy.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.6foBmRMlDy.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.6foBmRMlDy.exe.600e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.6foBmRMlDy.exe.600e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.lnmlavab.exe.d70e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.d70e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.lnmlavab.exe.dd0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.lnmlavab.exe.dd0000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.dd0000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.6foBmRMlDy.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.6foBmRMlDy.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.6foBmRMlDy.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.lnmlavab.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.lnmlavab.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.6foBmRMlDy.exe.600e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.6foBmRMlDy.exe.600e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.6foBmRMlDy.exe.600e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.6foBmRMlDy.exe.630000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.6foBmRMlDy.exe.630000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.6foBmRMlDy.exe.630000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.lnmlavab.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.lnmlavab.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.lnmlavab.exe.d70e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.lnmlavab.exe.d70e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.lnmlavab.exe.d70e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.lnmlavab.exe.d90000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.lnmlavab.exe.d90000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
13.2.svchost.exe.2be0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2be0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2be0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.lnmlavab.exe.d90000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.lnmlavab.exe.d90000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.lnmlavab.exe.d90000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
13.2.svchost.exe.2be0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.2.svchost.exe.2be0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
13.2.svchost.exe.2be0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d"C:\Users\user\Desktop\6foBmRMlDy.exe", ParentImage: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, ParentProcessId: 5840, ParentProcessName: lnmlavab.exe, ProcessCommandLine: svchost.exe, ProcessId: 6812, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\6foBmRMlDy.exe", ParentImage: C:\Users\user\Desktop\6foBmRMlDy.exe, ParentProcessId: 3180, ParentProcessName: 6foBmRMlDy.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 5644, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 6812, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d"C:\Users\user\Desktop\6foBmRMlDy.exe", ParentImage: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, ParentProcessId: 5840, ParentProcessName: lnmlavab.exe, ProcessCommandLine: svchost.exe, ProcessId: 6812, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 6812, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gqbqwogt

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\6foBmRMlDy.exe", ParentImage: C:\Users\user\Desktop\6foBmRMlDy.exe, ParentProcessId: 3180, ParentProcessName: 6foBmRMlDy.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 5644, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3984, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6foBmRMlDy.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\lnmlavab.exe

Avira: detection malicious, Label: HEUR/AGEN.1307867

Found malware configuration

Source: 12.3.lnmlavab.exe.d90000.0.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\lnmlavab.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 6foBmRMlDy.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Unpacked PE file: 0.2.6foBmRMlDy.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Unpacked PE file: 12.2.lnmlavab.exe.400000.0.unpack

Source: 6foBmRMlDy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\gqbqwogt

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.71.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.106 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.228.234.180 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 67.195.228.106 67.195.228.106
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US
Source: Joe Sandbox View	ASN Name: ITOS-ASRU ITOS-ASRU
Source: Joe Sandbox View	ASN Name: MAILRU-ASMailRuRU MAILRU-ASMailRuRU

Source: global traffic	TCP traffic: 192.168.2.6:49711 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.6:61283 -> 67.195.228.106:25
Source: global traffic	TCP traffic: 192.168.2.6:61403 -> 74.125.71.27:25
Source: global traffic	TCP traffic: 192.168.2.6:61476 -> 217.69.139.150:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61479
Source: unknown	Network traffic detected: HTTP traffic on port 61479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6foBmRMlDy.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lnmlavab.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6812, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.6foBmRMlDy.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.6foBmRMlDy.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.6foBmRMlDy.exe.600e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.6foBmRMlDy.exe.600e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.d70e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.d70e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.lnmlavab.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.lnmlavab.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\gqbqwogt\

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_00445C78	0_2_00445C78
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0044780B	0_2_0044780B
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_00447D4F	0_2_00447D4F
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0043F5CB	0_2_0043F5CB
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_004491A8	0_2_004491A8
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_004472C7	0_2_004472C7
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00445C78	12_2_00445C78
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0044780B	12_2_0044780B
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00447D4F	12_2_00447D4F
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0043F5CB	12_2_0043F5CB
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_004491A8	12_2_004491A8
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_004472C7	12_2_004472C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02BEC913	13_2_02BEC913

Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: String function: 0043FB94 appears 36 times
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: String function: 006027AB appears 35 times
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: String function: 0043FB94 appears 36 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840

Source: 6foBmRMlDy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.3.6foBmRMlDy.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.6foBmRMlDy.exe.630000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.6foBmRMlDy.exe.600e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.6foBmRMlDy.exe.600e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.d70e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.d70e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.lnmlavab.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.lnmlavab.exe.d90000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: 6foBmRMlDy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@32/3@9/5

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_006B1DC3 CreateToolhelp32Snapshot,Module32First,

0_2_006B1DC3

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02BE9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02BE9A6B

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:712:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5440:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3224:120:WilError_03

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

File created: C:\Users\user\AppData\Local\Temp\lnmlavab.exe

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: k\`	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: ^ohJ	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: ?zEo	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: k3nU	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: 0ugV	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: IfoB	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: Z1S9	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: $&s	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: p7~	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: /H;+	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: C:7C	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: kd@9	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: agYU	0_2_0043B240
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Command line argument: \|%FH	0_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: k\`	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: ^ohJ	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: ?zEo	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: k3nU	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: 0ugV	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: IfoB	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: Z1S9	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: $&s	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: p7~	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: /H;+	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: C:7C	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: kd@9	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: agYU	12_2_0043B240
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Command line argument: \|%FH	12_2_0043B240

Source: 6foBmRMlDy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

File read: C:\Users\user\Desktop\6foBmRMlDy.exe

Jump to behavior

Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_12-21867
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_0-21759

Source: unknown	Process created: C:\Users\user\Desktop\6foBmRMlDy.exe "C:\Users\user\Desktop\6foBmRMlDy.exe"
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqbqwogt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnmlavab.exe" C:\Windows\SysWOW64\gqbqwogt\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description gqbqwogt "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start gqbqwogt
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d"C:\Users\user\Desktop\6foBmRMlDy.exe"
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 568
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3180 -ip 3180
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 772
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqbqwogt\	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnmlavab.exe" C:\Windows\SysWOW64\gqbqwogt\	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description gqbqwogt "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start gqbqwogt	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 568	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3180 -ip 3180	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 772	Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 6foBmRMlDy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 6foBmRMlDy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Unpacked PE file: 0.2.6foBmRMlDy.exe.400000.0.unpack .text:ER;.data:W;.tuh:R;.kovaxe:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Unpacked PE file: 12.2.lnmlavab.exe.400000.0.unpack .text:ER;.data:W;.tuh:R;.kovaxe:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Unpacked PE file: 0.2.6foBmRMlDy.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Unpacked PE file: 12.2.lnmlavab.exe.400000.0.unpack

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: 6foBmRMlDy.exe	Static PE information: section name: .tuh
Source: 6foBmRMlDy.exe	Static PE information: section name: .kovaxe

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0043D4C3 push ecx; ret	0_2_0043D4D6
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0043FBD9 push ecx; ret	0_2_0043FBEC
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0043D4C3 push ecx; ret	12_2_0043D4D6
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0043FBD9 push ecx; ret	12_2_0043FBEC

Source: 6foBmRMlDy.exe

Static PE information: section name: .text entropy: 7.003526634718541

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	File created: C:\Users\user\AppData\Local\Temp\lnmlavab.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gqbqwogt

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support"

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\svchost.exe

File deleted: c:\users\user\desktop\6fobmrmldy.exe

Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

13_2_02BE199C

Source: C:\Windows\SysWOW64\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_13-7595

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_13-6131

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_13-7318

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-21774
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-21882

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	API coverage: 5.6 %
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	API coverage: 4.2 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 4876	Thread sleep count: 41 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4876	Thread sleep time: -41000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

0_2_00401D96

Source: svchost.exe, 0000000D.00000002.3361932502.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	API call chain: ExitProcess graph end node			graph_0-22230
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	API call chain: ExitProcess graph end node			graph_12-22173

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe

Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep

graph_13-7483

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_0060092B mov eax, dword ptr fs:[00000030h]	0_2_0060092B
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_00600D90 mov eax, dword ptr fs:[00000030h]	0_2_00600D90
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_006B16A0 push dword ptr fs:[00000030h]	0_2_006B16A0
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_0073C628 push dword ptr fs:[00000030h]	12_2_0073C628
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00D70D90 mov eax, dword ptr fs:[00000030h]	12_2_00D70D90
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00D7092B mov eax, dword ptr fs:[00000030h]	12_2_00D7092B

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02BE9A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	13_2_02BE9A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.125.71.27 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.106 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.228.234.180 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2BE0000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2BE0000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2BE0000			Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2CC3008			Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqbqwogt\	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnmlavab.exe" C:\Windows\SysWOW64\gqbqwogt\	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description gqbqwogt "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start gqbqwogt	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 568	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3180 -ip 3180	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 772	Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

0_2_00407809

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\6foBmRMlDy.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6foBmRMlDy.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lnmlavab.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6812, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.dd0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6foBmRMlDy.exe.600e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.6foBmRMlDy.exe.630000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.lnmlavab.exe.d70e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.lnmlavab.exe.d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.2be0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6foBmRMlDy.exe PID: 3180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lnmlavab.exe PID: 5840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6812, type: MEMORYSTR

Source: C:\Users\user\Desktop\6foBmRMlDy.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_02BE88B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	13_2_02BE88B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	412 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6foBmRMlDy.exe	100%	Avira	HEUR/AGEN.1307867
6foBmRMlDy.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\lnmlavab.exe	100%	Avira	HEUR/AGEN.1307867
C:\Users\user\AppData\Local\Temp\lnmlavab.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	217.69.139.150	true	true	unknown
mta5.am0.yahoodns.net	67.195.228.106	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	unknown
vanaheim.cn	185.228.234.180	true	true	unknown
smtp.google.com	74.125.71.27	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true		unknown
jotunheim.name:443	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
74.125.71.27	smtp.google.com	United States	15169	GOOGLEUS	false
67.195.228.106	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
185.228.234.180	vanaheim.cn	Russian Federation	64439	ITOS-ASRU	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531711
Start date and time:	2024-10-11 16:35:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6foBmRMlDy.exe renamed because original name is a hash value
Original Sample Name:	e4352f63724267bed81e8c199bd8ca0f.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@32/3@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 268
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.112.250.133, 20.231.239.246, 20.236.44.162, 20.76.201.171, 20.70.246.20
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 6foBmRMlDy.exe

Simulations

Behavior and APIs

Time	Type	Description
10:36:45	API Interceptor	14x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.11.0	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse
67.195.228.106	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
	Update-KB6734-x86.exe	Get hash	malicious	Unknown	Browse
	Update-KB78-x86.exe	Get hash	malicious	Unknown	Browse
	DWVByMCYL8.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	HsWJJz7nq4.exe	Get hash	malicious	Tofsee Xmrig	Browse
	ac492e6a204784df07ef3841b3ae1f8a68b349db90a34.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
217.69.139.150	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
microsoft-com.mail.protection.outlook.com	OPgjjiInNK.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	52.101.11.9
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	52.101.42.0
mxs.mail.ru	OPgjjiInNK.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
mta5.am0.yahoodns.net	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
	file.exe	Get hash	malicious	Phorpiex	Browse	67.195.228.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MAILRU-ASMailRuRU	https://ok.me/KtdI1	Get hash	malicious	Unknown	Browse	217.20.155.6
	https://ok.me/KtdI1	Get hash	malicious	Unknown	Browse	217.20.156.11
	http://bk.ru	Get hash	malicious	HTMLPhisher	Browse	217.69.141.181
	OPgjjiInNK.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	8zzBr1gT31.elf	Get hash	malicious	Mirai	Browse	5.61.23.57
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	OuZGkt7xKK.exe	Get hash	malicious	Coinhive, Xmrig	Browse	178.237.20.50
MICROSOFT-CORP-MSN-AS-BLOCKUS	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://tzr7wtjq.r.us-east-1.awstrack.me/L0/https:%2F%2Fclickproxy.retailrocket.net%2F%3Furl=https%253A%252F%252Fneamunit.ro%2F%2Fwinners%2F%2Fnatalie.gilbert%2FbmF0YWxpZS5naWxiZXJ0QGJlbm5ldHRzLmNvLnVr/1/010001927b41f2f4-541067bc-8926-4dcb-8f02-24fcf186dd1a-000000/pqvbHhvZKuWAqkc2J1BWoU1pciA=395	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	kamilia.kaszowski-401(k) Statement-emailCapstonelogistics.eml	Get hash	malicious	HTMLPhisher	Browse	20.44.10.122
	https://tzr7wtjq.r.us-east-1.awstrack.me/L0/https:%2F%2Fclickproxy.retailrocket.net%2F%3Furl=https%253A%252F%252Fneamunit.ro%2F%2Fwinners%2F%2Fnatalie.gilbert%2FbmF0YWxpZS5naWxiZXJ0QGJlbm5ldHRzLmNvLnVr/1/010001927b41f2f4-541067bc-8926-4dcb-8f02-24fcf186dd1a-000000/pqvbHhvZKuWAqkc2J1BWoU1pciA=395	Get hash	malicious	HTMLPhisher	Browse	52.98.243.50
	https://tzr7wtjq.r.us-east-1.awstrack.me/L0/https:%2F%2Fclickproxy.retailrocket.net%2F%3Furl=https%253A%252F%252Fneamunit.ro%2F%2Fwinners%2F%2Fnatalie.gilbert%2FbmF0YWxpZS5naWxiZXJ0QGJlbm5ldHRzLmNvLnVr/1/010001927b41f2f4-541067bc-8926-4dcb-8f02-24fcf186dd1a-000000/pqvbHhvZKuWAqkc2J1BWoU1pciA=395	Get hash	malicious	HTMLPhisher	Browse	40.126.32.68
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	Mobile_App_Project_Details.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fwww.hudl.com%2Fnotifications-tracking%2Ftracker%2FBulkDownloadReady-6151bba290ef2e043c74df7a-6040b153-3f06-4375-9d9d-2976d6f1ac3e-11012597%2Femail%2Flanding%3Fforward%3Dhttps%3A%2F%2Fwww.google.com.sg%2Furl%3Fq%3Damp%2Fs%2Fhosxxrs.com%2F.drogo&data=eJxkkEGL3CAUgH-NcygY9Gl0hKZ0S2qZwy6l0_vyjCYja3RqEjL99yVLoYfeHu87vO99Q2ccBH2WmipgikqtkBrnJQUX8IxaCuHcyXcfTnP3UWnWniWEhmuGDIA1KI1yjVH-fH3--f3y8vrU91_71-fL9Xp5-fZ5fjRTKVMKzVDmT6eli3ksRLIB73FNAWuOeTrYqXZ-rZiJZG6LyYcJ39dbd1vX-0LEEwFLwO773tw2nw5IwOayxjEOuMaSF7pWHN5ingjY9zFUAvbLlt76sudU0P8I6H9TxVvuHIJhYYTApBi09KNGqphkjreCivFIIXRLjTeegtHKq5HjIALlnHFojSZgw4wxEbAJsz_OCjuWumP1RPT_a_8L0SyH4lYTEfYXET3OdwJ2IWBvZXk86vL3u8bXMpU_AQAA___Ij4KF#ask.gcr@zendesk.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	na.elf	Get hash	malicious	Mirai	Browse	20.108.4.35
	7hmGbJQzp5.xlam	Get hash	malicious	Hidden Macro 4.0	Browse	13.107.246.60
YAHOO-GQ1US	na.elf	Get hash	malicious	Mirai	Browse	98.137.186.231
	na.elf	Get hash	malicious	Unknown	Browse	98.139.117.51
	na.elf	Get hash	malicious	Mirai	Browse	98.137.77.120
	Remittance_Regulvar.htm	Get hash	malicious	Unknown	Browse	74.6.160.106
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	98.137.11.164
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	98.137.11.164
	27987136e29b3032ad40982c8b7c2e168112c9601e08da806119dcba615524b5.html	Get hash	malicious	Unknown	Browse	98.137.11.163
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	98.137.11.164
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	98.137.11.163
	https://content.app-us1.com/kd4oo8/2024/09/26/7d3453ba-0845-4df1-80a7-42d15e30f736.pdf	Get hash	malicious	HTMLPhisher	Browse	98.137.11.164
ITOS-ASRU	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.228.233.50
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.228.233.50
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.228.233.50
	PcWanHBSjp.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.187.174.250
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	193.187.173.86
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	193.187.173.86
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	193.187.173.86
	iVLDo46ao5.exe	Get hash	malicious	DCRat	Browse	193.187.172.13
	Cheat.Lab.2.7.0.msi	Get hash	malicious	Unknown	Browse	185.159.129.244
	file.exe	Get hash	malicious	RedLine	Browse	185.159.129.168

Process:	C:\Users\user\Desktop\6foBmRMlDy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12737536
Entropy (8bit):	3.8795853374092077
Encrypted:	false
SSDEEP:	3072:s/IcJg7uMwZi9VaiI2PLP7zIyMDWVYvVtKHpA6PYYNp/GG7Ig7LRACfij5+U/p49:uH0uMvGiI2PLgW4upRfJGuLmHsU
MD5:	415D8A2F273DA3EB07A38C1E95C0BB82
SHA1:	5623B0E9CB62A2F4D010AC199696CDFA39F4EB6A
SHA-256:	CE0247F5EF96C5172A41BB6C20601B5A659976C8E916D43B49D1453F0730460C
SHA-512:	03415DFAB3E50FB503CB0F8D8FDABBBF966FD4A6C0E4CF3DCB356836ABB06C68570015953AC955E7937702E1CCD948F8585A7765F76CED894DACD25834FD514E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.[.Y...Y...Y.......Y.......Y.......Y......Y...Y..cY.......Y.......Y.......Y..Rich.Y..........PE..L....Uhd..........................................@..........................p..........................................................`^...................P..........................................@............................................text.............................. ..`.data............`..................@....tuh................................@..@.kovaxe.............................@..@.rsrc...`^.......`..................@..@.reloc.......P.......d..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12737536
Entropy (8bit):	3.8795853374092077
Encrypted:	false
SSDEEP:	3072:s/IcJg7uMwZi9VaiI2PLP7zIyMDWVYvVtKHpA6PYYNp/GG7Ig7LRACfij5+U/p49:uH0uMvGiI2PLgW4upRfJGuLmHsU
MD5:	415D8A2F273DA3EB07A38C1E95C0BB82
SHA1:	5623B0E9CB62A2F4D010AC199696CDFA39F4EB6A
SHA-256:	CE0247F5EF96C5172A41BB6C20601B5A659976C8E916D43B49D1453F0730460C
SHA-512:	03415DFAB3E50FB503CB0F8D8FDABBBF966FD4A6C0E4CF3DCB356836ABB06C68570015953AC955E7937702E1CCD948F8585A7765F76CED894DACD25834FD514E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.[.Y...Y...Y.......Y.......Y.......Y......Y...Y..cY.......Y.......Y.......Y..Rich.Y..........PE..L....Uhd..........................................@..........................p..........................................................`^...................P..........................................@............................................text.............................. ..`.data............`..................@....tuh................................@..@.kovaxe.............................@..@.rsrc...`^.......`..................@..@.reloc.......P.......d..............@..B................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.461963871651088
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6foBmRMlDy.exe
File size:	426'496 bytes
MD5:	e4352f63724267bed81e8c199bd8ca0f
SHA1:	ce9c69ca36920f076fe1369be4d9001085ca8602
SHA256:	5ffda142aa321a2b5546c426a28403d7f19b51b88985c8617f11c04411489e30
SHA512:	afe8786dade10b520aeee40fc661d0f86b370e2c0272be3a462033cdc4b9cf91ddf8a2f2f6628c478da8736dbd7704d8da3b577c5afeb053db79dad1556c8bc4
SSDEEP:	3072://IcJg7uMwZi9VaiI2PLP7zIyMDWVYvVtKHpA6PYYNp/GG7Ig7LRACfij5+U/p49:HH0uMvGiI2PLgW4upRfJGuLmHsU
TLSH:	5394C012A2F1BC60D9268672CE1AF7F8762DF9308D59B75B330A672F18701E2D267351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.[.Y...Y...Y.......Y.......Y.......Y.......Y...Y..cY.......Y.......Y.......Y..Rich.Y..........PE..L....Uhd...................

File Icon


Icon Hash:	452145655545610d

Static PE Info

General

Entrypoint:	0x43d001
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6468550F [Sat May 20 05:05:19 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2a922b568f49098a9b670af5a77dc13f

Entrypoint Preview

Instruction
call 00007FB01D03CCE8h
jmp 00007FB01D037F7Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004012FCh
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FB01D03810Eh
test byte ptr [eax], 00000008h
je 00007FB01D038109h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040112Ch]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 0043D0C9h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007FB01D04448Ah

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x49cf8	0x8c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x15e60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0xd10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x49d84	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a6b8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x20c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x498ee	0x49a00	26f8f05186a7c73dd67ec955846d31ee	False	0.7278822686757216	data	7.003526634718541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4b000	0x119b8	0x6000	695085632ed5424d7fc7eb362c2702ab	False	0.08304850260416667	data	0.9867858225859076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tuh	0x5d000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.kovaxe	0x5e000	0xd6	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5f000	0x15e60	0x16000	126d04f38160694f408843d78c780868	False	0.44062943892045453	data	4.960422625060359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0x1c8e	0x1e00	744ce1cba9490ef09b39366b352f3b48	False	0.36940104166666665	data	3.7499768141825527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x72070	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x723a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x724f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x733a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x73c48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x5f7f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.36886993603411516
RT_ICON	0x5f7f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.36886993603411516
RT_ICON	0x60698	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4548736462093863
RT_ICON	0x60698	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4548736462093863
RT_ICON	0x60f40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.4596774193548387
RT_ICON	0x60f40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.4596774193548387
RT_ICON	0x61608	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.46315028901734107
RT_ICON	0x61608	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.46315028901734107
RT_ICON	0x61b70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.26991701244813276
RT_ICON	0x61b70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.26991701244813276
RT_ICON	0x64118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.31121013133208253
RT_ICON	0x64118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.31121013133208253
RT_ICON	0x651c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35904255319148937
RT_ICON	0x651c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35904255319148937
RT_ICON	0x65690	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5652985074626866
RT_ICON	0x65690	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5652985074626866
RT_ICON	0x66538	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5473826714801444
RT_ICON	0x66538	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5473826714801444
RT_ICON	0x66de0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6242774566473989
RT_ICON	0x66de0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6242774566473989
RT_ICON	0x67348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4616182572614108
RT_ICON	0x67348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4616182572614108
RT_ICON	0x698f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.48592870544090055
RT_ICON	0x698f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.48592870544090055
RT_ICON	0x6a998	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.49426229508196723
RT_ICON	0x6a998	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.49426229508196723
RT_ICON	0x6b320	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4530141843971631
RT_ICON	0x6b320	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4530141843971631
RT_ICON	0x6b7f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3752665245202559
RT_ICON	0x6b7f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3752665245202559
RT_ICON	0x6c698	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5185018050541517
RT_ICON	0x6c698	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5185018050541517
RT_ICON	0x6cf40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6048387096774194
RT_ICON	0x6cf40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6048387096774194
RT_ICON	0x6d608	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6553468208092486
RT_ICON	0x6d608	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6553468208092486
RT_ICON	0x6db70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.4841286307053942
RT_ICON	0x6db70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.4841286307053942
RT_ICON	0x70118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5035178236397748
RT_ICON	0x70118	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5035178236397748
RT_ICON	0x711c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.48114754098360657
RT_ICON	0x711c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.48114754098360657
RT_ICON	0x71b48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5372340425531915
RT_ICON	0x71b48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5372340425531915
RT_DIALOG	0x74448	0x58	data			0.8977272727272727
RT_STRING	0x744a0	0x26e	data	Tamil	India	0.5016077170418006
RT_STRING	0x744a0	0x26e	data	Tamil	Sri Lanka	0.5016077170418006
RT_STRING	0x74710	0x29c	data	Tamil	India	0.4865269461077844
RT_STRING	0x74710	0x29c	data	Tamil	Sri Lanka	0.4865269461077844
RT_STRING	0x749b0	0x4b0	data	Tamil	India	0.455
RT_STRING	0x749b0	0x4b0	data	Tamil	Sri Lanka	0.455
RT_ACCELERATOR	0x72028	0x48	data	Tamil	India	0.8472222222222222
RT_ACCELERATOR	0x72028	0x48	data	Tamil	Sri Lanka	0.8472222222222222
RT_GROUP_CURSOR	0x724d0	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x741b0	0x30	data			0.9375
RT_GROUP_ICON	0x6b788	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x6b788	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_GROUP_ICON	0x65628	0x68	data	Tamil	India	0.6826923076923077
RT_GROUP_ICON	0x65628	0x68	data	Tamil	Sri Lanka	0.6826923076923077
RT_GROUP_ICON	0x71fb0	0x76	data	Tamil	India	0.6779661016949152
RT_GROUP_ICON	0x71fb0	0x76	data	Tamil	Sri Lanka	0.6779661016949152
RT_VERSION	0x741e0	0x264	data			0.5392156862745098

Imports

DLL	Import
KERNEL32.dll	EnumCalendarInfoW, InterlockedDecrement, GetCurrentProcess, GetLogicalDriveStringsW, SetComputerNameW, SetVolumeMountPointW, GetTimeFormatA, GetTickCount, CreateNamedPipeW, GetNumberFormatA, ClearCommBreak, GetConsoleAliasExesW, TlsSetValue, GetEnvironmentStrings, LoadLibraryW, GetLocaleInfoW, _hread, GetCalendarInfoW, SetVolumeMountPointA, GetVersionExW, EnumSystemCodePagesA, CreateSemaphoreA, GetFileAttributesW, CreateActCtxA, GetShortPathNameA, CreateJobObjectA, VerifyVersionInfoW, CreateProcessW, GetLastError, GetCurrentDirectoryW, GetProcAddress, SetFileAttributesA, DefineDosDeviceA, GlobalFree, FindClose, LoadLibraryA, LocalAlloc, CreateHardLinkW, GetNumberFormatW, FoldStringW, SetEnvironmentVariableA, GetModuleFileNameA, EnumDateFormatsA, GlobalUnWire, OpenEventW, GetShortPathNameW, SetFileShortNameA, GetDiskFreeSpaceExA, ReadConsoleInputW, DebugBreak, GetTempPathA, LocalFree, LCMapStringW, CommConfigDialogW, SetFilePointer, EnumCalendarInfoA, InterlockedExchange, GetComputerNameA, CloseHandle, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, GetModuleHandleA, MultiByteToWideChar, HeapFree, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, HeapAlloc, GetStartupInfoW, RaiseException, RtlUnwind, TerminateProcess, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsFree, SetLastError, GetCurrentThreadId, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, Sleep, HeapSize, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, WideCharToMultiByte, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers
GDI32.dll	CreateDCA, GetCharWidth32A, GetCharWidthI
SHELL32.dll	FindExecutableA
ole32.dll	CoSuspendClassObjects
WINHTTP.dll	WinHttpSetDefaultProxyConfiguration, WinHttpOpen
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 16:36:02.817156076 CEST	49711	25	192.168.2.6	52.101.11.0
Oct 11, 2024 16:36:03.801642895 CEST	49711	25	192.168.2.6	52.101.11.0
Oct 11, 2024 16:36:05.801702976 CEST	49711	25	192.168.2.6	52.101.11.0
Oct 11, 2024 16:36:06.151674986 CEST	49713	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:06.151726961 CEST	443	49713	185.228.234.180	192.168.2.6
Oct 11, 2024 16:36:06.151791096 CEST	49713	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:09.801803112 CEST	49711	25	192.168.2.6	52.101.11.0
Oct 11, 2024 16:36:17.801779032 CEST	49711	25	192.168.2.6	52.101.11.0
Oct 11, 2024 16:36:22.840190887 CEST	61283	25	192.168.2.6	67.195.228.106
Oct 11, 2024 16:36:23.848676920 CEST	61283	25	192.168.2.6	67.195.228.106
Oct 11, 2024 16:36:25.848558903 CEST	61283	25	192.168.2.6	67.195.228.106
Oct 11, 2024 16:36:29.848582983 CEST	61283	25	192.168.2.6	67.195.228.106
Oct 11, 2024 16:36:37.848579884 CEST	61283	25	192.168.2.6	67.195.228.106
Oct 11, 2024 16:36:42.865026951 CEST	61403	25	192.168.2.6	74.125.71.27
Oct 11, 2024 16:36:43.879933119 CEST	61403	25	192.168.2.6	74.125.71.27
Oct 11, 2024 16:36:45.895576000 CEST	61403	25	192.168.2.6	74.125.71.27
Oct 11, 2024 16:36:46.145576954 CEST	49713	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:46.145699024 CEST	443	49713	185.228.234.180	192.168.2.6
Oct 11, 2024 16:36:46.145766020 CEST	49713	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:46.258964062 CEST	61424	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:46.259006023 CEST	443	61424	185.228.234.180	192.168.2.6
Oct 11, 2024 16:36:46.259067059 CEST	61424	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:36:49.895499945 CEST	61403	25	192.168.2.6	74.125.71.27
Oct 11, 2024 16:36:57.895538092 CEST	61403	25	192.168.2.6	74.125.71.27
Oct 11, 2024 16:37:02.887343884 CEST	61476	25	192.168.2.6	217.69.139.150
Oct 11, 2024 16:37:03.895478010 CEST	61476	25	192.168.2.6	217.69.139.150
Oct 11, 2024 16:37:05.895503044 CEST	61476	25	192.168.2.6	217.69.139.150
Oct 11, 2024 16:37:09.895497084 CEST	61476	25	192.168.2.6	217.69.139.150
Oct 11, 2024 16:37:17.895587921 CEST	61476	25	192.168.2.6	217.69.139.150
Oct 11, 2024 16:37:26.255201101 CEST	61424	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:37:26.255441904 CEST	443	61424	185.228.234.180	192.168.2.6
Oct 11, 2024 16:37:26.255553007 CEST	61424	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:37:26.365679026 CEST	61479	443	192.168.2.6	185.228.234.180
Oct 11, 2024 16:37:26.365782022 CEST	443	61479	185.228.234.180	192.168.2.6
Oct 11, 2024 16:37:26.365938902 CEST	61479	443	192.168.2.6	185.228.234.180

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 16:36:02.784337997 CEST	61654	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:02.816376925 CEST	53	61654	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:05.810204029 CEST	57286	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:06.151072979 CEST	53	57286	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:18.824312925 CEST	53	63796	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:22.820123911 CEST	53928	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:22.829569101 CEST	53	53928	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:22.831269979 CEST	55838	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:22.839654922 CEST	53	55838	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:42.849222898 CEST	58843	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:42.856307030 CEST	53	58843	1.1.1.1	192.168.2.6
Oct 11, 2024 16:36:42.856949091 CEST	60757	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:36:42.864515066 CEST	53	60757	1.1.1.1	192.168.2.6
Oct 11, 2024 16:37:02.864792109 CEST	56568	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:37:02.878443003 CEST	53	56568	1.1.1.1	192.168.2.6
Oct 11, 2024 16:37:02.879225016 CEST	65287	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:37:02.886684895 CEST	53	65287	1.1.1.1	192.168.2.6
Oct 11, 2024 16:38:05.370997906 CEST	61804	53	192.168.2.6	1.1.1.1
Oct 11, 2024 16:38:05.405061960 CEST	53	61804	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 16:36:02.784337997 CEST	192.168.2.6	1.1.1.1	0xfc3	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:05.810204029 CEST	192.168.2.6	1.1.1.1	0xe363	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.820123911 CEST	192.168.2.6	1.1.1.1	0x5722	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:22.831269979 CEST	192.168.2.6	1.1.1.1	0x3d2f	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.849222898 CEST	192.168.2.6	1.1.1.1	0xae13	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:42.856949091 CEST	192.168.2.6	1.1.1.1	0x4485	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:37:02.864792109 CEST	192.168.2.6	1.1.1.1	0x86eb	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:37:02.879225016 CEST	192.168.2.6	1.1.1.1	0x95b4	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:38:05.370997906 CEST	192.168.2.6	1.1.1.1	0x385f	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 16:36:02.816376925 CEST	1.1.1.1	192.168.2.6	0xfc3	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:02.816376925 CEST	1.1.1.1	192.168.2.6	0xfc3	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:02.816376925 CEST	1.1.1.1	192.168.2.6	0xfc3	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:02.816376925 CEST	1.1.1.1	192.168.2.6	0xfc3	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:06.151072979 CEST	1.1.1.1	192.168.2.6	0xe363	No error (0)	vanaheim.cn	185.228.234.180	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.829569101 CEST	1.1.1.1	192.168.2.6	0x5722	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:22.829569101 CEST	1.1.1.1	192.168.2.6	0x5722	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:22.829569101 CEST	1.1.1.1	192.168.2.6	0x5722	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:22.839654922 CEST	1.1.1.1	192.168.2.6	0x3d2f	No error (0)	mta5.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.856307030 CEST	1.1.1.1	192.168.2.6	0xae13	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:36:42.864515066 CEST	1.1.1.1	192.168.2.6	0x4485	No error (0)	smtp.google.com	74.125.71.27	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.864515066 CEST	1.1.1.1	192.168.2.6	0x4485	No error (0)	smtp.google.com	64.233.167.27	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.864515066 CEST	1.1.1.1	192.168.2.6	0x4485	No error (0)	smtp.google.com	74.125.71.26	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.864515066 CEST	1.1.1.1	192.168.2.6	0x4485	No error (0)	smtp.google.com	64.233.166.27	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:36:42.864515066 CEST	1.1.1.1	192.168.2.6	0x4485	No error (0)	smtp.google.com	64.233.166.26	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:37:02.878443003 CEST	1.1.1.1	192.168.2.6	0x86eb	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Oct 11, 2024 16:37:02.886684895 CEST	1.1.1.1	192.168.2.6	0x95b4	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:37:02.886684895 CEST	1.1.1.1	192.168.2.6	0x95b4	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:38:05.405061960 CEST	1.1.1.1	192.168.2.6	0x385f	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:38:05.405061960 CEST	1.1.1.1	192.168.2.6	0x385f	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:38:05.405061960 CEST	1.1.1.1	192.168.2.6	0x385f	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Oct 11, 2024 16:38:05.405061960 CEST	1.1.1.1	192.168.2.6	0x385f	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:35:57
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\6foBmRMlDy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6foBmRMlDy.exe"
Imagebase:	0x400000
File size:	426'496 bytes
MD5 hash:	E4352F63724267BED81E8C199BD8CA0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2096533476.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:35:57
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqbqwogt\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:35:57
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:35:58
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnmlavab.exe" C:\Windows\SysWOW64\gqbqwogt\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:35:58
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:35:59
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create gqbqwogt binPath= "C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d\"C:\Users\user\Desktop\6foBmRMlDy.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:35:59
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:35:59
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description gqbqwogt "wifi internet conection"
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:35:59
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start gqbqwogt
Imagebase:	0x170000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe /d"C:\Users\user\Desktop\6foBmRMlDy.exe"
Imagebase:	0x400000
File size:	12'737'536 bytes
MD5 hash:	415D8A2F273DA3EB07A38C1E95C0BB82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2130408783.0000000000DD0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2127071237.0000000000D90000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0xaa0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5840 -ip 5840
Imagebase:	0x9b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 568
Imagebase:	0x9b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3180 -ip 3180
Imagebase:	0x9b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	10:36:00
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	10:36:01
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 772
Imagebase:	0x9b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:36:43
Start date:	11/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	23%
Signature Coverage:	30.3%
Total number of Nodes:	525
Total number of Limit Nodes:	44

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001838), ref: 0040A4C3

Strings

\, xrefs: 00409D0C
", xrefs: 0040A078
D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
P, xrefs: 00409DAA
", xrefs: 0040A189
", xrefs: 00409EDB
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: b37934571552078ddbfaab47005c7767904b914e0070efdbfd13cf5a9cdf07b2
Instruction ID: bd119e6c4087cb98d252ff90c2b4564d186cc4371c54d2626973292121ed4095
Opcode Fuzzy Hash: b37934571552078ddbfaab47005c7767904b914e0070efdbfd13cf5a9cdf07b2
Instruction Fuzzy Hash: 0B52A1B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0043B240 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043C50B: __lock.LIBCMT ref: 0043C529
Part of subcall function 0043C50B: ___sbh_find_block.LIBCMT ref: 0043C534
Part of subcall function 0043C50B: ___sbh_free_block.LIBCMT ref: 0043C543

_realloc.LIBCMT ref: 0043B947

Part of subcall function 0043CA60: _malloc.LIBCMT ref: 0043CA76

_fseek.LIBCMT ref: 0043B94F

Strings

?zEo, xrefs: 0043B316
/H;+, xrefs: 0043B6AC
C:7C, xrefs: 0043B6E5
p7~, xrefs: 0043B672
k3nU, xrefs: 0043B3ED
|%FH, xrefs: 0043B823
agYU, xrefs: 0043B7CA
kd@9, xrefs: 0043B7BF
Z1S9, xrefs: 0043B511
$&s, xrefs: 0043B64C
0ugV, xrefs: 0043B41B
cg P, xrefs: 0043B67F

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: ___sbh_find_block___sbh_free_block__lock_fseek_malloc_realloc
String ID: $&s$/H;+$0ugV$?zEo$C:7C$Z1S9$agYU$cg P$k3nU$kd@9$p7~$|%FH
API String ID: 3289479739-3763514964
Opcode ID: 7dcdd3eaea46ffe2a30c8f0310ea7705a34f69824791a8e454ba313e888b229a
Instruction ID: d87394b33d7e6c5c910dd0271f55276661a3dd12386dfd98f108e32f406b15c8
Opcode Fuzzy Hash: 7dcdd3eaea46ffe2a30c8f0310ea7705a34f69824791a8e454ba313e888b229a
Instruction Fuzzy Hash: 8902FCB5609380DFD2708F6AC489B8EFBE4BF85314F40891DE69A9B610D7709885CF97

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: dd8323cc3663becab7e2967d3efa69540a9c24c17e68938a9fe8f8f1d062e2db
Instruction ID: 06034c09a380b67456f64a6cc71bbc1075b83f40537ea60a42ab4a6d8e407b0f
Opcode Fuzzy Hash: dd8323cc3663becab7e2967d3efa69540a9c24c17e68938a9fe8f8f1d062e2db
Instruction Fuzzy Hash: 3AA181B2540208BBEB21DFA1CC45FDF3BACEB44344F104437FA05A6192D7B999948FA9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction ID: 39f8afa0f9c16d59a54efa000c115c62b3535d7a3470d06cdb9238e0f04a129a
Opcode Fuzzy Hash: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction Fuzzy Hash: C531E0B2900108BFDB01DFA09D44ADF7F78AF48314F158076E112F7291D778A9648F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 006B1DC3 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006B1DEB
Module32First.KERNEL32(00000000,00000224), ref: 006B1E0B

Memory Dump Source

Source File: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a2000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 696289c74a8974d4652e780d3c056231e4a97f0d5f035470289b066480fe4ea3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1DF0F6722003117FD7203BF9989DBEE73EDAF4A325F500128E642951C0DB70ED864BA1

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 573530a394494cd252acd85827aa24eb1d86e5d70ab511f0ce4f94472402c086
Instruction ID: 197d4fc66f8e4192ef9d41e029ea27591e600de1538a1216c66efdd274428ce7
Opcode Fuzzy Hash: 573530a394494cd252acd85827aa24eb1d86e5d70ab511f0ce4f94472402c086
Instruction Fuzzy Hash: F8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
", xrefs: 00407227

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 3f864b9e64e2f7a1d4d97f78ecf1fd3725cd2b03a8b023efc5a10220ad7d3397
Instruction ID: 7765b981cd58ee1688e4c4772d4ab21dab1833365f63e39a1c5bd68b3cda8b0b
Opcode Fuzzy Hash: 3f864b9e64e2f7a1d4d97f78ecf1fd3725cd2b03a8b023efc5a10220ad7d3397
Instruction Fuzzy Hash: E2B17071D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0060003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0060024D

Strings

kernel32.dll, xrefs: 0060008F, 00600095
cess, xrefs: 0060018D

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bbbf4db3596f4485a88410cc2d3c193017e3a9667bdecbbed5112f2fd1dd1f22
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 02526974A01229DFDB64CF58C985BA9BBB1BF09304F1480E9E54DAB391DB30AE85DF14

Function 0043AEB0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0043AFA0
_feof.LIBCMT ref: 0043AFBA

Part of subcall function 0043ADE0: VirtualProtect.KERNELBASE(0045A480,0045A9F4,00000020,?), ref: 0043AE8F

Strings

=<9A, xrefs: 0043B15D
89A, xrefs: 0043B157
{, xrefs: 0043B169
Bq , xrefs: 0043AEF4

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: ProtectVirtual_feof_strlen
String ID: 89A$=<9A$Bq ${
API String ID: 1251290033-441600927
Opcode ID: bac7f9505f20d68383763d65345367bdbfa94530caf3835c190cf427977607d5
Instruction ID: 17c99ab5acc6df25385ed16af596a2251f632a33a78189a9da60bd62079ab192
Opcode Fuzzy Hash: bac7f9505f20d68383763d65345367bdbfa94530caf3835c190cf427977607d5
Instruction Fuzzy Hash: 94910371940350AFD710ABA0ED49FAA3B74FB49716F00013AF645B62E2C7B85640CBEE

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: a5c5d522b106040adc57172562e4df723170804bdc8f2d65522e1c605b71199f
Instruction ID: 19cd972424ac8e8d042cd161df480d49e2af34fc78b4bb0df73037009807ae11
Opcode Fuzzy Hash: a5c5d522b106040adc57172562e4df723170804bdc8f2d65522e1c605b71199f
Instruction Fuzzy Hash: 0201847298020877EA112F62AD46F9F3F1DEB54718F00483AF615790D2D9B994709A6C

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 0043ADE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0045A480,0045A9F4,00000020,?), ref: 0043AE8F

Strings

, xrefs: 0043AE76

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 01f13a5192d663de11e313c2b231697ccad97762487919bd531801ef589a38fb
Instruction ID: dc8660ecb2c9a0ef57b55d70a2a8dc3997a93980919400bc7a706f5d6ada5fb8
Opcode Fuzzy Hash: 01f13a5192d663de11e313c2b231697ccad97762487919bd531801ef589a38fb
Instruction Fuzzy Hash: 08114C746883C0DEE301CB78BD48F563FA55322307F1501B8D484432BBE2B6A658CBBA

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 71381d414eea609956b81229ff7ef55c0a1e20f0b60b179c9f465f11489b4c90
Instruction ID: 3cca0c38997a8a474aeccf5a0ebcf8f93a8d16d18ff02e9242d6ab16e280a915
Opcode Fuzzy Hash: 71381d414eea609956b81229ff7ef55c0a1e20f0b60b179c9f465f11489b4c90
Instruction Fuzzy Hash: C641EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 00600E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00600223,?,?), ref: 00600E19
SetErrorMode.KERNELBASE(00000000,?,?,00600223,?,?), ref: 00600E1E

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5e5b7fc9be17af52c8aa1593ebc2cf7226538b4808b2ec5a12ddc81c56322646
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 08D0123114512877D7002A94DC09BCE7B1CDF05B62F008411FB0DE9180C770994046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 54bc16a58432e014760a8219cb6401776c0b2f7f4e35f25b0da1a83a0963d2cd
Instruction ID: 594da891b9e57e87d6aa513f65a0e563028cfc4c29bd5910f078fc56da7159a2
Opcode Fuzzy Hash: 54bc16a58432e014760a8219cb6401776c0b2f7f4e35f25b0da1a83a0963d2cd
Instruction Fuzzy Hash: 84F0C2B6104218AFD710DB64EEC4FE77BAED714308F1084B6F286E3141D6B89DA85B6C

Function 0043EEEE Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0043EF03

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ba49affe4ba948a0bcfaba6f076b34328c56a29a8243271a74c8c5a257fdd3ef
Instruction ID: c47c4244610d5876d865f45c43479abe6b0c6b95a462d5fe56188cfb810440df
Opcode Fuzzy Hash: ba49affe4ba948a0bcfaba6f076b34328c56a29a8243271a74c8c5a257fdd3ef
Instruction Fuzzy Hash: EED05E765583486EDB105F716C087263BDCA388396F044436B90CC6190E7B5C940C508

Function 006B1A82 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006B1AD3

Memory Dump Source

Source File: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a2000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a521632b412bdc3f4331fca387d88913c3b07ebd21773b7050d3287afa57c9ba
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 61112D79A00208FFDB01DF98C995E98BBF5AF09351F058094F9489F362D371EA90DB80

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

lid_file_upd, xrefs: 0040CE6A
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
wtm_w, xrefs: 0040C96C
local_time, xrefs: 0040CACD
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
\, xrefs: 0040D39D
wtm_c, xrefs: 0040C956
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
@, xrefs: 0040D754
4, xrefs: 0040D9F7
wtm_r, xrefs: 0040C97F
.sys, xrefs: 0040D0CC
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
\, xrefs: 0040D3A7
drivers\, xrefs: 0040D067
srv_time, xrefs: 0040CABB
flags_upd, xrefs: 0040CE4A

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtFilterToken, xrefs: 0040122B
NtQueryInformationToken, xrefs: 00401262
RtlNtStatusToDosError, xrefs: 00401194
NtSetInformationToken, xrefs: 00401175
RtlInitUnicodeString, xrefs: 00401135
NtOpenProcessToken, xrefs: 004011D4
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
NtTerminateProcess, xrefs: 004010F6
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlFreeSid, xrefs: 00401116
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
Jul, xrefs: 0040B280
Oct, xrefs: 0040B295
Sun, xrefs: 0040B225
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Apr, xrefs: 0040B26B
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Mon, xrefs: 0040B22C
Feb, xrefs: 0040B25D
Nov, xrefs: 0040B29C
Wed, xrefs: 0040B23A
Thu, xrefs: 0040B241
Dec, xrefs: 0040B2A3
Sep, xrefs: 0040B28E
May, xrefs: 0040B272
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
<, xrefs: 00401378
%systemroot%\system32\cmd.exe, xrefs: 00401316
uac, xrefs: 00401628
@, xrefs: 00401380
D, xrefs: 004015C6
, xrefs: 00401462

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
IsWow64Process, xrefs: 00401DF2
loader_id, xrefs: 00401F4B, 00401F6B
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
net_type, xrefs: 00401E87

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: f83cae532fda0f7b628782386ce8b2feec09b1d0c3fd7cfd61acfb995292e920
Instruction ID: d6b35303784bc7068dc70d414bcf7f40aad10565f6e4a34c223da57409024e49
Opcode Fuzzy Hash: f83cae532fda0f7b628782386ce8b2feec09b1d0c3fd7cfd61acfb995292e920
Instruction Fuzzy Hash: 9651EA705043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA95487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 006065E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006065F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00606610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00606631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00606652

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: a38fb02cb1b8bdc450920f971ced91a8ab60e08a4a3d40738c7c81e2561d1324
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: F711A371640218BFDB259F65DC06FDB3FA9EB047A5F104024F908E7291D7B2DD1086A4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 0060092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006009DC, 006009DF, 006009E4
., xrefs: 0060095F
l, xrefs: 00600966

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ca3e0dc928b3eb58f5f920a532e04de175240ee417e0ebceb62b96e15e73e0bb
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 683137B6900609DFEB14CF99C880BAEBBF6FF48324F25504AD441A7351D771EA45CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 006B16A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133585534.00000000006A2000.00000040.00000020.00020000.00000000.sdmp, Offset: 006A2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a2000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 286080fffba44842fcef4e8575c94b031553f78ca8775af079a2ca657e5ad825
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 671170B2340100AFD754DF55DCA1EE673EAEB8A360B698165E904CB315E675EC42C760

Function 00600D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 0d8b75db3329e727e2f298a538b10a5da1ac7c04e1debf53f6a48a6320adb0d8
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: FD01A7766406048FEF25CF64C804BEB33E6EF85315F4544E5D506973C2E774A9418B90

Function 00609EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00609E6D
lstrcpy.KERNEL32(?,00000000), ref: 00609FE1
lstrcat.KERNEL32(?,?), ref: 00609FF2
lstrcat.KERNEL32(?,0041070C), ref: 0060A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0060A054
DeleteFileA.KERNEL32(?), ref: 0060A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0060A0D6
lstrcpy.KERNEL32 ref: 0060A12F
lstrlen.KERNEL32(00000022), ref: 0060A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00609F13

Part of subcall function 00607029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00607081

Part of subcall function 00606F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\cmxmskcp,00607043), ref: 00606F4E
Part of subcall function 00606F30: GetProcAddress.KERNEL32(00000000), ref: 00606F55
Part of subcall function 00606F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00606F7B
Part of subcall function 00606F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00606F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0060A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0060A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0060A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0060A21B
GetDriveTypeA.KERNEL32(?), ref: 0060A265
lstrcat.KERNEL32(?,00000000), ref: 0060A29F
lstrcat.KERNEL32(?,00410A34), ref: 0060A2C5
lstrcat.KERNEL32(?,00000022), ref: 0060A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0060A2F4
wsprintfA.USER32 ref: 0060A31D
lstrcat.KERNEL32(?,00000000), ref: 0060A345
lstrcat.KERNEL32(?,?), ref: 0060A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0060A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0060A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0060A1D1

Part of subcall function 00609966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0060999D
Part of subcall function 00609966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006099BD
Part of subcall function 00609966: RegCloseKey.ADVAPI32(?), ref: 006099C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0060A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0060A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0060A41D

Strings

", xrefs: 0060A3F0
P, xrefs: 0060A011
D, xrefs: 0060A1F5
", xrefs: 0060A142
", xrefs: 0060A2DF
\, xrefs: 00609F73

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: f09d99bef10a707308c08a341eb846df543125ad02325dd00d10b794679eceeb
Instruction ID: c389e5303b252b28d9cac88e195e444d81f4e4943055c323ee86538f73e6faac
Opcode Fuzzy Hash: f09d99bef10a707308c08a341eb846df543125ad02325dd00d10b794679eceeb
Instruction Fuzzy Hash: A8F153B1C8021DAFDF25DBA0CC49EEF7BBDAB08344F1444A9F605E2181E7758A848F65

Function 00607CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00607D21
GetUserNameA.ADVAPI32(?,?), ref: 00607D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00607D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00607DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00607DC0
EqualSid.ADVAPI32(?,?), ref: 00607DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00607DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00607DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00607E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00607E12
LocalFree.KERNEL32(00000000), ref: 00607E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00607E35

Strings

PromptOnSecureDesktop, xrefs: 00607FA0
D, xrefs: 00607D73

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 6ddb5a849a8e63d4e82f5725ebf9ff1544124760c8226c418f7ac8739cc2ce02
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 8BA14E71D40219AFDB15CFA0DD88FEFBBB9FB08300F148469E506E6290DB759A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

%d=%p, xrefs: 004066F9
localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 64bdd4d646a522699b5472447b714269db1a1731565c65632a199503b6103360
Instruction ID: 302e59d67534013c0e033960a005fbe7b570eed1172f45d0d905d428b8e71e1f
Opcode Fuzzy Hash: 64bdd4d646a522699b5472447b714269db1a1731565c65632a199503b6103360
Instruction Fuzzy Hash: 87616F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
helo %s, xrefs: 0040A803
ehlo %s, xrefs: 0040A7F5
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Too small respons, xrefs: 0040A9C9
AUTH LOGIN, xrefs: 0040A80C
data, xrefs: 0040A85E
., xrefs: 0040A8CA
Incorrect respons, xrefs: 0040AB39
rcpt to:<%s>, xrefs: 0040A855
quit, xrefs: 0040A86C
mail from:<%s>, xrefs: 0040A848

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00607A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00607A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00607ACD
GetLengthSid.ADVAPI32(?), ref: 00607ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00607B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00607B1F
EqualSid.ADVAPI32(?,?), ref: 00607B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00607B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00607B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00607B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00607B77
LocalFree.KERNEL32(00000000), ref: 00607B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00607B9A
GetAce.ADVAPI32(?,?,?), ref: 00607BCA
EqualSid.ADVAPI32(?,?), ref: 00607BF1
DeleteAce.ADVAPI32(?,?), ref: 00607C0A
EqualSid.ADVAPI32(?,?), ref: 00607C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00607CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00607CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00607CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00607CE0
LocalFree.KERNEL32(00000000), ref: 00607CEE

Strings

D, xrefs: 00607AC3

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: f94d7baa27170664f7a7b63508fea508ab7bf58432c4c3f75191f6af49eed310
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: F3814D71D4421AAFDB15CFA4DD48FEFBBB9EF08304F04806AE505E6290D775AA41CB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC
123.45.67.89, xrefs: 004019A6

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0060858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0060865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0060867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006086A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006086B1

Strings

PromptOnSecureDesktop, xrefs: 006085B6, 00608645, 006086BD, 00608708, 006087C5, 00608812, 006088E9, 00608905
", xrefs: 0060896C

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 90fb4428aaed878ae58cb48a88724d8fe0859b05d5be2d74ccb286e204afa899
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: C5C1A271980209BEEB15EBA4DC85EEF7B7EEB04300F144479F541E3191EAB18E948B69

Function 006014E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00601601
lstrlenW.KERNEL32(-00000003), ref: 006017D8

Strings

<, xrefs: 006015DF
, xrefs: 006016C9
@, xrefs: 006015E7
D, xrefs: 0060182D

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 0106f8326c29c87495d64b03651bf441e723d1204bf1639b59ff95524b78e91c
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: ECF1ADB15483419FD724CF64C888BABB7E6FB8A304F00892DF6969B390D7B4D944CB56

Function 00607666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006076D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00607757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0060778F
___ascii_stricmp.LIBCMT ref: 006078B4
RegCloseKey.ADVAPI32(?), ref: 0060794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0060796D
RegCloseKey.ADVAPI32(?), ref: 0060797E
RegCloseKey.ADVAPI32(?), ref: 006079AC
RegCloseKey.ADVAPI32(?), ref: 00607A56

Part of subcall function 0060F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0060772A,?), ref: 0060F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006079F6
RegCloseKey.ADVAPI32(?), ref: 00607A4D

Strings

PromptOnSecureDesktop, xrefs: 006076C5, 006076CA, 006076E5, 00607782, 006077E6, 00607862, 0060787B, 006079C2
", xrefs: 00607800

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: ee68fc272f5aca9451a2f3cc8bacf15325f24d7edfc7c02b11cb973e6eadd9ed
Instruction ID: ac1dadede3495783e220f03068f8a22dcffc91644f91668f8c29acb1ebc4ed2a
Opcode Fuzzy Hash: ee68fc272f5aca9451a2f3cc8bacf15325f24d7edfc7c02b11cb973e6eadd9ed
Instruction Fuzzy Hash: F5C1D271D84209AFDB299BA4DC45FEF7BBAEF45310F1040A5F504E62D1EB71AE808B64

Function 00602CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00602CED
socket.WS2_32(00000002,00000002,00000011), ref: 00602D07
htons.WS2_32(00000000), ref: 00602D42
select.WS2_32 ref: 00602D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00602DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00602E62

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 6aa280bc4b535c23eccfb838c3cdfc821fee280d4ed5cc7e2961b9725fb67911
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: AB61DF7158430AABC3249F60DC4CBABBBE9EF88341F144819F98496291D7B49C818BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%s%d, xrefs: 0040AE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0060958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006095A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006095D5
GetModuleFileNameA.KERNEL32(00000000), ref: 006095DC
wsprintfA.USER32 ref: 00609635
wsprintfA.USER32 ref: 00609673
wsprintfA.USER32 ref: 006096F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00609758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0060978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006097D8

Strings

PromptOnSecureDesktop, xrefs: 00609604, 00609624, 00609662, 00609683, 006096B6, 006096DF, 00609701, 00609734, 00609780, 006097B7

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: e35f04148ce3af63e99fbb061a16182ac2415cb778cceb4801d6d6173470cb1c
Instruction ID: 071045268869b9a7fdff2eb33fc3a93db369cf211225bc15fbbdee1b4a0a4c2c
Opcode Fuzzy Hash: e35f04148ce3af63e99fbb061a16182ac2415cb778cceb4801d6d6173470cb1c
Instruction Fuzzy Hash: 5DA163B1980208EFEB29DF90CC45FDB3BAEEB45341F104026F91596292E7B5D984CBA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_DOMAIN, xrefs: 0040B44B
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%FROM_DOMAIN, xrefs: 0040B41E
%DATE, xrefs: 0040B4D2
%TO_EMAIL, xrefs: 0040B473
%FROM_USER, xrefs: 0040B431
%s@%s, xrefs: 0040B461
%TO_HASH, xrefs: 0040B4B0
%P5DATE, xrefs: 0040B4F2
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00601FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0060202D
GetSystemInfo.KERNEL32(?), ref: 0060204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0060206A
GetProcAddress.KERNEL32(00000000), ref: 00602071
GetCurrentProcess.KERNEL32(?), ref: 00602082
GetTickCount.KERNEL32 ref: 00602230

Part of subcall function 00601E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00601E7C

Strings

hi_id, xrefs: 0060217D, 00602182, 0060219A
work_srv, xrefs: 006020C5
flags_upd, xrefs: 006020A5, 006020AA, 006020E3
localcfg, xrefs: 00602091, 00602098, 006020AB, 006020E4, 006020F3, 00602119, 00602138, 0060214E, 00602166, 00602183, 0060219B, 006021B7, 006021D7

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 1c05908e8332f2c0f6c33c38143c7fb2cde288243502d8b530b502e0e60caf20
Instruction ID: d4bbff1380e136dd98fb3418034d05c4493a90962e40df13d55ed5cdf5de5bc5
Opcode Fuzzy Hash: 1c05908e8332f2c0f6c33c38143c7fb2cde288243502d8b530b502e0e60caf20
Instruction Fuzzy Hash: A25128B0580344AFE374AF758C8AF67BAEDEF54704F00081DF99682282D7B5A944C769

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00603059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00603068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00603078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00603095
RtlAllocateHeap.NTDLL(00000000), ref: 006030B6
htons.WS2_32(00000035), ref: 006030EF
inet_addr.WS2_32(?), ref: 006030FA
gethostbyname.WS2_32(?), ref: 0060310D
HeapFree.KERNEL32(00000000), ref: 0060314D

Strings

iphlpapi.dll, xrefs: 00603062, 00603067, 00603077

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 42dca44393844f7192eea04adf073b8f5a34f3e9ffaa26fe603e657e69aefd8d
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: E531E731E40216ABDB159BB49C48AEF777DAF08362F144165E518E33D0DB74DE418B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 00606778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 006067C3
htonl.WS2_32(?), ref: 006067DF
htonl.WS2_32(?), ref: 006067EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006068F1
ExitProcess.KERNEL32 ref: 006069BC

Strings

except_info, xrefs: 0060698F
localcfg, xrefs: 00606994

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 509986b44764779889ec140751805dc5d86e13b3ca1e1aa93028e23e5d2d1926
Instruction ID: b23914a89fcd64ab5afc59d3d28c65524e5bfdf9c5397cceab52a480675a0ee5
Opcode Fuzzy Hash: 509986b44764779889ec140751805dc5d86e13b3ca1e1aa93028e23e5d2d1926
Instruction Fuzzy Hash: 40617071A40208AFDB649FB4DC45FEA77E9FF08300F14806AF96DD21A1EA759990CF14

Function 0060F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0060CC84), ref: 0060F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0060F5CE
closesocket.WS2_32(00000000), ref: 0060F5DC

Strings

time_cfg, xrefs: 0060F58A

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 9a46c1aace4caf4b95a5a8e89bcc02224028bef9f85b1d8fc083fc7a80866bdc
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 31318071950118ABDB21DFA5DC85DEF7BBDEF89310F10457AF905D3190E7B08A828BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00602F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00602FA1
LoadLibraryA.KERNEL32(?), ref: 00602FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00602FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00603000
RtlAllocateHeap.NTDLL(00000000), ref: 00603007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00603032

Strings

dnsapi.dll, xrefs: 00602F90

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 4a5fe35d8da6266fa33f8121a628a741460fa3887347c4e7f86384e71e8ab4c9
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 4B21A471981226BBCB229B54DC48AEFFBBDEF08B51F104421F902E7280D7B49E8187D4

Function 00606F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\cmxmskcp,00607043), ref: 00606F4E
GetProcAddress.KERNEL32(00000000), ref: 00606F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00606F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00606F92

Strings

C:\Windows\SysWOW64\, xrefs: 00606F30, 00606F38, 00606F65, 00606F6C, 00606F7A, 00606F85, 00606F91, 00606FA9, 00606FC6, 00606FEC
PromptOnSecureDesktop, xrefs: 00606F9D, 00606FBF, 00606FCF, 00606FE5, 00606FF5
\\.\pipe\cmxmskcp, xrefs: 00606F37

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\cmxmskcp
API String ID: 1082366364-2166947222
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 2ce5cd39c038bbeabf50141046d14da8011b659c104837ebcdf801b2ac4791e5
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 4F214661BC434179F3365731AC89FFB2E4E8B52710F0840A9F400D56C1DAD988E682AD

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 006092CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006092E2
wsprintfA.USER32 ref: 00609350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00609375
lstrlen.KERNEL32(?,?,00000000), ref: 00609389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00609394
CloseHandle.KERNEL32(00000000), ref: 0060939B

Strings

PromptOnSecureDesktop, xrefs: 0060932B, 00609343, 0060935E

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: bfe57a4fc71bc86b956c85f6229a34bf72fae7eaa16dd9e6f9221353b497443a
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 81119AB17801247BE7646731DC0EFEF7A6EDBC4B10F00C569BB05E50D1EEB54A418668

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 006099E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00609A18
GetThreadContext.KERNEL32(?,?), ref: 00609A52
TerminateProcess.KERNEL32(?,00000000), ref: 00609A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00609A98
SetThreadContext.KERNEL32(?,00010002), ref: 00609AB5
ResumeThread.KERNEL32(?), ref: 00609AC2

Strings

D, xrefs: 00609A10

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 0de9fae4ea87dd00b72895c5890f947aba1d0ce24201110797387e5d6a0c2a61
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 68213BB1A41219BBDB219BA1DC09EEF7BBDEF04750F404061BA19E1191EB758A44CBA4

Function 00601C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00601C18
LoadLibraryA.KERNEL32(004102C8), ref: 00601C26
GetProcessHeap.KERNEL32 ref: 00601C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00601C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00601CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00601D02
FreeLibrary.KERNEL32(?), ref: 00601D0B

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 90af031df8a9c33de3c3be54088a5b488752400ea334e28720cc9ca1c1289c7c
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 1D313031D80219BFCB159FE4DC888EFBABAEF46711B24447AE501A7290D7B58E80DB54

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 8d14f0f9d29bb03ce564d9d2efa64e335a6ea708645b73911051f25a1151d1b7
Instruction ID: 9669132274562be234db05f10d2b02b24c7977acc8fbe0bb4274004673291573
Opcode Fuzzy Hash: 8d14f0f9d29bb03ce564d9d2efa64e335a6ea708645b73911051f25a1151d1b7
Instruction Fuzzy Hash: 1A4181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F604B21C1D7389A51DBA4

Function 00606CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00606CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00606D22
GetLastError.KERNEL32 ref: 00606DA7
CloseHandle.KERNEL32(?), ref: 00606DB5
GetLastError.KERNEL32 ref: 00606DD6
DeleteFileA.KERNEL32(?), ref: 00606DE7
GetLastError.KERNEL32 ref: 00606DFD

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction ID: 89413c475034482a2552d580d678b450cc334111bacd76a74e2ffea366c35948
Opcode Fuzzy Hash: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction Fuzzy Hash: 0F31FF72A40249BFCB05AFA4DD48ADF7FBAEF48300F148065F111E3291D7B08AA58B65

Function 0060E2FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0060E50A,00000000,00000000,00000000,00020106,00000000,0060E50A,00000000,000000E4), ref: 0060E319
RegSetValueExA.ADVAPI32(0060E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0060E38E
RegDeleteValueA.ADVAPI32(0060E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,D`), ref: 0060E3BF
RegCloseKey.ADVAPI32(0060E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,D`,0060E50A), ref: 0060E3C8

Strings

PromptOnSecureDesktop, xrefs: 0060E33A
D`, xrefs: 0060E2FC

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop$D`
API String ID: 2667537340-1471834828
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 7bc02e4fc611f494ae3ed125c91af2b8ca686896b2fb2415832930b5423ef460
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: C7215E71A4022DBBDF249FA4EC89EDF7F7AEF08750F048425F904E6191E2728A54D7A0

Function 006093AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006093C6
GetModuleFileNameA.KERNEL32(00000000), ref: 006093CD
CharToOemA.USER32(?,?), ref: 006093DB
wsprintfA.USER32 ref: 00609410

Part of subcall function 006092CB: GetTempPathA.KERNEL32(00000400,?), ref: 006092E2
Part of subcall function 006092CB: wsprintfA.USER32 ref: 00609350
Part of subcall function 006092CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00609375
Part of subcall function 006092CB: lstrlen.KERNEL32(?,?,00000000), ref: 00609389
Part of subcall function 006092CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00609394
Part of subcall function 006092CB: CloseHandle.KERNEL32(00000000), ref: 0060939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00609448

Strings

PromptOnSecureDesktop, xrefs: 006093FA, 006093FF, 0060941C

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 66b840284e6ac0042d9211cabbb99710b4b16d03a2fd9add08b1d61b3065247c
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 64019EF69401187BDB20A7619D8DEDF3B7CDB85701F0000A6BB09E2080EAB49BC58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 0060AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0060AAE5

Strings

, xrefs: 0060ABB3
localcfg, xrefs: 0060AD72

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: f5f0e6a239232b3fe66da1deb6423b85db05f87f4e1b174dda9b254ed0a017b1
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 67710971AC0304AAEF398BD4DC85FEF376B9F00385F24416AF905A61D1DB619D84875B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0060E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060DF6C: GetCurrentThreadId.KERNEL32 ref: 0060DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0060E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00606128), ref: 0060E950
lstrcmp.KERNEL32(?,00000008), ref: 0060E989

Strings

A, xrefs: 0060E9A0
A, xrefs: 0060E960, 0060E965
A, xrefs: 0060E8C6, 0060E8CD, 0060E936, 0060E998

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 3e4c2bcf437347e5a11852a900633579aa40974a5cebe1a0052d1ceeec177275
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 9831B0316807259FCB79CF24C884BA77BE6EB15320F108D2EE59687691D372EC80CB85

Function 00606E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00606E19

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: f552a068977ab52d6fd0c89de7ba5d01b8b6950a3ab35f65c4d26fbfa3e1d134
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: E9218E76148219BFDB199B70FC49EDF3FAEDB48360B208425F502D10D1EB719A109678

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0060C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0060C6B4
InterlockedIncrement.KERNEL32(0060C74B), ref: 0060C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0060C747), ref: 0060C728
CloseHandle.KERNEL32(00000000,?,0060C747,00413588,00608A77), ref: 0060C733

Strings

localcfg, xrefs: 0060C544

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 24b3a9bba70c2f48d9bc4b692323ba6ee4716eec93a7a6b4edad37e5182ec2d3
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 97514BB5A40B418FD7788F69C98552BBBEAFB48310B505A3EE18BC7AD0D775F8408B14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 006071C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006071E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00607228
LocalFree.KERNEL32(?,?,?), ref: 00607286
wsprintfA.USER32 ref: 0060729D

Strings

|, xrefs: 0060721A

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 15166f27ac6bf166ed40f8bab9b90bea49ed4678c15d287df934e8210a9a3d4c
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: BF315C72944108BBCB11DFA8DC45ADB3BADEF04314F148066F809DB241EA75E7488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0060B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0060B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0060B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0060B548
GetTimeZoneInformation.KERNEL32(?), ref: 0060B590
wsprintfA.USER32 ref: 0060B61E

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: a713c1bd6d55d903456ca7437e11eb71e9fde705e18ef116205fe8ea64178c01
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D4512171D4021CAACF19DFD5D8445EEBBB9BF48304F10816AF501A6150E7B84AC9CF98

Function 006062D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 00606303
LoadLibraryA.KERNEL32(?), ref: 0060632A
GetProcAddress.KERNEL32(00000000,?), ref: 006063B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 00606405

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 282e4a74672eb40117801d12cc0015738c4229909dbad1e1df50a1187214dd3f
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 4A417C71A40209ABDB1CCF58C894AAAB7B6EF04314F248069F815DB3D0E731ED61CB90

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00441FDF Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00442007

Part of subcall function 0043D346: __getptd.LIBCMT ref: 0043D354
Part of subcall function 0043D346: __getptd.LIBCMT ref: 0043D362

__getptd.LIBCMT ref: 00442011

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 0044201F
__getptd.LIBCMT ref: 0044202D
__getptd.LIBCMT ref: 00442038

Part of subcall function 0043D3EB: __CallSettingFrame@12.LIBCMT ref: 0043D437

Part of subcall function 00442105: __getptd.LIBCMT ref: 00442114
Part of subcall function 00442105: __getptd.LIBCMT ref: 00442122

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 82b52318a1209ef730d5319d681579c68b95efd4f15e921cb8a75d79ffafd6a1
Instruction ID: 1f26d2b162cf52cccfd16e20c8fbb1d915908f5f3995bdd14c1524195890a431
Opcode Fuzzy Hash: 82b52318a1209ef730d5319d681579c68b95efd4f15e921cb8a75d79ffafd6a1
Instruction Fuzzy Hash: 8A1107B1D01209DFDB00EFA5D845AEDBBB1FF08314F10906AF814B7292DB789A159F54

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0060E3DE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,D`,00000000,00000000,00000000), ref: 0060E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0060E484

Part of subcall function 0060E2FC: RegCreateKeyExA.ADVAPI32(80000001,0060E50A,00000000,00000000,00000000,00020106,00000000,0060E50A,00000000,000000E4), ref: 0060E319
Part of subcall function 0060E2FC: RegSetValueExA.ADVAPI32(0060E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0060E38E
Part of subcall function 0060E2FC: RegDeleteValueA.ADVAPI32(0060E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,D`), ref: 0060E3BF
Part of subcall function 0060E2FC: RegCloseKey.ADVAPI32(0060E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,D`,0060E50A), ref: 0060E3C8

Strings

PromptOnSecureDesktop, xrefs: 0060E4F1, 0060E4F6, 0060E537, 0060E561
D`, xrefs: 0060E498, 0060E4BD, 0060E41A, 0060E447, 0060E4C0, 0060E41D, 0060E459, 0060E45A, 0060E46C, 0060E49B

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop$D`
API String ID: 4151426672-1471834828
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: f6fe699f9cdd3cf87a807b95288eb787a70031fc33aca5be0b77203851efe956
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: AF41EBB2D80224BAEB246F518C46FEF3B6DDF44724F148439F909941D2E7B6CA50D6B4

Function 0060E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060DF6C: GetCurrentThreadId.KERNEL32 ref: 0060DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0060A6AC), ref: 0060E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0060A6AC), ref: 0060E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0060A6AC), ref: 0060E819

Strings

PromptOnSecureDesktop, xrefs: 0060E840, 0060E845, 0060E87C, 0060E89B

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: e432a3ce8c9f9c32b9940b3ecc10d09fac2078b92ab52525846e53e81574ddcc
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 532107B1A803117AE22877719C0BFEB3E0DDF65760F10452CBA09A51D3EA56D45082B9

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00607665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006076D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0060796D
RegCloseKey.ADVAPI32(?), ref: 0060797E

Strings

PromptOnSecureDesktop, xrefs: 006076C5, 006076CA, 006076E5

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 1ca877d0efe0134af19799411b495c83391bbd6071a74882221177d6726408b8
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 9211EE70A44109AFDB118FA9DC45FEFBF7AEF82300F140165F512E62D1E6B19E408BA0

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00609966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0060999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006099BD
RegCloseKey.ADVAPI32(?), ref: 006099C6

Strings

PromptOnSecureDesktop, xrefs: 00609989, 0060998E, 006099B0, 006099D3

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: bde14c43a3be25d7fb12ea7c9ba369c4fa591c76792886928569026d6699d854
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 6CF096B2680208BBF7116B54EC0BFDB3A2DDB95B14F104075FA05B50D2F6E59E9082BD

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 0044238C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0044239F

Part of subcall function 004422FA: ___BuildCatchObjectHelper.LIBCMT ref: 00442330

_UnwindNestedFrames.LIBCMT ref: 004423B6
___FrameUnwindToState.LIBCMT ref: 004423C4

Strings

csm, xrefs: 0044239B, 004423B0, 004423C3, 004423E1, 004423F1

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 84f9305d874a50c559aacd72def427a465394a76ca2251e82b6bc0fb57543b16
Instruction ID: 162b1056426cc82c358fe9af72ed69cc294d3496da7099d7d246f226f1b9182b
Opcode Fuzzy Hash: 84f9305d874a50c559aacd72def427a465394a76ca2251e82b6bc0fb57543b16
Instruction Fuzzy Hash: 85012471400109BBEF226E62CD45EAA7E7AFF08358F004016BD1815121D7BA99B2EBA8

Function 006028EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006028FA
gethostbyname.WS2_32(u6A), ref: 00602906

Strings

u6A, xrefs: 006028EC, 006028F9, 00602905
time_cfg, xrefs: 006028EB

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 984fcb4d6cca28fd7470b81fb69de835d970889206e9035e18d40a40cab019bc
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: FCE0EC346445129FDB509B28F848AD777A6AF4A330F058595F454D72A0C7749CC19654

Function 006069C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006069E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00606A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00606A3A
CloseHandle.KERNEL32(000000FF), ref: 00606BD8

Part of subcall function 0060EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00601DCF,?), ref: 0060EEA8
Part of subcall function 0060EE95: HeapFree.KERNEL32(00000000), ref: 0060EEAF

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 0983866b6ded83c218b6db805dc74890dcb7b5585be94ec93677419446b3fa19
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 917118B194022DEFDB149FA4CC809EEBBBAFB04314F10456AF515E6290E7309EA2DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0043E8CF Relevance: 6.1, APIs: 4, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0043E8EC
__lock.LIBCMT ref: 0043E947
__lock.LIBCMT ref: 0043E968
___addlocaleref.LIBCMT ref: 0043E986

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID:
API String ID: 1628550938-0
Opcode ID: 527085ad0c23569588e8bc56588d9980db29695c3eb2eba31ec3827da0fc121d
Instruction ID: bc4a548131b22b17b9de46e530637c5985591d8a156a8d0739d64019e8320eaa
Opcode Fuzzy Hash: 527085ad0c23569588e8bc56588d9980db29695c3eb2eba31ec3827da0fc121d
Instruction Fuzzy Hash: A7119370901701DAD720AF7BD801B5AB7E0AF08318F10952FE499A76E1CB78A945CF5D

Function 00445B3B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00445B61

Part of subcall function 00445986: __fltout2.LIBCMT ref: 004459B2

__cftog_l.LIBCMT ref: 00445B87
__cftoe_l.LIBCMT ref: 00445BB9

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ae282ed6a95cd7186b08dcf145c2bf78d6f0b8c0a9c18ac976c3c7a0e60f1159
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: B3114E3240098EBBDF125E85CC41CEE3F23FB18354B588456FE1859132D33AD9B1AB86

Function 0060417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006041AB
GetLastError.KERNEL32 ref: 006041B5
WaitForSingleObject.KERNEL32(?,?), ref: 006041C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006041D9

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 35c194dc92fd66c5d657cc669647f3dd5e4e6ce986322f5a436c21874c32ee27
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 97014C7651110AAFDF11DF91ED84BEF3B6DEB18355F0040A1FA01E2190EB70DA908BB5

Function 006041F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0060421F
GetLastError.KERNEL32 ref: 00604229
WaitForSingleObject.KERNEL32(?,?), ref: 0060423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0060424D

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: b2267914e453d815d69778275db9367afa04cbca7e7cbd85fe44bfb71cb13173
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: C40108B2651109AFDF11DF90ED84BEF7BADEB08355F108061FA01E2190DB70DA648BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0060E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0060E066

Strings

A, xrefs: 0060E07F
A, xrefs: 0060E036
A, xrefs: 0060E037, 0060E03C

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 0c2ae73cfe9669cf21beceec8b11ed2fb3762fedbab8fca1a7e1e7ed5c6b57c5
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 65F06871600711DBCB24CF15D8849D3B7EAFF55321B448A2BE155C31A0D3B5A8A4CB51

Function 0043E6F2 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0043E6FE

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 0043E715
__amsg_exit.LIBCMT ref: 0043E723
__lock.LIBCMT ref: 0043E733

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: b78ccc7f9f955085c9a3344ba17983f18658971e1009bcac8464a64a30da5490
Instruction ID: 9113c6c431d65f47a9aeab8c6341431268222f3b6a85bdc93a37d405eae70c95
Opcode Fuzzy Hash: b78ccc7f9f955085c9a3344ba17983f18658971e1009bcac8464a64a30da5490
Instruction Fuzzy Hash: BCF01D35A42701DAE620BB77D40274E73A0AB08718F10616FE445672D2CB3CA9058A9A

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 00608330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006083C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00608477

Part of subcall function 006069C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 006069E5
Part of subcall function 006069C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00606A26
Part of subcall function 006069C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00606A3A

Part of subcall function 0060EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00601DCF,?), ref: 0060EEA8
Part of subcall function 0060EE95: HeapFree.KERNEL32(00000000), ref: 0060EEAF

Strings

PromptOnSecureDesktop, xrefs: 006083B2, 006083B7, 00608483

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: dc6905d8ed84855177189277f6b5df549201cd8d89e89fdb6cacc4e5cc18cbcc
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 2B4194B298010ABFDB18EBA0DD81DFF77AEEB00300F1444AAF544D7191FAB15E548B65

Function 0060E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0060E859,00000000,00020119,0060E859,PromptOnSecureDesktop), ref: 0060E64D
RegCloseKey.ADVAPI32(0060E859,?,?,?,?,000000C8,000000E4), ref: 0060E787

Strings

PromptOnSecureDesktop, xrefs: 0060E637

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: e048254597bc9394ca32861aa3cecaec215f04e1d0411b9ee23e243ba30613e1
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: F34137B2D4011DBFDF11EF94DC81DEFBBBAEB14304F104466F910A6291E3729A558B60

Function 0060AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0060AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0060B00D

Part of subcall function 0060AF6F: gethostname.WS2_32(?,00000080), ref: 0060AF83
Part of subcall function 0060AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0060AFE6

Part of subcall function 0060331C: gethostname.WS2_32(?,00000080), ref: 0060333F
Part of subcall function 0060331C: gethostbyname.WS2_32(?), ref: 00603349

Part of subcall function 0060AA0A: inet_ntoa.WS2_32(00000000), ref: 0060AA10

Strings

%OUTLOOK_BND_, xrefs: 0060B076, 0060B07B, 0060B0BE, 0060B0DD

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: f9a88e25c353402b199e5b9d6398c3dad3fb7cd121a6723e123a395fd7d4071b
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: F741537294020CABDF69EFA0DC46EEF3B6DFF08304F14442AF92592192EB75D6548B58

Function 00609452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00609536
Sleep.KERNEL32(000001F4), ref: 0060955D

Strings

, xrefs: 006094D9

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 613737ed03f357cab549a3687ea981c82f12aceb2df9588eb74e5abe8a71fcc2
Instruction ID: cd3594e48aebd119f322e9e16c43588eeea33a5e37c69adae99acb2114afb12d
Opcode Fuzzy Hash: 613737ed03f357cab549a3687ea981c82f12aceb2df9588eb74e5abe8a71fcc2
Instruction Fuzzy Hash: 9F4104718882856EEB3F8A65DC9C7E77BE79B42314F1840A5D082972E3D6744D828731

Function 0060BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0060B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0060BA3A
InterlockedIncrement.KERNEL32(?), ref: 0060BA94
GetTickCount.KERNEL32 ref: 0060BB79
GetTickCount.KERNEL32 ref: 0060BB99
InterlockedIncrement.KERNEL32(?), ref: 0060BE15
closesocket.WS2_32(00000000), ref: 0060BEB4

Strings

%FROM_EMAIL, xrefs: 0060BC7D

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 51670c4b3fddb2ab554a4af19c4c9b1a14cb7032ae75c4ad32b416f5cad987ad
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 92318F71580248DFDF29DFA4DC44AEA77BAEB44740F20805AFA14922D1DB74DA85CF14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0060709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006070BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006070F4

Strings

|, xrefs: 006070E6

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 09141670dc1b5f3f1294f6c112bada7a973cc035d27214df5169462ca0816dab
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 61111872D44118EBDF15CBD4DC84ADFB7BEAB05301F1841A6E501E61D0D670AB998BA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00442105 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00442114

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 00442122

Strings

csm, xrefs: 00442130

Memory Dump Source

Source File: 00000000.00000002.2133178272.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_6foBmRMlDy.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: dc06647ed881300172cdfc684aac1163bc2a0f868911a398cd8d5672599b3405
Instruction ID: 96f6a5e9f7941ab84f0187159e4ce633c560aaca1b25a4ff6305554a5f7d0553
Opcode Fuzzy Hash: dc06647ed881300172cdfc684aac1163bc2a0f868911a398cd8d5672599b3405
Instruction Fuzzy Hash: FC018B388002018AEF34AF22D5407AEB3B5BF94311FA4542FF441A63A1CBB89D81CF49

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00603189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00602F88: GetModuleHandleA.KERNEL32(?), ref: 00602FA1
Part of subcall function 00602F88: LoadLibraryA.KERNEL32(?), ref: 00602FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006031DA
HeapFree.KERNEL32(00000000), ref: 006031E1

Memory Dump Source

Source File: 00000000.00000002.2133397787.0000000000600000.00000040.00001000.00020000.00000000.sdmp, Offset: 00600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: a7088c39696391252968a096388e7f24de6d2c6100a61351bc921582b74d4ccd
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: FD51DC3194021AAFCB09DF64D8889EAB77AFF09301B1440A8EC9687351E732DB19CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.2133127134.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2133127134.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_6foBmRMlDy.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: lnmlavab.exePID: 5840, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	26.1%
Signature Coverage:	0%
Total number of Nodes:	459
Total number of Limit Nodes:	41

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\6foBmRMlDy.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001838), ref: 0040A4C3

Strings

", xrefs: 00409EDB
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 0040A078
gqbqwogt, xrefs: 0040A389, 0040A397
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 0040A1D9
P, xrefs: 00409DAA
\, xrefs: 00409D0C
%X%08X, xrefs: 0040A0B0
C:\Users\user\Desktop\6foBmRMlDy.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\6foBmRMlDy.exe$C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$D$P$\$gqbqwogt
API String ID: 2089075347-832082967
Opcode ID: 68b797b8a1a511787d44de11c5faf4c0f38f9e92d064f931bb102e5cd7b1cfad
Instruction ID: bd119e6c4087cb98d252ff90c2b4564d186cc4371c54d2626973292121ed4095
Opcode Fuzzy Hash: 68b797b8a1a511787d44de11c5faf4c0f38f9e92d064f931bb102e5cd7b1cfad
Instruction Fuzzy Hash: 0B52A1B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0043B240 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043C50B: __lock.LIBCMT ref: 0043C529
Part of subcall function 0043C50B: ___sbh_find_block.LIBCMT ref: 0043C534
Part of subcall function 0043C50B: ___sbh_free_block.LIBCMT ref: 0043C543

_realloc.LIBCMT ref: 0043B947

Part of subcall function 0043CA60: _malloc.LIBCMT ref: 0043CA76

_fseek.LIBCMT ref: 0043B94F

Strings

|%FH, xrefs: 0043B823
cg P, xrefs: 0043B67F
k3nU, xrefs: 0043B3ED
agYU, xrefs: 0043B7CA
C:7C, xrefs: 0043B6E5
/H;+, xrefs: 0043B6AC
0ugV, xrefs: 0043B41B
$&s, xrefs: 0043B64C
?zEo, xrefs: 0043B316
kd@9, xrefs: 0043B7BF
p7~, xrefs: 0043B672
Z1S9, xrefs: 0043B511

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: ___sbh_find_block___sbh_free_block__lock_fseek_malloc_realloc
String ID: $&s$/H;+$0ugV$?zEo$C:7C$Z1S9$agYU$cg P$k3nU$kd@9$p7~$|%FH
API String ID: 3289479739-3763514964
Opcode ID: 7dcdd3eaea46ffe2a30c8f0310ea7705a34f69824791a8e454ba313e888b229a
Instruction ID: d87394b33d7e6c5c910dd0271f55276661a3dd12386dfd98f108e32f406b15c8
Opcode Fuzzy Hash: 7dcdd3eaea46ffe2a30c8f0310ea7705a34f69824791a8e454ba313e888b229a
Instruction Fuzzy Hash: 8902FCB5609380DFD2708F6AC489B8EFBE4BF85314F40891DE69A9B610D7709885CF97

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 573530a394494cd252acd85827aa24eb1d86e5d70ab511f0ce4f94472402c086
Instruction ID: 197d4fc66f8e4192ef9d41e029ea27591e600de1538a1216c66efdd274428ce7
Opcode Fuzzy Hash: 573530a394494cd252acd85827aa24eb1d86e5d70ab511f0ce4f94472402c086
Instruction Fuzzy Hash: F8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 00D7003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00D7024D

Strings

cess, xrefs: 00D7018D
kernel32.dll, xrefs: 00D7008F, 00D70095

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 378bad5e76836b7b995bf65dfe44e8aaefc7390f33bc4c46cde62e9966ea3d70
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 55526A74A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E54DAB291DB30AE85DF24

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 0043AEB0 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0043AFA0
_feof.LIBCMT ref: 0043AFBA

Part of subcall function 0043ADE0: VirtualProtect.KERNELBASE(0045A480,0045A9F4,00000020,?), ref: 0043AE8F

Strings

{, xrefs: 0043B169
=<9A, xrefs: 0043B15D
89A, xrefs: 0043B157
Bq , xrefs: 0043AEF4

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: ProtectVirtual_feof_strlen
String ID: 89A$=<9A$Bq ${
API String ID: 1251290033-441600927
Opcode ID: bac7f9505f20d68383763d65345367bdbfa94530caf3835c190cf427977607d5
Instruction ID: 17c99ab5acc6df25385ed16af596a2251f632a33a78189a9da60bd62079ab192
Opcode Fuzzy Hash: bac7f9505f20d68383763d65345367bdbfa94530caf3835c190cf427977607d5
Instruction Fuzzy Hash: 94910371940350AFD710ABA0ED49FAA3B74FB49716F00013AF645B62E2C7B85640CBEE

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 8d14f0f9d29bb03ce564d9d2efa64e335a6ea708645b73911051f25a1151d1b7
Instruction ID: 9669132274562be234db05f10d2b02b24c7977acc8fbe0bb4274004673291573
Opcode Fuzzy Hash: 8d14f0f9d29bb03ce564d9d2efa64e335a6ea708645b73911051f25a1151d1b7
Instruction Fuzzy Hash: 1A4181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F604B21C1D7389A51DBA4

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 0043ADE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0045A480,0045A9F4,00000020,?), ref: 0043AE8F

Strings

, xrefs: 0043AE76

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 01f13a5192d663de11e313c2b231697ccad97762487919bd531801ef589a38fb
Instruction ID: dc8660ecb2c9a0ef57b55d70a2a8dc3997a93980919400bc7a706f5d6ada5fb8
Opcode Fuzzy Hash: 01f13a5192d663de11e313c2b231697ccad97762487919bd531801ef589a38fb
Instruction Fuzzy Hash: 08114C746883C0DEE301CB78BD48F563FA55322307F1501B8D484432BBE2B6A658CBBA

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 0073CD4B Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0073CD73
Module32First.KERNEL32(00000000,00000224), ref: 0073CD93

Memory Dump Source

Source File: 0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_72d000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e65b464a5c065ac5ba64b70bccdd76dc551b204214777cc43e3f27c432ce6107
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4AF0C231200710BFE7212BF49C8CB6A7AE8AF49724F100138F646A10C1DA74EC058761

Function 00D70E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00D70223,?,?), ref: 00D70E19
SetErrorMode.KERNELBASE(00000000,?,?,00D70223,?,?), ref: 00D70E1E

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 2762a91926a1f5a926c02bf7060ede664ceebc7a5e5fee287f75921d9fd7d195
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: D9D01232245228B7DB002A94DC09BCEBF1CDF09BA2F048421FB0DE9080CBB09A4046EA

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 54bc16a58432e014760a8219cb6401776c0b2f7f4e35f25b0da1a83a0963d2cd
Instruction ID: 594da891b9e57e87d6aa513f65a0e563028cfc4c29bd5910f078fc56da7159a2
Opcode Fuzzy Hash: 54bc16a58432e014760a8219cb6401776c0b2f7f4e35f25b0da1a83a0963d2cd
Instruction Fuzzy Hash: 84F0C2B6104218AFD710DB64EEC4FE77BAED714308F1084B6F286E3141D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 0043EEEE Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0043EF03

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: ba49affe4ba948a0bcfaba6f076b34328c56a29a8243271a74c8c5a257fdd3ef
Instruction ID: c47c4244610d5876d865f45c43479abe6b0c6b95a462d5fe56188cfb810440df
Opcode Fuzzy Hash: ba49affe4ba948a0bcfaba6f076b34328c56a29a8243271a74c8c5a257fdd3ef
Instruction Fuzzy Hash: EED05E765583486EDB105F716C087263BDCA388396F044436B90CC6190E7B5C940C508

Function 0073CA0A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0073CA5B

Memory Dump Source

Source File: 0000000C.00000002.2130315965.000000000072D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0072D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_72d000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 26e07ffa80174fc54d8b7de4562cf9380a7f7e7ba7da5eeac39c307ba590413a
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9F112A79A00208EFDB01DF98C985E98BBF5AF08351F1580A4F948AB362D375EA50DB90

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 00D765E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00D765F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00D76610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 00D76631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 00D76652

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: af0589ea6862a97b62c587bb980df2ff119c90bbf06b67c4d232caabbad29e60
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: FF115171600218BFDB219F65DC46F9B3FA8EB057A5F148064FA08A7251F6B1DD009AB4

Function 00D79EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00D79E6D
lstrcpy.KERNEL32(?,00000000), ref: 00D79FE1
lstrcat.KERNEL32(?,?), ref: 00D79FF2
lstrcat.KERNEL32(?,0041070C), ref: 00D7A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 00D7A054
DeleteFileA.KERNEL32(?), ref: 00D7A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00D7A0D6
lstrcpy.KERNEL32 ref: 00D7A12F
lstrlen.KERNEL32(00000022), ref: 00D7A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 00D79F13

Part of subcall function 00D77029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 00D77081

Part of subcall function 00D76F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\cmxmskcp,00D77043), ref: 00D76F4E
Part of subcall function 00D76F30: GetProcAddress.KERNEL32(00000000), ref: 00D76F55
Part of subcall function 00D76F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00D76F7B
Part of subcall function 00D76F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00D76F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 00D7A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 00D7A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 00D7A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 00D7A21B
GetDriveTypeA.KERNEL32(?), ref: 00D7A265
lstrcat.KERNEL32(?,00000000), ref: 00D7A29F
lstrcat.KERNEL32(?,00410A34), ref: 00D7A2C5
lstrcat.KERNEL32(?,00000022), ref: 00D7A2D9
lstrcat.KERNEL32(?,00410A34), ref: 00D7A2F4
wsprintfA.USER32 ref: 00D7A31D
lstrcat.KERNEL32(?,00000000), ref: 00D7A345
lstrcat.KERNEL32(?,?), ref: 00D7A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 00D7A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 00D7A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 00D7A1D1

Part of subcall function 00D79966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00D7999D
Part of subcall function 00D79966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 00D799BD
Part of subcall function 00D79966: RegCloseKey.ADVAPI32(?), ref: 00D799C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 00D7A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 00D7A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 00D7A41D

Strings

\, xrefs: 00D79F73
P, xrefs: 00D7A011
", xrefs: 00D7A142
", xrefs: 00D7A2DF
", xrefs: 00D7A3F0
D, xrefs: 00D7A1F5

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: f09d99bef10a707308c08a341eb846df543125ad02325dd00d10b794679eceeb
Instruction ID: 28c86946f18af0390c8b3291b3858272d08dbf26d1e14e39f28d07d4078d985a
Opcode Fuzzy Hash: f09d99bef10a707308c08a341eb846df543125ad02325dd00d10b794679eceeb
Instruction Fuzzy Hash: 51F133B1D40259AFDF21DBA48C49EEFBBBCAB48300F5484A6F509E2141F7758A848F75

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlAllocateAndInitializeSid, xrefs: 0040120F
ntdll.dll, xrefs: 0040100D
NtClose, xrefs: 004011B4
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
NtQueryInformationToken, xrefs: 00401262
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
RtlSetLastWin32Error, xrefs: 004010D6
NtTerminateProcess, xrefs: 004010F6
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
RtlNtStatusToDosError, xrefs: 00401194
RtlFreeSid, xrefs: 00401116
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sat, xrefs: 0040B24F
Jan, xrefs: 0040B256
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Tue, xrefs: 0040B233
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Jul, xrefs: 0040B280
Fri, xrefs: 0040B248
Apr, xrefs: 0040B26B
May, xrefs: 0040B272
Feb, xrefs: 0040B25D
Sun, xrefs: 0040B225
Jun, xrefs: 0040B279
Mar, xrefs: 0040B264
Wed, xrefs: 0040B23A
Dec, xrefs: 0040B2A3
Thu, xrefs: 0040B241
Nov, xrefs: 0040B29C
Mon, xrefs: 0040B22C
Oct, xrefs: 0040B295

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$D
API String ID: 2976863881-2668765463
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00D77CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00D77D21
GetUserNameA.ADVAPI32(?,?), ref: 00D77D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00D77D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00D77DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00D77DC0
EqualSid.ADVAPI32(?,?), ref: 00D77DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 00D77DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00D77DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00D77E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00D77E12
LocalFree.KERNEL32(00000000), ref: 00D77E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D77E35

Strings

D, xrefs: 00D77D73
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 00D77F49, 00D77F76, 00D77F8A, 00D77F8B

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$D
API String ID: 2976863881-2668765463
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 32a309a3117da9000bd3b3b506a30cebafa397025a933bab8edd8e03b72e5ad6
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 55A14D71900259AFDF118FA4DD88FEEBBB9FF08300F14846AF509E6150EB758A85CB64

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

except_info, xrefs: 00406728
plgs:, xrefs: 004066AA
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 64bdd4d646a522699b5472447b714269db1a1731565c65632a199503b6103360
Instruction ID: 302e59d67534013c0e033960a005fbe7b570eed1172f45d0d905d428b8e71e1f
Opcode Fuzzy Hash: 64bdd4d646a522699b5472447b714269db1a1731565c65632a199503b6103360
Instruction Fuzzy Hash: 87616F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Incorrect respons, xrefs: 0040AB39
AUTH LOGIN, xrefs: 0040A80C
quit, xrefs: 0040A86C
ESMTP, xrefs: 0040AA38
helo %s, xrefs: 0040A803
localcfg, xrefs: 0040AB0B
rcpt to:<%s>, xrefs: 0040A855
data, xrefs: 0040A85E
., xrefs: 0040A8CA

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00D77A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00D77A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00D77ACD
GetLengthSid.ADVAPI32(?), ref: 00D77ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00D77B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00D77B1F
EqualSid.ADVAPI32(?,?), ref: 00D77B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 00D77B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00D77B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00D77B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00D77B77
LocalFree.KERNEL32(00000000), ref: 00D77B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D77B9A
GetAce.ADVAPI32(?,?,?), ref: 00D77BCA
EqualSid.ADVAPI32(?,?), ref: 00D77BF1
DeleteAce.ADVAPI32(?,?), ref: 00D77C0A
EqualSid.ADVAPI32(?,?), ref: 00D77C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 00D77CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00D77CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00D77CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00D77CE0
LocalFree.KERNEL32(00000000), ref: 00D77CEE

Strings

D, xrefs: 00D77AC3

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 548678f98bf6af5ee7878ad4a9f47db61d44c7909a2dadae65351f1c2a8d2732
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: CB814F71904219AFDB12CFA4DD44FEEBBB8EF0C300F18846AE509E6150E7759A41CBA4

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$localcfg
API String ID: 237177642-2863267139
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

@, xrefs: 00401380
uac, xrefs: 00401628
, xrefs: 00401462
<, xrefs: 00401378
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
useless, xrefs: 0040161E

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
work_srv, xrefs: 00401E5E
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
born_date, xrefs: 00401EAD, 00401ECC
loader_id, xrefs: 00401F4B, 00401F6B
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: f83cae532fda0f7b628782386ce8b2feec09b1d0c3fd7cfd61acfb995292e920
Instruction ID: d6b35303784bc7068dc70d414bcf7f40aad10565f6e4a34c223da57409024e49
Opcode Fuzzy Hash: f83cae532fda0f7b628782386ce8b2feec09b1d0c3fd7cfd61acfb995292e920
Instruction Fuzzy Hash: 9651EA705043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA95487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
localcfg, xrefs: 004019A3
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
Iphlpapi.dll, xrefs: 004019B7

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 00D7858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00D7865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00D7867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00D786A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00D786B1

Strings

", xrefs: 00D7896C
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 00D7882F, 00D7883C, 00D7884C

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe
API String ID: 237177642-2678118854
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: c7c58f892ba44053ee145756bc67f5bd77b4fae661e54c241737af15ffee961e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 55C18471940249BEEB11ABA4DD89EEF7B7DEB04300F188076F609E6051FB704A94AB75

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00D714E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00D71601
lstrlenW.KERNEL32(-00000003), ref: 00D717D8

Strings

, xrefs: 00D716C9
D, xrefs: 00D7182D
@, xrefs: 00D715E7
<, xrefs: 00D715DF

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 2ce56e4f1902ac4c83f1a00d70adcbea95accc6f8fea1a41ddf3645813bd7f0f
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 72F190B55083419FD720CF68C889BABB7E4FB88300F148A2DF69997290E774D945CB62

Function 00D77666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 00D776D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00D77757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00D7778F
___ascii_stricmp.LIBCMT ref: 00D778B4
RegCloseKey.ADVAPI32(?), ref: 00D7794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00D7796D
RegCloseKey.ADVAPI32(?), ref: 00D7797E
RegCloseKey.ADVAPI32(?), ref: 00D779AC
RegCloseKey.ADVAPI32(?), ref: 00D77A56

Part of subcall function 00D7F40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,00D7772A,?), ref: 00D7F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00D779F6
RegCloseKey.ADVAPI32(?), ref: 00D77A4D

Strings

", xrefs: 00D77800

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: ee68fc272f5aca9451a2f3cc8bacf15325f24d7edfc7c02b11cb973e6eadd9ed
Instruction ID: 0ad9bf5db6b93752658bee5267f527fb58940476b1077d7a7cbdbbf0d7477051
Opcode Fuzzy Hash: ee68fc272f5aca9451a2f3cc8bacf15325f24d7edfc7c02b11cb973e6eadd9ed
Instruction Fuzzy Hash: 80C18272904209AFEB21DBA4DC45FEEBBB9EF45310F1484A5F508E6191FB71DA848B70

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 3f864b9e64e2f7a1d4d97f78ecf1fd3725cd2b03a8b023efc5a10220ad7d3397
Instruction ID: 7765b981cd58ee1688e4c4772d4ab21dab1833365f63e39a1c5bd68b3cda8b0b
Opcode Fuzzy Hash: 3f864b9e64e2f7a1d4d97f78ecf1fd3725cd2b03a8b023efc5a10220ad7d3397
Instruction Fuzzy Hash: E2B17071D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 00D72CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D72CED
socket.WS2_32(00000002,00000002,00000011), ref: 00D72D07
htons.WS2_32(00000000), ref: 00D72D42
select.WS2_32 ref: 00D72D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 00D72DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00D72E62

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: f981581ceac0e363a9200ae42dc7bbf82f5506728d83e5eb606cb9b07012400d
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: B161E071504385ABC3209F65DC48B7BBBF8EF48351F148819F98897251E7B4D8808BB6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
127.0.0.1, xrefs: 0040ADEB
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: dd8323cc3663becab7e2967d3efa69540a9c24c17e68938a9fe8f8f1d062e2db
Instruction ID: 06034c09a380b67456f64a6cc71bbc1075b83f40537ea60a42ab4a6d8e407b0f
Opcode Fuzzy Hash: dd8323cc3663becab7e2967d3efa69540a9c24c17e68938a9fe8f8f1d062e2db
Instruction Fuzzy Hash: 3AA181B2540208BBEB21DFA1CC45FDF3BACEB44344F104437FA05A6192D7B999948FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_DOMAIN, xrefs: 0040B41E
%TO_EMAIL, xrefs: 0040B473
%TO_DOMAIN, xrefs: 0040B44B
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_EMAIL, xrefs: 0040B3E9
%TO_HASH, xrefs: 0040B4B0
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 00D71FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00D7202D
GetSystemInfo.KERNEL32(?), ref: 00D7204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00D7206A
GetProcAddress.KERNEL32(00000000), ref: 00D72071
GetCurrentProcess.KERNEL32(?), ref: 00D72082
GetTickCount.KERNEL32 ref: 00D72230

Part of subcall function 00D71E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 00D71E7C

Strings

localcfg, xrefs: 00D72091, 00D72098, 00D720AB, 00D720E4, 00D720F3, 00D72119, 00D72138, 00D7214E, 00D72166, 00D72183, 00D7219B, 00D721B7, 00D721D7
flags_upd, xrefs: 00D720A5, 00D720AA, 00D720E3
hi_id, xrefs: 00D7217D, 00D72182, 00D7219A
work_srv, xrefs: 00D720C5

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 1c05908e8332f2c0f6c33c38143c7fb2cde288243502d8b530b502e0e60caf20
Instruction ID: df1a970853ae3a683ffb097f151978d6796622a3c37fd500e46dfe72005785bb
Opcode Fuzzy Hash: 1c05908e8332f2c0f6c33c38143c7fb2cde288243502d8b530b502e0e60caf20
Instruction Fuzzy Hash: 4E51A4B09003446FE330AF658C86F67BBECEB55704F44892DF99E82142F7B9A9848775

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 00D73059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00D73068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00D73078
GetProcAddress.KERNEL32(00000000,00410408), ref: 00D73095
RtlAllocateHeap.NTDLL(00000000), ref: 00D730B6
htons.WS2_32(00000035), ref: 00D730EF
inet_addr.WS2_32(?), ref: 00D730FA
gethostbyname.WS2_32(?), ref: 00D7310D
HeapFree.KERNEL32(00000000), ref: 00D7314D

Strings

iphlpapi.dll, xrefs: 00D73062, 00D73067, 00D73077

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 61ab24285c855f7272049497d0a5810f425d0fab57cfc3983796e6327cc5aef5
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: C0319531A00706ABDF119BB49C49AAE7778AF04760F58C125E91CE7290EB74DA419B64

Function 00D7958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00D795A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 00D795D5
GetModuleFileNameA.KERNEL32(00000000), ref: 00D795DC
wsprintfA.USER32 ref: 00D79635
wsprintfA.USER32 ref: 00D79673
wsprintfA.USER32 ref: 00D796F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00D79758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00D7978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00D797D8

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: e35f04148ce3af63e99fbb061a16182ac2415cb778cceb4801d6d6173470cb1c
Instruction ID: 9de33349ec8de31ce36edf3988a0711f5d27330ce01af65a0bbc8ffcbd2e6cf1
Opcode Fuzzy Hash: e35f04148ce3af63e99fbb061a16182ac2415cb778cceb4801d6d6173470cb1c
Instruction Fuzzy Hash: 8AA18DB2900208AFEB25DFA4CC55FDA7BACEB05300F108026FA09D6151F7B5D984CBB5

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction ID: 39f8afa0f9c16d59a54efa000c115c62b3535d7a3470d06cdb9238e0f04a129a
Opcode Fuzzy Hash: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction Fuzzy Hash: C531E0B2900108BFDB01DFA09D44ADF7F78AF48314F158076E112F7291D778A9648F69

Function 00D76778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 00D767C3
htonl.WS2_32(?), ref: 00D767DF
htonl.WS2_32(?), ref: 00D767EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 00D768F1
ExitProcess.KERNEL32 ref: 00D769BC

Strings

localcfg, xrefs: 00D76994
except_info, xrefs: 00D7698F

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 509986b44764779889ec140751805dc5d86e13b3ca1e1aa93028e23e5d2d1926
Instruction ID: 9a7cc3c831fb0917414932bb97dc144081645535a685cfc31f1c629e597d7374
Opcode Fuzzy Hash: 509986b44764779889ec140751805dc5d86e13b3ca1e1aa93028e23e5d2d1926
Instruction Fuzzy Hash: 93616E71A40208AFDB609FB4DC45FEA77E9FB08300F248066FA6DD2161EB7599948F64

Function 00D7F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00D7CC84), ref: 00D7F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 00D7F5CE
closesocket.WS2_32(00000000), ref: 00D7F5DC

Strings

time_cfg, xrefs: 00D7F58A

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 04eed95930fafb1e532d556ba6384d4bdd2e6d89feeaecab57dd84be9894af62
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: D1316072900118ABDB20DFA5DC85DEF7BBCEF49310F108576F919D3150E7709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 00D72F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00D72FA1
LoadLibraryA.KERNEL32(?), ref: 00D72FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00D72FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00D73000
RtlAllocateHeap.NTDLL(00000000), ref: 00D73007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 00D73032

Strings

dnsapi.dll, xrefs: 00D72F90

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 54a623e7ca50359f0691b2845bfd538e84fb5044beadbf4ff2fd8300fb1f9659
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 52216071901629BBCB219F65DC49EAEFBB8EF08B50F148421F909E7140E7B49EC197E4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 00D799E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00D79A18
GetThreadContext.KERNEL32(?,?), ref: 00D79A52
TerminateProcess.KERNEL32(?,00000000), ref: 00D79A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00D79A98
SetThreadContext.KERNEL32(?,00010002), ref: 00D79AB5
ResumeThread.KERNEL32(?), ref: 00D79AC2

Strings

D, xrefs: 00D79A10

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: fa7bb2d4ecd93f33223b222884586b05cb48b2e48f74ab0dafadceab8ae19d50
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: D5213D72902219BBDB11DBA1DC09EEFBBBCEF05750F448061BA19E5150F7758A44CBB4

Function 00D71C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00D71C18
LoadLibraryA.KERNEL32(004102C8), ref: 00D71C26
GetProcessHeap.KERNEL32 ref: 00D71C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00D71C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00D71CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 00D71D02
FreeLibrary.KERNEL32(?), ref: 00D71D0B

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 03731f461915edb934bf91966c8ea4d36e9d06897a5fe9dfcad061e5628b65d0
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: F7314336D00219BFCB219FE8DC888FEBBB9EB45711B28857AE505A2110E7B54D80DB64

Function 00D76CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00D76CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00D76D22
GetLastError.KERNEL32 ref: 00D76DA7
CloseHandle.KERNEL32(?), ref: 00D76DB5
GetLastError.KERNEL32 ref: 00D76DD6
DeleteFileA.KERNEL32(?), ref: 00D76DE7
GetLastError.KERNEL32 ref: 00D76DFD

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction ID: ba16f7aa594475d73aaf3a051c3be45071dd1797771d8a885c5beeb4f9864bd6
Opcode Fuzzy Hash: f90c53903c5e7bc53eced6da245d78f0497ab651d24c434d9efbd75cec7a0e65
Instruction Fuzzy Hash: 2E310E72A00649BFCB21DFA49D48ADE7F78EB48300F18C065E259E3211F7708A988B75

Function 00D76F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\cmxmskcp,00D77043), ref: 00D76F4E
GetProcAddress.KERNEL32(00000000), ref: 00D76F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00D76F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00D76F92

Strings

\\.\pipe\cmxmskcp, xrefs: 00D76F37
C:\Windows\SysWOW64\, xrefs: 00D76F30, 00D76F38, 00D76F65, 00D76F6C, 00D76F7A, 00D76F85, 00D76F91, 00D76FA9, 00D76FC6, 00D76FEC

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\cmxmskcp
API String ID: 1082366364-3093387212
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: a5522164844f7a239b44152a4a08d1f87a1383c6ac48e1b60374cb403deefe97
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 4421CF217453407AF7325335AC89FBB2A5C8F52720F1CC0A5F948A6191FAD9C8D682BD

Function 00D7AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00D7AAE5

Strings

localcfg, xrefs: 00D7AD72
, xrefs: 00D7ABB3

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 5e65a1ea47d00e255dd02fbb77232059c24100c0a0f67edb0051873f43de18f9
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 80710872A40314BADF319B5CDC86BEE3769DB80715F28C067F90CA6091FA629D848777

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 00D7E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7DF6C: GetCurrentThreadId.KERNEL32 ref: 00D7DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 00D7E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00D76128), ref: 00D7E950
lstrcmp.KERNEL32(?,00000008), ref: 00D7E989

Strings

A, xrefs: 00D7E960, 00D7E965
A, xrefs: 00D7E8C6, 00D7E8CD, 00D7E936, 00D7E998
A, xrefs: 00D7E9A0

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: b04b4933ae8572374221ab5ea4a61207db99e21e41c2ccd4fdee243017d35663
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: B731B0326007059BCB71CF24C884BA67BE4EF09320F58C9AAE69987551F370E880CFA1

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 00D76E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00D76E19

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: fa71bf60281b41d26faac38e60196e76cad4da0bd0d52f52721134ddb1644554
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: D4214A76204619BFDB119BA0EC49EDF3FADEB49360B24C465F50AD1091FB70DA409674

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 00D792CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 00D792E2
wsprintfA.USER32 ref: 00D79350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00D79375
lstrlen.KERNEL32(?,?,00000000), ref: 00D79389
WriteFile.KERNEL32(00000000,?,00000000), ref: 00D79394
CloseHandle.KERNEL32(00000000), ref: 00D7939B

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: da4fcd9ef3978045be792a22e05583ede1c533b561f36ba9c239ceb8060e86c1
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 0E117FB26401147BE7206B32EC0EFEF7A6DDFC8B10F00C065BB09A5091FAB44A4186B4

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 00D7C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00D7C6B4
InterlockedIncrement.KERNEL32(00D7C74B), ref: 00D7C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,00D7C747), ref: 00D7C728
CloseHandle.KERNEL32(00000000,?,00D7C747,00413588,00D78A77), ref: 00D7C733

Strings

localcfg, xrefs: 00D7C544

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 244d38784e906c826c6cb62bc6d9e671aa09a51be3f54e9f928a62bd11adbbd4
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 25515FB1611B418FD7348F29C5C552ABBE9FB48300B54A93EE18BC7AA0E774F840CB20

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe
API String ID: 124786226-3352897057
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 00D771C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00D771E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00D77228
LocalFree.KERNEL32(?,?,?), ref: 00D77286
wsprintfA.USER32 ref: 00D7729D

Strings

|, xrefs: 00D7721A

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: be0500e370c099c6d186e95ba5e40b8b224f2e97665b25f868adb257814afbf5
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: E5312972A04208BFDB11DFA8DC45BDA7BACEF04314F14C066F959DB211EA75DA488BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00D7B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D7B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D7B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D7B548
GetTimeZoneInformation.KERNEL32(?), ref: 00D7B590
wsprintfA.USER32 ref: 00D7B61E

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 8bb4fadb07ad4487435ade9db077f9e5fcd35eac548462eae27c544bc323fe10
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 6A512EB1D0021CAACF14DFD5D8885EEBBB9AF48314F14816BF505A6150E7B84AC9CFA8

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00D762D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 00D76303
LoadLibraryA.KERNEL32(?), ref: 00D7632A
GetProcAddress.KERNEL32(00000000,?), ref: 00D763B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 00D76405

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 78e92423144b01283f0cc8a63ad4d626d06589c8c6c4d43ccfc72489d92fe64c
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 86414B71A04A09EBDB14CF68C884AA9B7B8EF04358F2CC169E959D7290F771ED40CB60

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00D793AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 00D793C6
GetModuleFileNameA.KERNEL32(00000000), ref: 00D793CD
CharToOemA.USER32(?,?), ref: 00D793DB
wsprintfA.USER32 ref: 00D79410

Part of subcall function 00D792CB: GetTempPathA.KERNEL32(00000400,?), ref: 00D792E2
Part of subcall function 00D792CB: wsprintfA.USER32 ref: 00D79350
Part of subcall function 00D792CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00D79375
Part of subcall function 00D792CB: lstrlen.KERNEL32(?,?,00000000), ref: 00D79389
Part of subcall function 00D792CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 00D79394
Part of subcall function 00D792CB: CloseHandle.KERNEL32(00000000), ref: 00D7939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00D79448

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 9ee5502d6b1626ba5bccabadc592a454e35a99caa8a27d45ed12fc19152cc61f
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 19015EF69001587BDB21A7619D89EDF7B7CDB95701F0040A2BB49E2080EAB49AC58F75

Function 00441FDF Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00442007

Part of subcall function 0043D346: __getptd.LIBCMT ref: 0043D354
Part of subcall function 0043D346: __getptd.LIBCMT ref: 0043D362

__getptd.LIBCMT ref: 00442011

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 0044201F
__getptd.LIBCMT ref: 0044202D
__getptd.LIBCMT ref: 00442038

Part of subcall function 0043D3EB: __CallSettingFrame@12.LIBCMT ref: 0043D437

Part of subcall function 00442105: __getptd.LIBCMT ref: 00442114
Part of subcall function 00442105: __getptd.LIBCMT ref: 00442122

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 82b52318a1209ef730d5319d681579c68b95efd4f15e921cb8a75d79ffafd6a1
Instruction ID: 1f26d2b162cf52cccfd16e20c8fbb1d915908f5f3995bdd14c1524195890a431
Opcode Fuzzy Hash: 82b52318a1209ef730d5319d681579c68b95efd4f15e921cb8a75d79ffafd6a1
Instruction Fuzzy Hash: 8A1107B1D01209DFDB00EFA5D845AEDBBB1FF08314F10906AF814B7292DB789A159F54

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 0044238C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0044239F

Part of subcall function 004422FA: ___BuildCatchObjectHelper.LIBCMT ref: 00442330

_UnwindNestedFrames.LIBCMT ref: 004423B6
___FrameUnwindToState.LIBCMT ref: 004423C4

Strings

csm, xrefs: 0044239B, 004423B0, 004423C3, 004423E1, 004423F1

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 84f9305d874a50c559aacd72def427a465394a76ca2251e82b6bc0fb57543b16
Instruction ID: 162b1056426cc82c358fe9af72ed69cc294d3496da7099d7d246f226f1b9182b
Opcode Fuzzy Hash: 84f9305d874a50c559aacd72def427a465394a76ca2251e82b6bc0fb57543b16
Instruction Fuzzy Hash: 85012471400109BBEF226E62CD45EAA7E7AFF08358F004016BD1815121D7BA99B2EBA8

Function 00D728EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 00D728FA
gethostbyname.WS2_32(u6A), ref: 00D72906

Strings

time_cfg, xrefs: 00D728EB
u6A, xrefs: 00D728EC, 00D728F9, 00D72905

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 4d9b1e0b6c290b044801e3cc8cdbba9a8ac1f2abfdc93a476c1d8991735df849
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 75E0C2306041518FCB008B2CF888AE537E4EF0A330F08C180F048C31A0D734DDC09B61

Function 00D769C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 00D769E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 00D76A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 00D76A3A
CloseHandle.KERNEL32(000000FF), ref: 00D76BD8

Part of subcall function 00D7EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00D71DCF,?), ref: 00D7EEA8
Part of subcall function 00D7EE95: HeapFree.KERNEL32(00000000), ref: 00D7EEAF

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: e5159148b0a4016446cbbfa7d51434dee4ece8aa56b3847bcffa3f6946d0ed07
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: A171297190061DEFDF11DFA4CC809EEBBB9FB05314F14856AE519E6190E7309E92DB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 00D7E2FC Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00D7E50A,00000000,00000000,00000000,00020106,00000000,00D7E50A,00000000,000000E4), ref: 00D7E319
RegSetValueExA.ADVAPI32(00D7E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 00D7E38E
RegDeleteValueA.ADVAPI32(00D7E50A,?,?,?,?,?,000000C8,004122F8), ref: 00D7E3BF
RegCloseKey.ADVAPI32(00D7E50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,00D7E50A), ref: 00D7E3C8

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: f8498b0f1007134ba49f66cae25e55bf493851bb782f7734cd82a3a8529ad0b6
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: EB213C71A0021DBBDF209FA5EC89EEE7F79EF09750F148061F908E7161E6718A54D7A0

Function 0043E8CF Relevance: 6.1, APIs: 4, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0043E8EC
__lock.LIBCMT ref: 0043E947
__lock.LIBCMT ref: 0043E968
___addlocaleref.LIBCMT ref: 0043E986

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID:
API String ID: 1628550938-0
Opcode ID: 527085ad0c23569588e8bc56588d9980db29695c3eb2eba31ec3827da0fc121d
Instruction ID: bc4a548131b22b17b9de46e530637c5985591d8a156a8d0739d64019e8320eaa
Opcode Fuzzy Hash: 527085ad0c23569588e8bc56588d9980db29695c3eb2eba31ec3827da0fc121d
Instruction Fuzzy Hash: A7119370901701DAD720AF7BD801B5AB7E0AF08318F10952FE499A76E1CB78A945CF5D

Function 00445B3B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00445B61

Part of subcall function 00445986: __fltout2.LIBCMT ref: 004459B2

__cftog_l.LIBCMT ref: 00445B87
__cftoe_l.LIBCMT ref: 00445BB9

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: ae282ed6a95cd7186b08dcf145c2bf78d6f0b8c0a9c18ac976c3c7a0e60f1159
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: B3114E3240098EBBDF125E85CC41CEE3F23FB18354B588456FE1859132D33AD9B1AB86

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 00D741F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00D7421F
GetLastError.KERNEL32 ref: 00D74229
WaitForSingleObject.KERNEL32(?,?), ref: 00D7423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D7424D

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 5ceadbd31ce54618ab8c33de0177aef0fb31acb881c21471a684344c0664b4c9
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: C4010872511109AFDF02DF90ED84BEF7BACEB08365F108061F905E2451E770DA648BBA

Function 00D7417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00D741AB
GetLastError.KERNEL32 ref: 00D741B5
WaitForSingleObject.KERNEL32(?,?), ref: 00D741C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D741D9

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 561984ed873f25ac4d15f5f04e43f0393555d514e1f2e519878486904aa1ab6f
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: CB014C7651121AAFDF02EF90ED84BEF3B6CEB18356F448065F905E2050E770DA908BB5

Function 00D7E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 00D7E066

Strings

A, xrefs: 00D7E07F
A, xrefs: 00D7E036
A, xrefs: 00D7E037, 00D7E03C

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 1e374b6f99a42f7531a2e960ee506fce0dda0f6784d62e4c0700c94af4fde0e8
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: B1F062312007129BCF20CF25D884A82B7E9FB09321B48C6AAE158C3060E3B4A898CB61

Function 0043E6F2 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0043E6FE

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 0043E715
__amsg_exit.LIBCMT ref: 0043E723
__lock.LIBCMT ref: 0043E733

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: b78ccc7f9f955085c9a3344ba17983f18658971e1009bcac8464a64a30da5490
Instruction ID: 9113c6c431d65f47a9aeab8c6341431268222f3b6a85bdc93a37d405eae70c95
Opcode Fuzzy Hash: b78ccc7f9f955085c9a3344ba17983f18658971e1009bcac8464a64a30da5490
Instruction Fuzzy Hash: BCF01D35A42701DAE620BB77D40274E73A0AB08718F10616FE445672D2CB3CA9058A9A

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 00D78330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 00D783C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00D78477

Part of subcall function 00D769C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 00D769E5
Part of subcall function 00D769C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 00D76A26
Part of subcall function 00D769C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 00D76A3A

Part of subcall function 00D7EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,00D71DCF,?), ref: 00D7EEA8
Part of subcall function 00D7EE95: HeapFree.KERNEL32(00000000), ref: 00D7EEAF

Strings

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 00D7848C, 00D784A1

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe
API String ID: 359188348-3352897057
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 0c1ae79636bde4a64df2df130f80ac65d4529bea8e8e29331a686f9874451409
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 084193B2D40109BFEB20EBA09D85DFF777DEB04314F1884A6F508D6011FAB05A849B74

Function 00D7AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D7AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D7B00D

Part of subcall function 00D7AF6F: gethostname.WS2_32(?,00000080), ref: 00D7AF83
Part of subcall function 00D7AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 00D7AFE6

Part of subcall function 00D7331C: gethostname.WS2_32(?,00000080), ref: 00D7333F
Part of subcall function 00D7331C: gethostbyname.WS2_32(?), ref: 00D73349

Part of subcall function 00D7AA0A: inet_ntoa.WS2_32(00000000), ref: 00D7AA10

Strings

%OUTLOOK_BND_, xrefs: 00D7B076, 00D7B07B, 00D7B0BE, 00D7B0DD

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 02c4ce8fc7e1d64894c52a6418a3a935f64f527c8233f7e95bb6cb3bb9c223cd
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 0841037290024CABDB25EFA0DC46FEF376CFF08314F14842AF91992152EA75D6549B74

Function 00D79452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 00D79536
Sleep.KERNEL32(000001F4), ref: 00D7955D

Strings

, xrefs: 00D794D9

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 613737ed03f357cab549a3687ea981c82f12aceb2df9588eb74e5abe8a71fcc2
Instruction ID: 5193883d5e0ad4030098b8bfd568f461448561e1ef91956ee5b2adb7bb862edf
Opcode Fuzzy Hash: 613737ed03f357cab549a3687ea981c82f12aceb2df9588eb74e5abe8a71fcc2
Instruction Fuzzy Hash: B941F7738083A46EEB378B78D8AD7A6BBA49B02314F1CC1A5D48A571A2F6744D818731

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 00D7BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00D7B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 00D7BA3A
InterlockedIncrement.KERNEL32(?), ref: 00D7BA94
GetTickCount.KERNEL32 ref: 00D7BB79
GetTickCount.KERNEL32 ref: 00D7BB99
InterlockedIncrement.KERNEL32(?), ref: 00D7BE15
closesocket.WS2_32(00000000), ref: 00D7BEB4

Strings

%FROM_EMAIL, xrefs: 00D7BC7D

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 913ca338bf9ab4f04404473dffdaa565d572e8179a13f12b4125726c321c7681
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 6E317C71400248DFDF25DFA4DC85BED77A8EB48710F24805AFA2882261FB75DA85CF20

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 00D7709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00D770BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 00D770F4

Strings

|, xrefs: 00D770E6

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 1cec5a6fd6a5d87f5e2e9f0fdc9b90fd257a35c952a3895e895fc50eab8d9d3b
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: BF115E72A0421CEBDF11CFD4DC84ADEB7BCAB04301F5491A6E905E6090E7709B88CBB0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 00442105 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00442114

Part of subcall function 0043EA2F: __getptd_noexit.LIBCMT ref: 0043EA32
Part of subcall function 0043EA2F: __amsg_exit.LIBCMT ref: 0043EA3F

__getptd.LIBCMT ref: 00442122

Strings

csm, xrefs: 00442130

Memory Dump Source

Source File: 0000000C.00000002.2130046316.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_lnmlavab.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: dc06647ed881300172cdfc684aac1163bc2a0f868911a398cd8d5672599b3405
Instruction ID: 96f6a5e9f7941ab84f0187159e4ce633c560aaca1b25a4ff6305554a5f7d0553
Opcode Fuzzy Hash: dc06647ed881300172cdfc684aac1163bc2a0f868911a398cd8d5672599b3405
Instruction Fuzzy Hash: FC018B388002018AEF34AF22D5407AEB3B5BF94311FA4542FF441A63A1CBB89D81CF49

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2130023880.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Function 00D73189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D72F88: GetModuleHandleA.KERNEL32(?), ref: 00D72FA1
Part of subcall function 00D72F88: LoadLibraryA.KERNEL32(?), ref: 00D72FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D731DA
HeapFree.KERNEL32(00000000), ref: 00D731E1

Memory Dump Source

Source File: 0000000C.00000002.2130374425.0000000000D70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d70000_lnmlavab.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 36d72d4817d1aae506c2788f64d6c803f424addc84adb5532ffa37187aad99b3
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 4351BC7190024AAFCF119F68D8889FAB7B5FF15304F148169EC9AC7211F732DA19DBA4

Analysis Process: svchost.exePID: 6812, Parent PID: 5840COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 02BEC913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 02BECA4E
closesocket.WS2_32(?), ref: 02BECB63
GetTempPathA.KERNEL32(00000120,?), ref: 02BECC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02BECCB4
WriteFile.KERNEL32(02BEA4B3,?,-000000E8,?,00000000), ref: 02BECCDC
CloseHandle.KERNEL32(02BEA4B3), ref: 02BECCED
wsprintfA.USER32 ref: 02BECD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02BECD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 02BECD89
CloseHandle.KERNEL32(?), ref: 02BECD98
CloseHandle.KERNEL32(?), ref: 02BECD9D
DeleteFileA.KERNEL32(?), ref: 02BECDC4
CloseHandle.KERNEL32(02BEA4B3), ref: 02BECDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02BECFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02BECFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 02BED033
lstrcatA.KERNEL32(?,04300108), ref: 02BED10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 02BED155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 02BED171
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000), ref: 02BED195
CloseHandle.KERNEL32(00000000), ref: 02BED19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 02BED1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02BED231
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02BED27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02BED2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02BED2C7
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02BED2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02BED2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02BED326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 02BED372
lstrcatA.KERNEL32(?,04300108,?,?,?,?,?,?,?,00000100), ref: 02BED3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 02BED3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 02BED408
WriteFile.KERNEL32(00000000,0430012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 02BED428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 02BED42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 02BED45B
CreateProcessA.KERNEL32(?,02BF0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 02BED4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02BED4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02BED4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 02BED513
closesocket.WS2_32(?), ref: 02BED56C
Sleep.KERNEL32(000003E8), ref: 02BED577
ExitProcess.KERNEL32 ref: 02BED583
wsprintfA.USER32 ref: 02BED81F

Part of subcall function 02BEC65C: send.WS2_32(00000000,?,00000000), ref: 02BEC74B

closesocket.WS2_32(?), ref: 02BEDAD5

Strings

.sys, xrefs: 02BED0CC
localcfg, xrefs: 02BECA89, 02BECA93, 02BECAC0, 02BECAD2, 02BECE4F, 02BECE6F, 02BED8D3, 02BED8FC
flags_upd, xrefs: 02BECE4A
srv_time, xrefs: 02BECABB
\, xrefs: 02BED3A7
local_time, xrefs: 02BECACD
.dat, xrefs: 02BED0D7, 02BED138, 02BED1AE, 02BED1D4, 02BED28E, 02BED308, 02BED3CF, 02BED441
wtm_c, xrefs: 02BEC956
lid_file_upd, xrefs: 02BECE6A
@, xrefs: 02BED754
wtm_r, xrefs: 02BEC97F
4, xrefs: 02BED9F7
\, xrefs: 02BED39D
except_info, xrefs: 02BED8CD, 02BED8D2, 02BED8FB
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 02BECC10, 02BECCF3, 02BED975, 02BED98E
wtm_w, xrefs: 02BEC96C
work_srv, xrefs: 02BED607, 02BED60F, 02BED62C
drivers\, xrefs: 02BED067
time_cfg, xrefs: 02BEC95B, 02BEC962, 02BEC971, 02BEC984

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1927557597
Opcode ID: 7007dcbfb402103e0e4fe84ecdffd90bdd95772ac475ffd0878a3fcdfeaa9f45
Instruction ID: cb0d42aacebbb28a7a253c3a6561dbafc5988db518dafaed7969b1369f304abe
Opcode Fuzzy Hash: 7007dcbfb402103e0e4fe84ecdffd90bdd95772ac475ffd0878a3fcdfeaa9f45
Instruction Fuzzy Hash: 3AB2C2B2D40249AFEF60ABA4DC44FEE7BBDEB08344F0409EAE606A7151D7709A55CF50

Function 02BE9A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 02BE9A7F
SetErrorMode.KERNELBASE(00000003), ref: 02BE9A83
SetUnhandledExceptionFilter.KERNEL32(02BE6511), ref: 02BE9A8A

Part of subcall function 02BEEC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 02BEEC5E
Part of subcall function 02BEEC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02BEEC72
Part of subcall function 02BEEC54: GetTickCount.KERNEL32 ref: 02BEEC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 02BE9AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 02BE9ABA
GetCommandLineA.KERNEL32 ref: 02BE9AFD
lstrlenA.KERNEL32(?), ref: 02BE9B99
ExitProcess.KERNEL32 ref: 02BE9C06
GetTempPathA.KERNEL32(000001F4,?), ref: 02BE9CAC
lstrcpyA.KERNEL32(?,00000000), ref: 02BE9D7A
lstrcatA.KERNEL32(?,?), ref: 02BE9D8B
lstrcatA.KERNEL32(?,02BF070C), ref: 02BE9D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02BE9DED
DeleteFileA.KERNEL32(00000022), ref: 02BE9E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 02BE9E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02BE9EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 02BE9ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 02BE9F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 02BE9F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 02BE9F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 02BE9FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02BE9FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02BE9FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 02BEA038
lstrcatA.KERNEL32(00000022,02BF0A34), ref: 02BEA05E
lstrcatA.KERNEL32(00000022,00000022), ref: 02BEA072
lstrcatA.KERNEL32(00000022,02BF0A34), ref: 02BEA08D
wsprintfA.USER32 ref: 02BEA0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 02BEA0DE
lstrcatA.KERNEL32(00000022,?), ref: 02BEA0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 02BEA120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 02BEA131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 02BEA174
GetModuleFileNameA.KERNEL32(00000000), ref: 02BEA17B
GetDriveTypeA.KERNEL32(00000022), ref: 02BEA1B6
GetCommandLineA.KERNEL32 ref: 02BEA1E5

Part of subcall function 02BE99D2: lstrcpyA.KERNEL32(?,?,00000100,02BF22F8,00000000,?,02BE9E9D,?,00000022,?,?,?,?,?,?,?), ref: 02BE99DF
Part of subcall function 02BE99D2: lstrcatA.KERNEL32(00000022,00000000,?,?,02BE9E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 02BE9A3C
Part of subcall function 02BE99D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,02BE9E9D,?,00000022,?,?,?), ref: 02BE9A52

lstrlenA.KERNEL32(?), ref: 02BEA288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 02BEA3B7
GetLastError.KERNEL32 ref: 02BEA3ED
Sleep.KERNELBASE(000003E8), ref: 02BEA400
DeleteFileA.KERNELBASE(02BF33D8), ref: 02BEA407
CreateThread.KERNELBASE(00000000,00000000,02BE405E,00000000,00000000,00000000), ref: 02BEA42C
WSAStartup.WS2_32(00001010,?), ref: 02BEA43A
CreateThread.KERNELBASE(00000000,00000000,02BE877E,00000000,00000000,00000000), ref: 02BEA469
Sleep.KERNELBASE(00000BB8), ref: 02BEA48A
GetTickCount.KERNEL32 ref: 02BEA49F
GetTickCount.KERNEL32 ref: 02BEA4B7
Sleep.KERNELBASE(00001838), ref: 02BEA4C3

Strings

\, xrefs: 02BE9D0C
gqbqwogt, xrefs: 02BEA389, 02BEA397
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 02BEA1D9
", xrefs: 02BE9EDB
", xrefs: 02BEA189
P, xrefs: 02BE9DAA
D, xrefs: 02BE9F8E
", xrefs: 02BEA078
%X%08X, xrefs: 02BEA0B0

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$D$P$\$gqbqwogt
API String ID: 2089075347-2461606005
Opcode ID: 810c156cb4daa72a842da7fcc9708dc8d1d65c67d9d9d6754391bcbf7a4e5911
Instruction ID: b2ea6b813486287bba8c8e685c883346979c975ac5c3a986966677ca3bb589cc
Opcode Fuzzy Hash: 810c156cb4daa72a842da7fcc9708dc8d1d65c67d9d9d6754391bcbf7a4e5911
Instruction Fuzzy Hash: 5D5262B1D40259AFDF51ABA0CC49EEE7BBDEB08304F1448E5F607A3151E7749A888F61

Function 02BE199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 02BE19B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,02BE1E9E), ref: 02BE19BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02BE19E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 02BE19ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 02BE19F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,02BE1E9E), ref: 02BE1A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A36
GetAdaptersInfo.IPHLPAPI(00000000,02BE1E9E,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,02BE1E9E,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A5A
GetAdaptersInfo.IPHLPAPI(00000000,02BE1E9E,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,02BE1E9E), ref: 02BE1A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,02BE1E9E), ref: 02BE1AA4

Strings

localcfg, xrefs: 02BE19A3
Iphlpapi.dll, xrefs: 02BE19B7
GetAdaptersInfo, xrefs: 02BE19DC
123.45.67.89, xrefs: 02BE19A6
GetBestInterface, xrefs: 02BE19EF
GetIfEntry, xrefs: 02BE19E4

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: 3a333301e65d388d610d8e0ee07b42fe0fa6e37181a338ce0d0b15447e6d131a
Instruction ID: 1092e0307697db0702122cf3e563040412a3497e37ce3d8eb53970448790bad2
Opcode Fuzzy Hash: 3a333301e65d388d610d8e0ee07b42fe0fa6e37181a338ce0d0b15447e6d131a
Instruction Fuzzy Hash: A3316171D50209AFDF51AFE8CC88CBEBBB5EF44745B6449A9F626A3121D7304E40CB60

Function 02BE7A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 02BE7ABA
GetUserNameA.ADVAPI32(?,?), ref: 02BE7ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,02BF070C,?,?,?), ref: 02BE7B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 02BE7B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 02BE7B59
EqualSid.ADVAPI32(?,00000022), ref: 02BE7B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 02BE7B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02BE7B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02BE7B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 02BE7BAB
LocalFree.KERNEL32(00000000), ref: 02BE7BB2
GetSecurityDescriptorDacl.ADVAPI32(?,02BE7FC9,?,00000000), ref: 02BE7BCE

Strings

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 02BE7CE2, 02BE7D0F, 02BE7D23, 02BE7D24
D, xrefs: 02BE7B0C

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$D
API String ID: 2976863881-2668765463
Opcode ID: 1b968d5315b6f4f77b1dded9fb99f05063d3f83c5e120207cd1d8d7894cbdfde
Instruction ID: 87ffd29bd5490bdac200f7f303fc8f15ec341acdc08612c41142c79937feac08
Opcode Fuzzy Hash: 1b968d5315b6f4f77b1dded9fb99f05063d3f83c5e120207cd1d8d7894cbdfde
Instruction Fuzzy Hash: 08A14DB1D40219AFEF519FA0DC88EEEBBBDFB04344F0444A9E606E3151EB358A55DB60

Function 02BE7809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02BE782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02BE7866
GetLengthSid.ADVAPI32(?), ref: 02BE7878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02BE789A
GetSecurityDescriptorOwner.ADVAPI32(?,02BE7F63,?), ref: 02BE78B8
EqualSid.ADVAPI32(?,02BE7F63), ref: 02BE78D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 02BE78E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02BE78F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02BE7901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02BE7910
LocalFree.KERNEL32(00000000), ref: 02BE7917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02BE7933
GetAce.ADVAPI32(?,00000000,?), ref: 02BE7963
EqualSid.ADVAPI32(?,02BE7F63), ref: 02BE798A
DeleteAce.ADVAPI32(?,00000000), ref: 02BE79A3
EqualSid.ADVAPI32(?,02BE7F63), ref: 02BE79C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 02BE7A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02BE7A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02BE7A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02BE7A79
LocalFree.KERNEL32(00000000), ref: 02BE7A87

Strings

D, xrefs: 02BE785C

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: f8e02c7e6e35c74215ebebe087d64ee0d92da3853897f0e586ab7e2a2251cd03
Instruction ID: b90ca1d4fd9c9bb27cbced215756b51bdfef878aed87e9f70a5df559b5d414c3
Opcode Fuzzy Hash: f8e02c7e6e35c74215ebebe087d64ee0d92da3853897f0e586ab7e2a2251cd03
Instruction Fuzzy Hash: BF814971D0021AABDF21DFA4DD48FEEBBB8EF08344F0444AAE616E3151DB348651DBA4

Function 02BE8328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,02BF0750,?,?,00000000,localcfg,00000000), ref: 02BE83F3
RegQueryValueExA.KERNELBASE(02BF0750,?,00000000,?,02BE8893,?,?,?,00000000,00000103,02BF0750,?,?,00000000,localcfg,00000000), ref: 02BE8414
RegSetValueExA.KERNELBASE(02BF0750,?,00000000,00000004,02BE8893,00000004,?,?,00000000,00000103,02BF0750,?,?,00000000,localcfg,00000000), ref: 02BE8441
RegCloseKey.ADVAPI32(02BF0750,?,?,00000000,00000103,02BF0750,?,?,00000000,localcfg,00000000), ref: 02BE844A

Strings

localcfg, xrefs: 02BE8348
C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 02BE85C8, 02BE85D5, 02BE85E5

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe$localcfg
API String ID: 237177642-2863267139
Opcode ID: 04ff6e9a9693c973c8a4f6b52068b6b08ecdbaf5523dc7204c56c44ecca03fd4
Instruction ID: 12193281b0bb79f26809aac92359c5550c1feb75f6c0e54321041009431310cd
Opcode Fuzzy Hash: 04ff6e9a9693c973c8a4f6b52068b6b08ecdbaf5523dc7204c56c44ecca03fd4
Instruction Fuzzy Hash: 63C192B1D4050CBEEF51ABA4DC85EEE7BBDEF04344F1448E5F606A6061EB318A949F21

Function 02BE1D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 02BE1DC6
GetSystemInfo.KERNELBASE(?), ref: 02BE1DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 02BE1E03
GetProcAddress.KERNEL32(00000000), ref: 02BE1E0A
GetCurrentProcess.KERNEL32(?), ref: 02BE1E1B
GetTickCount.KERNEL32 ref: 02BE1FC9

Part of subcall function 02BE1BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 02BE1C15

Strings

net_type, xrefs: 02BE1E87
localcfg, xrefs: 02BE1E2A, 02BE1E31, 02BE1E44, 02BE1E7D, 02BE1E8C, 02BE1EB2, 02BE1ED1, 02BE1EE7, 02BE1EFF, 02BE1F1C, 02BE1F34, 02BE1F50, 02BE1F70
loader_id, xrefs: 02BE1F4B, 02BE1F6B
flags_upd, xrefs: 02BE1E3E, 02BE1E43, 02BE1E7C
start_srv, xrefs: 02BE1E6C
IsWow64Process, xrefs: 02BE1DF2
kernel32, xrefs: 02BE1DF7
born_date, xrefs: 02BE1EAD, 02BE1ECC
lid_file_upd, xrefs: 02BE1E25
work_srv, xrefs: 02BE1E5E
hi_id, xrefs: 02BE1F16, 02BE1F1B, 02BE1F33

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: ec17b297a3c93c4fdb9b2e59d4026de07c0cc95ae147fc2e45675dbd0a3c5d2a
Instruction ID: c2ab8352d2f9bcf0183133a6ebbd29127bc93dccf8f243dfc2303bb39818f782
Opcode Fuzzy Hash: ec17b297a3c93c4fdb9b2e59d4026de07c0cc95ae147fc2e45675dbd0a3c5d2a
Instruction Fuzzy Hash: E551BFB09043446FEB60AF798C89F27BBECEB44748F004D9DB65B82552D774A904CBA2

Function 02BE73FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 02BE7472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 02BE74F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 02BE7528
___ascii_stricmp.LIBCMT ref: 02BE764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 02BE76E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 02BE7706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 02BE7717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 02BE7745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 02BE77EF

Part of subcall function 02BEF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02BF22F8,000000C8,02BE7150,?), ref: 02BEF1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02BE778F
RegCloseKey.KERNELBASE(?), ref: 02BE77E6

Strings

", xrefs: 02BE7599

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: c2b11867c8a2a249ce21fe4d58143e4aa084892c8e06dd4d326bf496d3fb1bfa
Instruction ID: 6ad6ebebba77c143ead67459e88fbaa3ed0c6412e8aced3f0a824cdfed10fb38
Opcode Fuzzy Hash: c2b11867c8a2a249ce21fe4d58143e4aa084892c8e06dd4d326bf496d3fb1bfa
Instruction Fuzzy Hash: 26C18F72940209AFEF11ABA4DC45FEEBBBAEF45314F1404E5E506E6190EF31DA84DB60

Function 02BE675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 02BE677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 02BE679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 02BE67B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 02BE67BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 02BE67D3
ReadFile.KERNELBASE(000000FF,?,00000040,02BE8244,00000000,?,76230F10,00000000), ref: 02BE6807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02BE681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 02BE683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02BE685C
ReadFile.KERNEL32(000000FF,?,00000028,02BE8244,00000000,?,76230F10,00000000), ref: 02BE688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 02BE6906
ReadFile.KERNEL32(000000FF,?,00000000,02BE8244,00000000,?,76230F10,00000000), ref: 02BE691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 02BE6971

Part of subcall function 02BEEC2E: GetProcessHeap.KERNEL32(00000000,02BEEA27,00000000,02BEEA27,00000000), ref: 02BEEC41
Part of subcall function 02BEEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02BEEC48

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 73c7eaa818e4f47d7b099dc44a380658883484af49fd11271f830a5323f2625b
Instruction ID: 0340a751f6a7ff3afa5cf562eef5d98fc36d39940b6eb873099e9cdda35a2737
Opcode Fuzzy Hash: 73c7eaa818e4f47d7b099dc44a380658883484af49fd11271f830a5323f2625b
Instruction Fuzzy Hash: 5E711975C0021DEFDF159FA4CC80AEEBBB9FB18354F1045AAE516A6190E7309E91DF60

Function 02BEF315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(02BECA1D), ref: 02BEF34D
socket.WS2_32(00000002,00000001,00000000), ref: 02BEF367
closesocket.WS2_32(00000000), ref: 02BEF375

Strings

time_cfg, xrefs: 02BEF323

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 1122e495cc7bd39b91aca18a2a19b51797cb663fd561d8210e0510d1df03b3df
Instruction ID: ae9a85bf6babaa8f72816d3a65672336bfb6850487123362f897d455735d6368
Opcode Fuzzy Hash: 1122e495cc7bd39b91aca18a2a19b51797cb663fd561d8210e0510d1df03b3df
Instruction Fuzzy Hash: 19317C76940118ABDB10DFA9DC849FE7BBCFF88350F1045A6FA16E3151E7309A418BA0

Function 02BE405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 02BE4070
ExitProcess.KERNEL32 ref: 02BE4121

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 473f2bef60f0079ea71ca3053500bd91f14e8bbf95d147f4e66570824edfa38b
Instruction ID: feecdd2dcb4fed54b2e5ce31658f5df427dc6620aca1d84f291419d659253b82
Opcode Fuzzy Hash: 473f2bef60f0079ea71ca3053500bd91f14e8bbf95d147f4e66570824edfa38b
Instruction Fuzzy Hash: D8517FB1D40219BAEF20ABA08C45FBF7BBDEF15754F0004E5F616B6181E7348A45DBA2

Function 02BE2D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,02BE2F01,?,02BE20FF,02BF2000), ref: 02BE2D3A
LoadLibraryA.KERNEL32(?), ref: 02BE2D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02BE2D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 02BE2D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 02BE2D99
HeapAlloc.KERNEL32(00000000), ref: 02BE2DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 02BE2DCB

Strings

dnsapi.dll, xrefs: 02BE2D29
DnsQuery_A, xrefs: 02BE2D5B

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: fdf6a7dfc3cf2a8eba2eed11f02947bc7aaf7537bb3eb3f665367dad22afa51c
Instruction ID: 01300f6c8d0252e468460d9d3cb41b65f6b7e1b5301862c6ee20619e5d148f73
Opcode Fuzzy Hash: fdf6a7dfc3cf2a8eba2eed11f02947bc7aaf7537bb3eb3f665367dad22afa51c
Instruction Fuzzy Hash: 88216271D40229EBCF12AF64DC44AAEBBBDEF08B51F108892FA06E7115D770DA9587D0

Function 02BE80C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02BE815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,02BEA45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02BE8187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,02BEA45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02BE81BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 02BE8210

Part of subcall function 02BE675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 02BE677E
Part of subcall function 02BE675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 02BE679A
Part of subcall function 02BE675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 02BE67B0
Part of subcall function 02BE675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 02BE67BF
Part of subcall function 02BE675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 02BE67D3
Part of subcall function 02BE675C: ReadFile.KERNELBASE(000000FF,?,00000040,02BE8244,00000000,?,76230F10,00000000), ref: 02BE6807
Part of subcall function 02BE675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02BE681F
Part of subcall function 02BE675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 02BE683E
Part of subcall function 02BE675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 02BE685C

Part of subcall function 02BEEC2E: GetProcessHeap.KERNEL32(00000000,02BEEA27,00000000,02BEEA27,00000000), ref: 02BEEC41
Part of subcall function 02BEEC2E: RtlFreeHeap.NTDLL(00000000), ref: 02BEEC48

Strings

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe, xrefs: 02BE8225, 02BE823A

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe
API String ID: 124786226-3352897057
Opcode ID: a7db080f15aa5d708a129e452364d0d9c30910e6a219248f46cb4b10dc264d3d
Instruction ID: eb940b4118befa6517e154dc87eaf92d7b0d1e53486a039e03a9e899a799f462
Opcode Fuzzy Hash: a7db080f15aa5d708a129e452364d0d9c30910e6a219248f46cb4b10dc264d3d
Instruction Fuzzy Hash: 76419FB2D45509BFEF51EBA09D80DBEB7ADDB04344F0408EAEA42A7010E7309E949B61

Function 02BE1AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02BE1AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02BE1AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02BE1B20

Strings

Iphlpapi.dll, xrefs: 02BE1ACC
GetAdaptersAddresses, xrefs: 02BE1AE3

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 95e035282beeb3e6be2ee1f7909325bca4a3f04c9915e3dc64e30866ae06df5c
Instruction ID: 485c7456a995e9a0c4526085e22920d23df75453da347a5d798a46e921169374
Opcode Fuzzy Hash: 95e035282beeb3e6be2ee1f7909325bca4a3f04c9915e3dc64e30866ae06df5c
Instruction Fuzzy Hash: 4F11D071E11138AFDF219BBCCC84CADBBBAEB44B10B2444E6E10BA7115E7308E40CB90

Function 02BEE3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,02BEE5F2,00000000,00020119,02BEE5F2,02BF22F8), ref: 02BEE3E6
RegQueryValueExA.ADVAPI32(02BEE5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 02BEE44E
RegQueryValueExA.ADVAPI32(02BEE5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 02BEE482
RegQueryValueExA.ADVAPI32(02BEE5F2,?,00000000,?,80000001,?), ref: 02BEE4CF
RegCloseKey.ADVAPI32(02BEE5F2,?,?,?,?,000000C8,000000E4), ref: 02BEE520

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 8d0b80d9bcecb1a24e85f10244847be08a695c67e9db3fa39f3d408e07fd8480
Instruction ID: cc48923effb074397ddac66b925ebe0bba4884a74d0ad6b40b536862f7bfa4cb
Opcode Fuzzy Hash: 8d0b80d9bcecb1a24e85f10244847be08a695c67e9db3fa39f3d408e07fd8480
Instruction Fuzzy Hash: F241E6B2D0021DAFDF11AFE4DC80DEEBBBAEF08354F1444A6EA11A6150E3319A559B60

Function 02BEF26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 02BEF2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 02BEF2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 02BEF2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 02BEF2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 02BEF2FD

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 73d0860fa72a48f55585983c49f85c34bbddcc32607e4b23b0b3d3c71da240d4
Instruction ID: 3fc8246bd77a51237d3dcd7df2d43b86619e5568f63868ee02a51fcf8803fb7e
Opcode Fuzzy Hash: 73d0860fa72a48f55585983c49f85c34bbddcc32607e4b23b0b3d3c71da240d4
Instruction Fuzzy Hash: A111FBB1A40248BAEB11DE94CD41F9E7FBCEB44751F004066BB04EA1D0E6B19A44CB94

Function 02BE1BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BE1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02BE1AD4
Part of subcall function 02BE1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02BE1AE9
Part of subcall function 02BE1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02BE1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02BE1C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 02BE1C51

Strings

localcfg, xrefs: 02BE1BE7
hi_id, xrefs: 02BE1BE5

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 927419cc575d4c17ee4c220d54c5d3ee6e9f54fbaf49a1623f051dd991c19502
Instruction ID: e4720d4d7d26ffddf2115a5cf672bf35b7057dcfd76c1262e06ce0d66ed78779
Opcode Fuzzy Hash: 927419cc575d4c17ee4c220d54c5d3ee6e9f54fbaf49a1623f051dd991c19502
Instruction Fuzzy Hash: 8B0184B291411CBBEF50DAFCC8C49EFBABCE744645F2008B5D716E7200D3309D449660

Function 02BE1B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 02BE1AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 02BE1AD4
Part of subcall function 02BE1AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 02BE1AE9
Part of subcall function 02BE1AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 02BE1B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 02BE1BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,02BE1EFD,00000000,00000000,00000000,00000000), ref: 02BE1BB8

Strings

localcfg, xrefs: 02BE1B7B

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 38c13392f0ed7cf9dafda85ade41566f7f643adc720e6c074431890e82b097a5
Instruction ID: cf998b3a4183cddcba38c876539c30ec9f1ba6734fbba020fb9b157af5c8b76b
Opcode Fuzzy Hash: 38c13392f0ed7cf9dafda85ade41566f7f643adc720e6c074431890e82b097a5
Instruction Fuzzy Hash: 67014FB6D0410CBFEB019BF9C8819EFFABDEB48654F250561A716E7151D6705E044AA0

Function 02BE2684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 02BE2693
gethostbyname.WS2_32(00000001), ref: 02BE269F

Strings

time_cfg, xrefs: 02BE2684

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: bef04d2781275ac343a206d0abf3fbe51112b9b0a204be907540e7d8645146a5
Instruction ID: babbd7780c5d424da6bacc60c90bb2713baf83c9307acb56fc47f986ac7b7914
Opcode Fuzzy Hash: bef04d2781275ac343a206d0abf3fbe51112b9b0a204be907540e7d8645146a5
Instruction Fuzzy Hash: 86E0C2346040118FCF509B28F844BD577E8EF06370F014AC0F881C31A5C730DC808790

Function 02BEE52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 02BEDD05: GetTickCount.KERNEL32 ref: 02BEDD0F
Part of subcall function 02BEDD05: InterlockedExchange.KERNEL32(02BF36B4,00000001), ref: 02BEDD44
Part of subcall function 02BEDD05: GetCurrentThreadId.KERNEL32 ref: 02BEDD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,02BEA445), ref: 02BEE558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,76230F10,?,00000000,?,02BEA445), ref: 02BEE583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,02BEA445), ref: 02BEE5B2

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: c06e05950fe0d85d2df16b1364dca8c5617aa41d833bcf19e475a85a1585b774
Instruction ID: 6f3984e2026cc605fd09c1b4f8d0bba75761b2f6d777d27186eef2d00aed3b85
Opcode Fuzzy Hash: c06e05950fe0d85d2df16b1364dca8c5617aa41d833bcf19e475a85a1585b774
Instruction Fuzzy Hash: D32107B2A802017AFA617A359C06F6B3A8EDB55764F0008D4BF0BB11D3EB55D5108AB1

Function 02BE877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 02BE88A5

Part of subcall function 02BEF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02BEE342,00000000,75B4EA50,80000001,00000000,02BEE513,?,00000000,00000000,?,000000E4), ref: 02BEF089
Part of subcall function 02BEF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02BEE342,00000000,75B4EA50,80000001,00000000,02BEE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02BEF093

Strings

localcfg, xrefs: 02BE87CA, 02BE87CF, 02BE87FB, 02BE8835, 02BE8861
rresolv, xrefs: 02BE87F6, 02BE885C

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: 91b9454b6166c3b2b0fcece4d55669e360ecf9af7629258cc4c8bca7c0f42266
Instruction ID: 0c03dbf7c19cd08be1ab1fe501d3f0977c273b3371c548f60f852eb30f47b706
Opcode Fuzzy Hash: 91b9454b6166c3b2b0fcece4d55669e360ecf9af7629258cc4c8bca7c0f42266
Instruction Fuzzy Hash: 63213C319983006AFB54BBB4AC42F7A3BDADB04760F5508C9FE16870D1EF91954489B1

Function 02BE4000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,02BF22F8,02BE42B6,00000000,00000001,02BF22F8,00000000,?,02BE98FD), ref: 02BE4021
GetLastError.KERNEL32(?,02BE98FD,00000001,00000100,02BF22F8,02BEA3C7), ref: 02BE402C
Sleep.KERNEL32(000001F4,?,02BE98FD,00000001,00000100,02BF22F8,02BEA3C7), ref: 02BE4046

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 568f19700f0a058cb5615661161d900c41a71ff251ce0adaada5cd7b63d2c0bc
Instruction ID: 17f3024e84c73139f99db5a0c1f8c7dd5acb1e7650564027ba19c37287e33dff
Opcode Fuzzy Hash: 568f19700f0a058cb5615661161d900c41a71ff251ce0adaada5cd7b63d2c0bc
Instruction Fuzzy Hash: E2F0A0326802056BDF711A78AC49B2A32B1EB81738F254FB4F3B7E20E2C73044819B14

Function 02BEDB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02BEDC19,?,00000104), ref: 02BEDB7F
lstrcpyA.KERNEL32(?,02BF28F8), ref: 02BEDBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 02BEDBC2

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: d80bb16ca1803c82bbfc896c5072192313fd988404e59a4f7a7612e8157dcdf1
Instruction ID: b3ee7916bc0cb5c4d4d233e59c171198cb916dd03e2636df35d6942bc073ce62
Opcode Fuzzy Hash: d80bb16ca1803c82bbfc896c5072192313fd988404e59a4f7a7612e8157dcdf1
Instruction Fuzzy Hash: 35F09070540209BBEF109F74DC49FD93B69AB10348F504994BB51A50D0D7F2D555CB10

Function 02BEEC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 02BEEC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 02BEEC72
GetTickCount.KERNEL32 ref: 02BEEC78

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 59f811d443e55932ac4931ce5f6edfbaca00af1fcb97d6c952bf5ea4bb532d27
Instruction ID: d6ce464280e8c5fb49c518993e593a09842facec48a70387e58a9afb15c7f6b0
Opcode Fuzzy Hash: 59f811d443e55932ac4931ce5f6edfbaca00af1fcb97d6c952bf5ea4bb532d27
Instruction Fuzzy Hash: 19E09AF5C50108BFE741ABB0DC4AE6B77FCEB08355F500A50BA11D6195DA709A148B64

Function 02BE30B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02BE30D8
gethostbyname.WS2_32(?), ref: 02BE30E2

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: b7e521f104932efd49793abc2504f00185a3cd6dee623fdda7ccfbac3b3b3d18
Instruction ID: 55e2f60965ce7963e88b39b6f1c15a3eb863f1c425457a57c37d49083b1fa829
Opcode Fuzzy Hash: b7e521f104932efd49793abc2504f00185a3cd6dee623fdda7ccfbac3b3b3d18
Instruction Fuzzy Hash: 32E09B71D001199BCF40EBA8EC85F9A77ECFF08348F180461F946E3255EB34E50487A0

Function 02BEEBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,02BEDB55,7FFF0001), ref: 02BEEC13
RtlReAllocateHeap.NTDLL(00000000,?,02BEDB55,7FFF0001), ref: 02BEEC1A

Part of subcall function 02BEEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02BEEBFE,7FFF0001,?,02BEDB55,7FFF0001), ref: 02BEEBD3
Part of subcall function 02BEEBCC: RtlAllocateHeap.NTDLL(00000000,?,02BEDB55,7FFF0001), ref: 02BEEBDA

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e2abe78bff7a94105ad62740521f14fbc0e47c6a96956db00411b005ed3f114e
Instruction ID: 49a07ac2f80dac4ea706e83a285f593585ce20a4e8789dc3afae3406b7638ebd
Opcode Fuzzy Hash: e2abe78bff7a94105ad62740521f14fbc0e47c6a96956db00411b005ed3f114e
Instruction Fuzzy Hash: 6EE048325442187BDF413FA4FC48F993B9ADF047B1F108555FA0E49160CB31D6A0DB94

Function 02BEEC2E Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02BEEBA0: GetProcessHeap.KERNEL32(00000000,00000000,02BEEC0A,00000000,80000001,?,02BEDB55,7FFF0001), ref: 02BEEBAD
Part of subcall function 02BEEBA0: HeapSize.KERNEL32(00000000,?,02BEDB55,7FFF0001), ref: 02BEEBB4

GetProcessHeap.KERNEL32(00000000,02BEEA27,00000000,02BEEA27,00000000), ref: 02BEEC41
RtlFreeHeap.NTDLL(00000000), ref: 02BEEC48

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID:
API String ID: 1305341483-0
Opcode ID: 861125693c52f9490a8b357f720955291b0e97da663809198cfff30d1589aa6b
Instruction ID: 72bf886eab1d8cda5ca44ee0e3d70fa943765dc5d09348dc137994dd8e0161ed
Opcode Fuzzy Hash: 861125693c52f9490a8b357f720955291b0e97da663809198cfff30d1589aa6b
Instruction Fuzzy Hash: 19C01272C462306BC9913760BC0CF9B6B58DF45A61F090C49F506671598760998046E1

Function 02BEEBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,02BEEBFE,7FFF0001,?,02BEDB55,7FFF0001), ref: 02BEEBD3
RtlAllocateHeap.NTDLL(00000000,?,02BEDB55,7FFF0001), ref: 02BEEBDA

Part of subcall function 02BEEB74: GetProcessHeap.KERNEL32(00000000,00000000,02BEEC28,00000000,?,02BEDB55,7FFF0001), ref: 02BEEB81
Part of subcall function 02BEEB74: HeapSize.KERNEL32(00000000,?,02BEDB55,7FFF0001), ref: 02BEEB88

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: 209a95e352b3cee0f781cdf297cbd545054298d7a2b303efcc9b7128e50d5664
Instruction ID: b62c9db1a9736902a0deab9bcb952a762e0dcc43bdc19818da5a7e1994bcd4b1
Opcode Fuzzy Hash: 209a95e352b3cee0f781cdf297cbd545054298d7a2b303efcc9b7128e50d5664
Instruction Fuzzy Hash: 63C0807254422067C64137B47C0CF9A3E94DF047E2F040D44F705C7164C73049908791

Function 02BEF43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,02BECA44), ref: 02BEF476

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 540dd4ea94207476b2f9fad967b531fdb33c8f7287e85a7e94bb1806e7e8c470
Instruction ID: b93e5b0183b110cb79289618208d1f9873bfa21434a80fe28ddc22f72a8e0ce9
Opcode Fuzzy Hash: 540dd4ea94207476b2f9fad967b531fdb33c8f7287e85a7e94bb1806e7e8c470
Instruction Fuzzy Hash: 3EF01C7220155AAB9F119E9AEC84CBB3BAEFF892507080662FA15D7510D731E8218BB0

Function 02BE1978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 02BE1992

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 4c5e0fdb0ace6add92becc9c295f7e4d6d00e2338a610e2fac8f25008db81f31
Instruction ID: 1aa96ede0b85708cf7dd7d635c8bc72fb846bfcd2f5715efb9f63ee2c71eda45
Opcode Fuzzy Hash: 4c5e0fdb0ace6add92becc9c295f7e4d6d00e2338a610e2fac8f25008db81f31
Instruction Fuzzy Hash: 13D0222A1482312A5600375CB80047FABACDF042A2710881BFD89C0010C734CC8287A1

Function 02BEDD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 02BEDDB5

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: de0b6e33c8a3fc1fade0c4c2eef29bf06bfbaba43b15c913ce3f11199c7ebc4e
Instruction ID: e44d24bebeaf588eeb4a9573b2f5e2fbdb9e9223582b8fb4853cc633c78d0086
Opcode Fuzzy Hash: de0b6e33c8a3fc1fade0c4c2eef29bf06bfbaba43b15c913ce3f11199c7ebc4e
Instruction Fuzzy Hash: 43F08C32200603CBCF20CE34988465AB3ECEB86329F648DAEE25AD3150D7B4D855CB11

Non-executed Functions

Function 02BE637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02BE9816,EntryPoint), ref: 02BE638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,02BE9816,EntryPoint), ref: 02BE63A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02BE63CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02BE63EB

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: bb6d436277db3d5e3702dfe557f8d361f9de974db9452c3ffd30e144fc64bc11
Instruction ID: c14643e9b73af759a7d9dadce7892d7806f3acdda9606160fcb54e91da45e4c8
Opcode Fuzzy Hash: bb6d436277db3d5e3702dfe557f8d361f9de974db9452c3ffd30e144fc64bc11
Instruction Fuzzy Hash: CD1191B1A00219BFDF519F69DC49F9B3BACEB047A4F004464FA06E7290D770DD108AA0

Function 02BE1000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,02BE1839,02BE9646), ref: 02BE1012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 02BE10C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 02BE10E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 02BE1101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 02BE1121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 02BE1140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 02BE1160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 02BE1180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 02BE119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 02BE11BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 02BE11DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 02BE11FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 02BE121A

Strings

RtlAllocateAndInitializeSid, xrefs: 02BE120F
RtlInitUnicodeString, xrefs: 02BE1135
ntdll.dll, xrefs: 02BE100D
NtSetInformationThread, xrefs: 02BE1155
NtClose, xrefs: 02BE11B4
NtTerminateProcess, xrefs: 02BE10F6
NtFilterToken, xrefs: 02BE122B
RtlNtStatusToDosError, xrefs: 02BE1194
NtSetInformationToken, xrefs: 02BE1175
NtOpenProcessToken, xrefs: 02BE11D4
RtlSetLastWin32Error, xrefs: 02BE10D6
RtlFreeSid, xrefs: 02BE1116
NtQueryInformationToken, xrefs: 02BE1262
RtlExpandEnvironmentStrings_U, xrefs: 02BE10BC
RtlLengthSid, xrefs: 02BE1246
NtDuplicateToken, xrefs: 02BE11F3

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 9fdb013a1ce5457f5f6c0375ffca367dddbed5448f0fb76061c0a3da09f05bd3
Instruction ID: d1f32eaf12b84080393b4eee2119a51030188404344db887be0816a50d87df8a
Opcode Fuzzy Hash: 9fdb013a1ce5457f5f6c0375ffca367dddbed5448f0fb76061c0a3da09f05bd3
Instruction Fuzzy Hash: B451C9719A2681D6EB909A6CEC40B5133E9E7483A4F248BD6AF2BD31E0D770C8D1CF51

Function 02BEB211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02BEB2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 02BEB2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 02BEB2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 02BEB2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 02BEB31A
GetTimeZoneInformation.KERNEL32(?), ref: 02BEB329
wsprintfA.USER32 ref: 02BEB3B7

Strings

Sep, xrefs: 02BEB28E
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 02BEB3AF
Tue, xrefs: 02BEB233
Feb, xrefs: 02BEB25D
Aug, xrefs: 02BEB287
Fri, xrefs: 02BEB248
Nov, xrefs: 02BEB29C
Mar, xrefs: 02BEB264
Wed, xrefs: 02BEB23A
Jan, xrefs: 02BEB256
Jun, xrefs: 02BEB279
Dec, xrefs: 02BEB2A3
May, xrefs: 02BEB272
Jul, xrefs: 02BEB280
Oct, xrefs: 02BEB295
Sun, xrefs: 02BEB225
Thu, xrefs: 02BEB241
Apr, xrefs: 02BEB26B
Mon, xrefs: 02BEB22C
Sat, xrefs: 02BEB24F

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: 0372c48004e48a993c472d693b2e1ab5179494890cb0dc8d7ec98538bfac1a84
Instruction ID: a7f1cf45e1ae474210fa2eb70552b523ca6b26017dbd95de69f931eda5d421b4
Opcode Fuzzy Hash: 0372c48004e48a993c472d693b2e1ab5179494890cb0dc8d7ec98538bfac1a84
Instruction Fuzzy Hash: FA510DB2E0021DAACF94EFD5D9859EFBBB9FF48304F104899E705A6165D3344A8DCB50

Function 02BE6511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02BE654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 02BE655C
htonl.WS2_32(?), ref: 02BE6578
htonl.WS2_32(?), ref: 02BE6587
wsprintfA.USER32 ref: 02BE659B
wsprintfA.USER32 ref: 02BE65DC
wsprintfA.USER32 ref: 02BE6671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 02BE668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 02BE6696
wsprintfA.USER32 ref: 02BE66B0
wsprintfA.USER32 ref: 02BE66E7
wsprintfA.USER32 ref: 02BE66FF
wsprintfA.USER32 ref: 02BE671F
ExitProcess.KERNEL32 ref: 02BE6755

Strings

ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 02BE666B
localcfg, xrefs: 02BE672D
except_info, xrefs: 02BE6728
Jan 13 2018, xrefs: 02BE653A
va=%08X%08X uef=%p, xrefs: 02BE6595
plgs:, xrefs: 02BE66AA
12:08:32, xrefs: 02BE6535
%d=%p, xrefs: 02BE66F9
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 02BE65D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 02BE6547

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: cb59f855cbf6e5194a0d31826aba51c40fe31522b2f8f58eeb98f081aeb36faf
Instruction ID: e48db61b56527f4b0b25097ec4916a3406de5d0bf567cb7cb19f6fa364c6eb2e
Opcode Fuzzy Hash: cb59f855cbf6e5194a0d31826aba51c40fe31522b2f8f58eeb98f081aeb36faf
Instruction Fuzzy Hash: 55614E71950208AFEF60AFB4DC45FEA77E9FF08310F1444A9FA6AD2122DB7199548F50

Function 02BEA7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02BEA7FB
lstrlenA.KERNEL32(?), ref: 02BEA87E
send.WS2_32(?,?,00000000,00000000), ref: 02BEA893
wsprintfA.USER32 ref: 02BEA8AF
send.WS2_32(?,.,00000005,00000000), ref: 02BEA8D2
wsprintfA.USER32 ref: 02BEA8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 02BEA97C
wsprintfA.USER32 ref: 02BEA9B9

Strings

localcfg, xrefs: 02BEAB0B
mail from:<%s>, xrefs: 02BEA848
Too big smtp respons (%d bytes), xrefs: 02BEA9B1
., xrefs: 02BEA8CA
ESMTP, xrefs: 02BEAA38
Error sending command (sent = %d/%d), xrefs: 02BEA8A7, 02BEA8DA
AUTH LOGIN, xrefs: 02BEA80C
Incorrect respons, xrefs: 02BEAB39
helo %s, xrefs: 02BEA803
rcpt to:<%s>, xrefs: 02BEA855
Too small respons, xrefs: 02BEA9C9
, xrefs: 02BEA94C
data, xrefs: 02BEA85E
quit, xrefs: 02BEA86C
ehlo %s, xrefs: 02BEA7F5

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: ac2531aea018acecfaf3aa5b916b6c66d76803989231a1cfe89c25ca79c58395
Instruction ID: d7eb86d5fa0493e13a25f27c660dae88c631e8b4110f85aea321ed49b9e2c324
Opcode Fuzzy Hash: ac2531aea018acecfaf3aa5b916b6c66d76803989231a1cfe89c25ca79c58395
Instruction Fuzzy Hash: 3AA15D71944315BBEF60AA64DC85FBE776EEB00308F1408E6FA13A70A1E771A958CB51

Function 02BE1280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02BE139A
lstrlenW.KERNEL32(-00000003), ref: 02BE1571

Strings

wusa.exe, xrefs: 02BE1388
@, xrefs: 02BE1380
D, xrefs: 02BE15C6
<, xrefs: 02BE1378
, xrefs: 02BE1462
uac, xrefs: 02BE1628
useless, xrefs: 02BE161E
%systemroot%\system32\cmd.exe, xrefs: 02BE1316

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: e0a71ecfc9166ac0a42bca49446b9ffccb45d4c3d6e66204f7d93fb900a34e72
Instruction ID: 905ee02406059c3aa9328e9761823dbdc3dd2eaa7c8ace5c31c1f6ce23afbf5a
Opcode Fuzzy Hash: e0a71ecfc9166ac0a42bca49446b9ffccb45d4c3d6e66204f7d93fb900a34e72
Instruction Fuzzy Hash: B1F19CB15183419FDB20DF68C888BAAB7E5FB88744F108D9DFA9B87250D770D844CB52

Function 02BE2A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 02BE2A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 02BE2A86
socket.WS2_32(00000002,00000002,00000011), ref: 02BE2AA0
htons.WS2_32(00000000), ref: 02BE2ADB
select.WS2_32 ref: 02BE2B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 02BE2B4A
htons.WS2_32(?), ref: 02BE2B71
htons.WS2_32(?), ref: 02BE2B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02BE2BFB

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 951c23b432ad0590d41234f5ff199331b642eecb2a9ca46077fe684888ada9f9
Instruction ID: a1c26ee682f61ce33de5023f8dfcc276089bc11a9155f6d9ee4ac6ed2d674ce7
Opcode Fuzzy Hash: 951c23b432ad0590d41234f5ff199331b642eecb2a9ca46077fe684888ada9f9
Instruction Fuzzy Hash: E161E5B19043059FDB20AF64DC09B6BBBECFB48795F000D49FD8A97251D7B4D8908BA1

Function 02BE704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 02BE70C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 02BE719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 02BE71B2
RegCloseKey.ADVAPI32(76230F10), ref: 02BE7208
RegCloseKey.ADVAPI32(76230F10), ref: 02BE7291
___ascii_stricmp.LIBCMT ref: 02BE72C2
RegCloseKey.ADVAPI32(76230F10), ref: 02BE72D0
RegCloseKey.ADVAPI32(76230F10), ref: 02BE7314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 02BE738D
RegCloseKey.ADVAPI32(76230F10), ref: 02BE73D8

Part of subcall function 02BEF1A5: lstrlenA.KERNEL32(000000C8,000000E4,02BF22F8,000000C8,02BE7150,?), ref: 02BEF1AD

Strings

", xrefs: 02BE7227
, xrefs: 02BE7194

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: a250d622d13a73f3020ed733830f688f51ec1ca27be38d05575ea81f09a5217c
Instruction ID: 40d8dfa559efe3ac5ff975e6b98962bec059351f000c9f4eb721b6ca21fc8f3b
Opcode Fuzzy Hash: a250d622d13a73f3020ed733830f688f51ec1ca27be38d05575ea81f09a5217c
Instruction Fuzzy Hash: C1B18F7284420ABEEF55AFA4DC44FEEB7B9EF04310F1005A6F502E2090EF759A84DB65

Function 02BEAD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 02BEAD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 02BEADA6

Part of subcall function 02BEAD08: gethostname.WS2_32(?,00000080), ref: 02BEAD1C
Part of subcall function 02BEAD08: lstrlenA.KERNEL32(?), ref: 02BEAD60
Part of subcall function 02BEAD08: lstrlenA.KERNEL32(?), ref: 02BEAD69
Part of subcall function 02BEAD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 02BEAD7F

Part of subcall function 02BE30B5: gethostname.WS2_32(?,00000080), ref: 02BE30D8
Part of subcall function 02BE30B5: gethostbyname.WS2_32(?), ref: 02BE30E2

wsprintfA.USER32 ref: 02BEAEA5

Part of subcall function 02BEA7A3: inet_ntoa.WS2_32(00000000), ref: 02BEA7A9

wsprintfA.USER32 ref: 02BEAE4F
wsprintfA.USER32 ref: 02BEAE5E

Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02BEEF92
Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(?), ref: 02BEEF99
Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(00000000), ref: 02BEEFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 02BEAE9F
%OUTLOOK_MID, xrefs: 02BEAEAE
%s%d, xrefs: 02BEAE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 02BEAE49
%OUTLOOK_HST, xrefs: 02BEAEC5
%OUTLOOK_BND_, xrefs: 02BEAE0F, 02BEAE14, 02BEAE57, 02BEAE76
127.0.0.1, xrefs: 02BEADEB

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: f9e001fe785ffda228728005cd7eabf62686a2ac27a2c5464699b4715717eb39
Instruction ID: 87cb88a7ad78377efa1004c1b8c0604c19dd2cbf0e91a12865b537ebfc3be254
Opcode Fuzzy Hash: f9e001fe785ffda228728005cd7eabf62686a2ac27a2c5464699b4715717eb39
Instruction Fuzzy Hash: CE41F3B290024C6BEF65EFA0DC45EEE37ADFF08350F144896FA1692162EB71D5588F50

Function 02BE2DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 02BE2E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2E4C
HeapAlloc.KERNEL32(00000000,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2E4F
htons.WS2_32(00000035), ref: 02BE2E88
inet_addr.WS2_32(?), ref: 02BE2E93
gethostbyname.WS2_32(?), ref: 02BE2EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2EE3
HeapFree.KERNEL32(00000000,?,00000000,02BE2F0F,?,02BE20FF,02BF2000), ref: 02BE2EE6

Strings

iphlpapi.dll, xrefs: 02BE2DFB, 02BE2E00, 02BE2E10
GetNetworkParams, xrefs: 02BE2E28

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: 345d77624bee2a0f9ecd240576db364bd979be220804acedd8e0fe174626449a
Instruction ID: d2568ec5a94563b2000ff7689f1829559761f1cd024f565608ceb8eb83f1239a
Opcode Fuzzy Hash: 345d77624bee2a0f9ecd240576db364bd979be220804acedd8e0fe174626449a
Instruction Fuzzy Hash: 2D31E431D0021AABDF10BBB89C48B6E777CEF04764F140995FE1AE3291D730C5519BA0

Function 02BE9326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,02BE9DD7,?,00000022,?,?,00000000,00000001), ref: 02BE9340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,02BE9DD7,?,00000022,?,?,00000000,00000001), ref: 02BE936E
GetModuleFileNameA.KERNEL32(00000000,?,02BE9DD7,?,00000022,?,?,00000000,00000001), ref: 02BE9375
wsprintfA.USER32 ref: 02BE93CE
wsprintfA.USER32 ref: 02BE940C
wsprintfA.USER32 ref: 02BE948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02BE94F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02BE9526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 02BE9571

Strings

runas, xrefs: 02BE9674

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: f6503f974ab9e98797ffb7f66418192659b23c52d8a7a7aea19118cd7d3ba726
Instruction ID: b37ca60d77d161131ce7202d940c7895a951a4fda15f8f484fa89423c64950e3
Opcode Fuzzy Hash: f6503f974ab9e98797ffb7f66418192659b23c52d8a7a7aea19118cd7d3ba726
Instruction Fuzzy Hash: CDA180B1940648AFEF21DFA0CC45FDE3BADEB04344F104496FA0692152E775D598CFA0

Function 02BEB3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02BEB467

Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 02BEEF92
Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(?), ref: 02BEEF99
Part of subcall function 02BEEF7C: lstrlenA.KERNEL32(00000000), ref: 02BEEFA0

Strings

%DATE, xrefs: 02BEB4D2
%FROM_USER, xrefs: 02BEB431
%TO_USER, xrefs: 02BEB488
%TO_DOMAIN, xrefs: 02BEB44B
%P5DATE, xrefs: 02BEB4F2
%TO_EMAIL, xrefs: 02BEB473
%FROM_DOMAIN, xrefs: 02BEB41E
%s@%s, xrefs: 02BEB461
%TO_HASH, xrefs: 02BEB4B0
%M5DATE, xrefs: 02BEB50F
%FROM_EMAIL, xrefs: 02BEB3E9

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: ea6cba80e17d0f09f5516e96d1ddb7dc791ce88d6bd8963deb05684bc1a790de
Instruction ID: 09920a805665431846930577dd84d9b9bf0d6f6616d224cdcf7b8ca22f5de8cb
Opcode Fuzzy Hash: ea6cba80e17d0f09f5516e96d1ddb7dc791ce88d6bd8963deb05684bc1a790de
Instruction Fuzzy Hash: 99417CB254011C7EFF00BAA4CCC1CBF7B6EEF09658F140595FA06B2021DB30EA188BA1

Function 02BE2011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE2078
GetTickCount.KERNEL32 ref: 02BE20D4
GetTickCount.KERNEL32 ref: 02BE20DB
GetTickCount.KERNEL32 ref: 02BE212B
GetTickCount.KERNEL32 ref: 02BE2132
GetTickCount.KERNEL32 ref: 02BE2142

Part of subcall function 02BEF04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,02BEE342,00000000,75B4EA50,80000001,00000000,02BEE513,?,00000000,00000000,?,000000E4), ref: 02BEF089
Part of subcall function 02BEF04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,02BEE342,00000000,75B4EA50,80000001,00000000,02BEE513,?,00000000,00000000,?,000000E4,000000C8), ref: 02BEF093

Part of subcall function 02BEE854: lstrcpyA.KERNEL32(00000001,?,?,02BED8DF,00000001,localcfg,except_info,00100000,02BF0264), ref: 02BEE88B
Part of subcall function 02BEE854: lstrlenA.KERNEL32(00000001,?,02BED8DF,00000001,localcfg,except_info,00100000,02BF0264), ref: 02BEE899

Part of subcall function 02BE1C5F: wsprintfA.USER32 ref: 02BE1CE1

Strings

net_type, xrefs: 02BE21DF
localcfg, xrefs: 02BE2070, 02BE2160, 02BE2186, 02BE2194, 02BE21E4
rbl_bl, xrefs: 02BE2181
rbl_ip, xrefs: 02BE218F

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 048c3acca177129bf2d20a201928d843250860971a817fced1572a2ccc52045d
Instruction ID: 4ae81bf61921b4b7b37e27eb8478a559c3d9f6e437fb44296c66b9664194e1b8
Opcode Fuzzy Hash: 048c3acca177129bf2d20a201928d843250860971a817fced1572a2ccc52045d
Instruction Fuzzy Hash: 39512271E843064FEB68EF34ED45B263BD9EB00354F100899EF83C71A6DBB49598CA12

Function 02BEC2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02BEA4C7: GetTickCount.KERNEL32 ref: 02BEA4D1
Part of subcall function 02BEA4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 02BEA4FA

GetTickCount.KERNEL32 ref: 02BEC31F
GetTickCount.KERNEL32 ref: 02BEC32B
GetTickCount.KERNEL32 ref: 02BEC363
GetTickCount.KERNEL32 ref: 02BEC378
GetTickCount.KERNEL32 ref: 02BEC44D
InterlockedIncrement.KERNEL32(02BEC4E4), ref: 02BEC4AE
CreateThread.KERNEL32(00000000,00000000,02BEB535,00000000,?,02BEC4E0), ref: 02BEC4C1
CloseHandle.KERNEL32(00000000,?,02BEC4E0,02BF3588,02BE8810), ref: 02BEC4CC

Strings

localcfg, xrefs: 02BEC2DD

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: b8715074b2e8075b8a800af4805bf6e7ec32ea5285f3e60618912565c41dc2bd
Instruction ID: fdc8a9352eb0a0e8186fd5900198d1356c667c5b3e303447be7f306a9abc76d7
Opcode Fuzzy Hash: b8715074b2e8075b8a800af4805bf6e7ec32ea5285f3e60618912565c41dc2bd
Instruction Fuzzy Hash: 2D5166B1A00B418FDB649F69C6C462ABBE9FF48304B509D6EE18BC7A90D774E840CB14

Function 02BEBE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02BEBE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02BEBE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02BEBE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 02BEBF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 02BEBF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 02BEBF94

Strings

smtp_ban, xrefs: 02BEBE55, 02BEBF77
smtp_retr, xrefs: 02BEBE61, 02BEBF8C
smtp_herr, xrefs: 02BEBE46, 02BEBF62

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 781a9cc5a0ab7d6e3f9434848a23c2c01f486e07dcad89ede4d80871ba601b63
Instruction ID: b19b544f47ee9ecc474cbdb47475ce8559b8e8b9f849dcd273b0f090da8d8387
Opcode Fuzzy Hash: 781a9cc5a0ab7d6e3f9434848a23c2c01f486e07dcad89ede4d80871ba601b63
Instruction Fuzzy Hash: 4D518F71A0061AAFDF11AB64C980B6EBBA9FF0435CF0444E9E943AB225D730E945CFD1

Function 02BE6A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6A7D
GetDiskFreeSpaceA.KERNEL32(02BE9E9D,02BE9A60,?,?,?,02BF22F8,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,02BE9A60,?,?,02BE9E9D), ref: 02BE6B80
GetLastError.KERNEL32(?,?,?,02BE9A60,?,?,02BE9E9D,?,?,?,?,?,02BE9E9D,?,00000022,?), ref: 02BE6B96

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: ec546d057d8708fab633a8dbd7292f69f076150afece248f3a1046009022d2e5
Instruction ID: 5fb1d6ea5ffbd269aa08012c82ff3000c4073f12feff8fab2f4f54455b83b138
Opcode Fuzzy Hash: ec546d057d8708fab633a8dbd7292f69f076150afece248f3a1046009022d2e5
Instruction Fuzzy Hash: 0C31CEB2D0010DAFDF01AFB48C85BDE7B7DEF68354F1488A6E652A3241D73096A48F61

Function 02BE6F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,02BED7C3), ref: 02BE6F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,02BED7C3), ref: 02BE6FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 02BE6FE8
LocalFree.KERNEL32(00000120), ref: 02BE701F
wsprintfA.USER32 ref: 02BE7036

Strings

/%d, xrefs: 02BE7030
|, xrefs: 02BE6FB3

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: b33a0ec9d841ab56e347518fb0398194bd32e41d4ba8df395c24767eb49ce3b6
Instruction ID: 793bbe5f6516bcc261ab7288ec4cc7173f43f9811cd82bc68d177293f9d0442d
Opcode Fuzzy Hash: b33a0ec9d841ab56e347518fb0398194bd32e41d4ba8df395c24767eb49ce3b6
Instruction Fuzzy Hash: 90311A72900209BBDF01DFA8D848ADA7BBCEF04354F0485A6F91ADB115EB35E6188B94

Function 02BE6CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,02BF22F8,000000E4,02BE6DDC,000000C8), ref: 02BE6CE7
GetProcAddress.KERNEL32(00000000), ref: 02BE6CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02BE6D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02BE6D2B

Strings

GetSystemWow64DirectoryA, xrefs: 02BE6CDD
kernel32, xrefs: 02BE6CE2
C:\Windows\SysWOW64\, xrefs: 02BE6CC9, 02BE6CD1, 02BE6CFE, 02BE6D05, 02BE6D13, 02BE6D1E, 02BE6D2A, 02BE6D42, 02BE6D5F, 02BE6D85

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: c5204e3d031a39aca52919b426acc8c3ce571b83fd502b039213dd18c25f6f1a
Instruction ID: a256ddaf9c8b7555da0574b8b1c388e9197a17172cbd92b8f871030aee31a6e4
Opcode Fuzzy Hash: c5204e3d031a39aca52919b426acc8c3ce571b83fd502b039213dd18c25f6f1a
Instruction Fuzzy Hash: E9215E61A8024479FFA5A7364C8CF7B3F4DCF16754F1C88C4FE06A7096DB94858982B5

Function 02BE977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,02BE9947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,02BF22F8), ref: 02BE97B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,02BF22F8), ref: 02BE97EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,02BF22F8), ref: 02BE97F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,02BF22F8), ref: 02BE9831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,02BF22F8), ref: 02BE984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,02BF22F8), ref: 02BE985B

Strings

D, xrefs: 02BE97A9

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 89abbf9ae54820295a0e55627d01d5407886a24da57efe260ed329ac2d10e104
Instruction ID: 9b14e7c2df9199be02014991b4eacc2954a32f3e600af8ffb494fa9e1f0fe2ae
Opcode Fuzzy Hash: 89abbf9ae54820295a0e55627d01d5407886a24da57efe260ed329ac2d10e104
Instruction Fuzzy Hash: 39212C71D41119ABDF51AFA1DC49FEF7B7CEF09694F0008A0BA1AE2054EB309658CAA0

Function 02BEE8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02BEDD05: GetTickCount.KERNEL32 ref: 02BEDD0F
Part of subcall function 02BEDD05: InterlockedExchange.KERNEL32(02BF36B4,00000001), ref: 02BEDD44
Part of subcall function 02BEDD05: GetCurrentThreadId.KERNEL32 ref: 02BEDD53

Part of subcall function 02BEDD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 02BEDDB5

lstrcpynA.KERNEL32(?,02BE1E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,02BEEAAA,?,?), ref: 02BEE8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,02BEEAAA,?,?,00000001,?,02BE1E84,?), ref: 02BEE935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,02BEEAAA,?,?,00000001,?,02BE1E84,?,0000000A), ref: 02BEE93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,02BEEAAA,?,?,00000001,?,02BE1E84,?), ref: 02BEE94F

Strings

localcfg, xrefs: 02BEE8AB
flags_upd, xrefs: 02BEE8A7

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 5a7cfde9d7ee00f68cca9b9dc8af33d7293ba43fbbcbf89587a412835dbf7941
Instruction ID: 37ec9ea47bf091ff674fb9c55368475c428bcecc0aad3bb12d69be9ef9bcec60
Opcode Fuzzy Hash: 5a7cfde9d7ee00f68cca9b9dc8af33d7293ba43fbbcbf89587a412835dbf7941
Instruction Fuzzy Hash: CE51FF72D0020AAFCF11EFA8C984DAEB7F9FF48314F144569E516A7210D775EA158F90

Function 02BE6BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02BE6BB2

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 0bb842c657d592dd9584e18e336f55f495fecd55a672e72c4d13a3ceb33fc7f2
Instruction ID: a000e31d592156a5dca3ea4399e99f3a1384267d4f4b22890ed979f89fe5bb5e
Opcode Fuzzy Hash: 0bb842c657d592dd9584e18e336f55f495fecd55a672e72c4d13a3ceb33fc7f2
Instruction Fuzzy Hash: 3A21AC72904109FFDF51ABB0ED88EAF7BACDB147A4B104891F603E2191EB30DA00DA74

Function 02BE9064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,02BF22F8), ref: 02BE907B
wsprintfA.USER32 ref: 02BE90E9
CreateFileA.KERNEL32(02BF22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02BE910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02BE9122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02BE912D
CloseHandle.KERNEL32(00000000), ref: 02BE9134

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 3e3d56c152ad8a4699a6c2871ed307ba5f7d1fdea886c4458c7715536c4c1ff0
Instruction ID: f9b014cd6cf2d07548fe200881c0e24bbd943025fde2ba93635ef93f0be87526
Opcode Fuzzy Hash: 3e3d56c152ad8a4699a6c2871ed307ba5f7d1fdea886c4458c7715536c4c1ff0
Instruction Fuzzy Hash: B911D6B2A405147BFB657732DC09FAF366EDBC4B10F0088A5BB0BE2155EB708A518B60

Function 02BEDD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BEDD0F
GetCurrentThreadId.KERNEL32 ref: 02BEDD20
GetTickCount.KERNEL32 ref: 02BEDD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,02BEE538,?,76230F10,?,00000000,?,02BEA445), ref: 02BEDD3B
InterlockedExchange.KERNEL32(02BF36B4,00000001), ref: 02BEDD44
GetCurrentThreadId.KERNEL32 ref: 02BEDD53

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 368f9a0de6b8cb32a49d15160568776f2546c3fab4031c398176cef83e9e56fb
Instruction ID: a8974aacecfb30adb4b389f6a017f3bfa06b3cb421ddd9f7a751188f36075116
Opcode Fuzzy Hash: 368f9a0de6b8cb32a49d15160568776f2546c3fab4031c398176cef83e9e56fb
Instruction Fuzzy Hash: 92F0E972988109FFCBC06BB5E884B2D77E9E745391F004C95E30AC3256C7645065CF21

Function 02BEAD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 02BEAD1C
lstrlenA.KERNEL32(?), ref: 02BEAD60
lstrlenA.KERNEL32(?), ref: 02BEAD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 02BEAD7F

Strings

LocalHost, xrefs: 02BEAD79

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 59360af16e025066ffa6607fc3e091da0d268e3fe48d1e48203131a102543148
Instruction ID: a5215b6e0b4440730ab3e96f59d08136d52a41429b1bcc23d2891bf769c601c8
Opcode Fuzzy Hash: 59360af16e025066ffa6607fc3e091da0d268e3fe48d1e48203131a102543148
Instruction Fuzzy Hash: 0E01F5208841895EDF31563CD844BBD7F6EEB8674BF5084D5E4C29B126EF2490878762

Function 02BE4280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,02BE98FD,00000001,00000100,02BF22F8,02BEA3C7), ref: 02BE4290
CloseHandle.KERNEL32(02BEA3C7), ref: 02BE43AB
CloseHandle.KERNEL32(00000001), ref: 02BE43AE

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 449e09dd41cb4a1c9d2d5ae970ade694bc45a7c442f7b794f43d595a101963cf
Instruction ID: 1ead499cce2bef23ec011b09f4a639c5403feaa205cbafe929eb948f1f8658f0
Opcode Fuzzy Hash: 449e09dd41cb4a1c9d2d5ae970ade694bc45a7c442f7b794f43d595a101963cf
Instruction Fuzzy Hash: B6419CB1C00209BBDF10ABB1DD85FAFBFB9EF40364F1045A5F606A6181D7349650CBA0

Function 02BE6069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02BE609C
LoadLibraryA.KERNEL32(?,?,02BE64CF,00000000), ref: 02BE60C3
GetProcAddress.KERNEL32(?,00000014), ref: 02BE614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02BE619E

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: bfd9bd32489e6fa3776729d548b6846044c107f70681b417d027badcb11364a2
Instruction ID: 2431f36d28aba79bf6e75195c8616148bb33781ffa2dea9916e65dd3b80efac9
Opcode Fuzzy Hash: bfd9bd32489e6fa3776729d548b6846044c107f70681b417d027badcb11364a2
Instruction Fuzzy Hash: 76417F71E0020AEFDF15CF68C884B69B7B9FF24358F1485A9E916D7292D730E990CB91

Function 02BE2923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7e456ed0058b5244d20e27881d2053e64a6cf3f6b0d264b265ebfb9104d3a7
Instruction ID: a612ef070bc97cbd7a5080a0166e9170f82c7ff67a3154435dfe3297516a7ff5
Opcode Fuzzy Hash: ba7e456ed0058b5244d20e27881d2053e64a6cf3f6b0d264b265ebfb9104d3a7
Instruction Fuzzy Hash: 8A31C071A40208ABDF109FA4CC81BBEB7F8FF48701F105896E916E7241E374D641CB60

Function 02BE26FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE272E
htons.WS2_32(00000001), ref: 02BE2752
htons.WS2_32(0000000F), ref: 02BE27D5
htons.WS2_32(00000001), ref: 02BE27E3
sendto.WS2_32(?,02BF2BF8,00000009,00000000,00000010,00000010), ref: 02BE2802

Part of subcall function 02BEEBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,02BEEBFE,7FFF0001,?,02BEDB55,7FFF0001), ref: 02BEEBD3
Part of subcall function 02BEEBCC: RtlAllocateHeap.NTDLL(00000000,?,02BEDB55,7FFF0001), ref: 02BEEBDA

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: a581cab84845baebd460fa5ad55d4dce029e934191cfeeee37c631adc741ed09
Instruction ID: 41c1f97fcd604afb4ac098eedf7ebaf1e7beb6f90d90c1f15e9b523203fe07ec
Opcode Fuzzy Hash: a581cab84845baebd460fa5ad55d4dce029e934191cfeeee37c631adc741ed09
Instruction Fuzzy Hash: C3316B34A803869FDB109FB4D881A617764EF1D358F1988ADEE56CB313D732D892EB10

Function 02BE9145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,02BF22F8), ref: 02BE915F
GetModuleFileNameA.KERNEL32(00000000), ref: 02BE9166
CharToOemA.USER32(?,?), ref: 02BE9174
wsprintfA.USER32 ref: 02BE91A9

Part of subcall function 02BE9064: GetTempPathA.KERNEL32(00000400,?,00000000,02BF22F8), ref: 02BE907B
Part of subcall function 02BE9064: wsprintfA.USER32 ref: 02BE90E9
Part of subcall function 02BE9064: CreateFileA.KERNEL32(02BF22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02BE910E
Part of subcall function 02BE9064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 02BE9122
Part of subcall function 02BE9064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 02BE912D
Part of subcall function 02BE9064: CloseHandle.KERNEL32(00000000), ref: 02BE9134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02BE91E1

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 1ebfc0e5ac1b3311cad60a83eb9556bf28c68d7657e84cc50e5678c182b7c09a
Instruction ID: 6a879d15d694d267945e3f5aaf473bc2cd46e234241d9894325c0bc5d99796d2
Opcode Fuzzy Hash: 1ebfc0e5ac1b3311cad60a83eb9556bf28c68d7657e84cc50e5678c182b7c09a
Instruction Fuzzy Hash: 9E0180F69401187BDB60A7618D49FEF777CDB95701F000491BB4AE2051DB7097888F70

Function 02BE2419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,02BE2491,?,?,?,02BEE844,-00000030,?,?,?,00000001), ref: 02BE2429
lstrlenA.KERNEL32(?,?,02BE2491,?,?,?,02BEE844,-00000030,?,?,?,00000001,02BE1E3D,00000001,localcfg,lid_file_upd), ref: 02BE243E
lstrcmpiA.KERNEL32(?,?), ref: 02BE2452
lstrlenA.KERNEL32(?,?,02BE2491,?,?,?,02BEE844,-00000030,?,?,?,00000001,02BE1E3D,00000001,localcfg,lid_file_upd), ref: 02BE2467

Strings

localcfg, xrefs: 02BE241F

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 17fbe8a71db0a17798accc6419785039172c8e40e131e712469add7dfb406314
Instruction ID: 0b0e63198ced00f70d466603b53ee4b3934f3850c3547a214b0c07832ad19bc4
Opcode Fuzzy Hash: 17fbe8a71db0a17798accc6419785039172c8e40e131e712469add7dfb406314
Instruction Fuzzy Hash: 0E01DA31A0021CAFCF11EF69DC849DEBBB9EF44394B05C565EE5A97211E730EA509B90

Function 02BE1C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 02BE1CE1
wsprintfA.USER32 ref: 02BE1D6B

Strings

localcfg, xrefs: 02BE1C70
%u.%u.%u.%u.%s, xrefs: 02BE1CDB, 02BE1D65

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 074a0a4e78e65253dfd5344092f4bde5059d393d38682b099ebc2484c4dfec02
Instruction ID: 8336531c9dba8f371b1efb2327437ac3ee60e391cd87a32ab52117e213f40db9
Opcode Fuzzy Hash: 074a0a4e78e65253dfd5344092f4bde5059d393d38682b099ebc2484c4dfec02
Instruction Fuzzy Hash: 02418A729042989FDF21DF788C44AEE3BE99F49310F244096F9A5D3152D734EA04CBA0

Function 02BEE654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02BEDD05: GetTickCount.KERNEL32 ref: 02BEDD0F
Part of subcall function 02BEDD05: InterlockedExchange.KERNEL32(02BF36B4,00000001), ref: 02BEDD44
Part of subcall function 02BEDD05: GetCurrentThreadId.KERNEL32 ref: 02BEDD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,02BE5EC1), ref: 02BEE693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,02BE5EC1), ref: 02BEE6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,76230F10,00000000,?,02BE5EC1), ref: 02BEE722

Strings

89ABCDEF, xrefs: 02BEE721

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 02f696f721875a2fd3cb18ef1be9d32ba03c69a8e61a9b6fed9225079e9e03d2
Instruction ID: 81bc3d2da0aa317836a37ebbba76617dcb200b65a4f333a1235a3e7db657fd4d
Opcode Fuzzy Hash: 02f696f721875a2fd3cb18ef1be9d32ba03c69a8e61a9b6fed9225079e9e03d2
Instruction Fuzzy Hash: 2C31BE72A00B06DFCF318F64D884B6677E5EF05374F1088AAEA578B552E770E884CB91

Function 02BEE095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,02BEE2A3,00000000,00000000,00000000,00020106,00000000,02BEE2A3,00000000,000000E4), ref: 02BEE0B2
RegSetValueExA.ADVAPI32(02BEE2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,02BF22F8), ref: 02BEE127
RegDeleteValueA.ADVAPI32(02BEE2A3,?,?,?,?,?,000000C8,02BF22F8), ref: 02BEE158
RegCloseKey.ADVAPI32(02BEE2A3,?,?,?,?,000000C8,02BF22F8,?,?,?,?,?,?,?,?,02BEE2A3), ref: 02BEE161

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 9a0e786a244598f3991b5e42f3a73fe1d8ed0715ae7f8dd44a044d9f4697a8c5
Instruction ID: de4dba7f45aa614c5021f3842d6870059531c8d32991f66c7974bc4a449b6228
Opcode Fuzzy Hash: 9a0e786a244598f3991b5e42f3a73fe1d8ed0715ae7f8dd44a044d9f4697a8c5
Instruction Fuzzy Hash: 9C215E71E0021DBBDF209EA4DC89EDE7F79EF097A0F0040A1FA05A6151E771CA94DB91

Function 02BE3F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,02BEA3C7,00000000,00000000,000007D0,00000001), ref: 02BE3FB8
GetLastError.KERNEL32 ref: 02BE3FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 02BE3FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02BE3FE6

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 081149fd61541e72b4ad900940f1e358263878ace2e1c02cd7886043576d2927
Instruction ID: e3c1d4c689f6d86ad01c65f2634a924a46433e393c580e6502d1931b6d0286db
Opcode Fuzzy Hash: 081149fd61541e72b4ad900940f1e358263878ace2e1c02cd7886043576d2927
Instruction Fuzzy Hash: 7501E97291010AABDF11DFA4DD45BEE7BBCEB04355F004491FA02E3050D771DA649BB2

Function 02BE3F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,02BEA3C7,00000000,00000000,000007D0,00000001), ref: 02BE3F44
GetLastError.KERNEL32 ref: 02BE3F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 02BE3F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 02BE3F72

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: eec4355aad41c18d845e0f830a9e7549a325c6edb8c8bbab7f81358da11e6383
Instruction ID: 2262e106d1b85ec3a9bd31eba67855980cd6f03d57cda890b56422abeeafae7f
Opcode Fuzzy Hash: eec4355aad41c18d845e0f830a9e7549a325c6edb8c8bbab7f81358da11e6383
Instruction Fuzzy Hash: F601D772911109ABDF01DFA0ED44BEE7BBCEB04355F1044A6FA02E3050D730DA248BA2

Function 02BE4E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE4E9E
GetTickCount.KERNEL32 ref: 02BE4EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 02BE4EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 02BE4EC3

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 6ac7905295b006da6a46579e378070ae4b1a9ad5b891d94b08a4147da482dcbb
Instruction ID: 370620d5580c13bb8db681dd87965f6637968489b3b1307cd8154712908b3f61
Opcode Fuzzy Hash: 6ac7905295b006da6a46579e378070ae4b1a9ad5b891d94b08a4147da482dcbb
Instruction Fuzzy Hash: AEE0263264020867DB0032B9AC80F6772599B453A0F010D71E70AC3145C75AD41241B1

Function 02BEA4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BEA4D1
GetTickCount.KERNEL32 ref: 02BEA4E4
Sleep.KERNEL32(00000000,?,02BEC2E9,02BEC4E0,00000000,localcfg,?,02BEC4E0,02BF3588,02BE8810), ref: 02BEA4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 02BEA4FA

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: ac323cfde70fb5957374b6212aff05b6fe601c57cd4e084c101fdf91dfbeb6d3
Instruction ID: 7a2cd06925cc3908e17f7956a5976b2d7425676736225a52dc0ae44970b3439c
Opcode Fuzzy Hash: ac323cfde70fb5957374b6212aff05b6fe601c57cd4e084c101fdf91dfbeb6d3
Instruction Fuzzy Hash: E5E0263324020867CB0037B5AC84F6A739DEB497A1F0608A1FB06E3242C716A55182B6

Function 02BE4BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE4BDD
GetTickCount.KERNEL32 ref: 02BE4BEC
Sleep.KERNEL32(00000000,?,?,?,0321E09C,02BE50F2), ref: 02BE4BF9
InterlockedExchange.KERNEL32(0321E090,00000001), ref: 02BE4C02

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 6e512d4cf0c59d593dcbd6e519912f214e35d702d170d45d8e65adbccaf03b62
Instruction ID: 27d027c374a6654efbf73219a2b47a3e98c32068bafd5d1f68a0e6c1a3f1c902
Opcode Fuzzy Hash: 6e512d4cf0c59d593dcbd6e519912f214e35d702d170d45d8e65adbccaf03b62
Instruction Fuzzy Hash: E6E07D3768020C27CB0036B59C80F56736CDB453A1F020CB2F70AC3241C792E41042B1

Function 02BE30FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE3103
GetTickCount.KERNEL32 ref: 02BE310F
Sleep.KERNEL32(00000000), ref: 02BE311C
InterlockedExchange.KERNEL32(?,00000001), ref: 02BE3128

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5aa8bf4722ff308e44b418062ec4c2641074a1cd8d23f9dfca715f2747df56c0
Instruction ID: 71803ea5e49bbfef32e6d1901317e1b59ba807b0a823a16345636d1efce769b9
Opcode Fuzzy Hash: 5aa8bf4722ff308e44b418062ec4c2641074a1cd8d23f9dfca715f2747df56c0
Instruction Fuzzy Hash: 9AE0C231640219ABDF403B75AD85B6AAA9ADF847A1F010CB9F302D35A5C75088509A73

Function 02BE8CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BE8D02
GetTickCount.KERNEL32 ref: 02BE8DA1

Strings

localcfg, xrefs: 02BE8D19

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 32dd3f13e90278597b03d95df4d4ebd66aa10233e97a6559ec5551d84a3958bd
Instruction ID: a818efa71195922fbe62b67c6d01ad16fd6e28509e873c6553ea5ecc45e7ba53
Opcode Fuzzy Hash: 32dd3f13e90278597b03d95df4d4ebd66aa10233e97a6559ec5551d84a3958bd
Instruction Fuzzy Hash: BE21D232A10915AFCF50DF78D88065EBBBAEF21354B2589DDD402DB221CB31E940CB50

Function 02BEBFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 02BEBFD0
wsprintfA.USER32 ref: 02BEC060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 02BEC057

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 0d51a6c3803de936dcd1d908832a83ef46dc0395a90f303245483b8a1e88f771
Instruction ID: 16fdcfbdfc1dd1ac249a6e4d0d24009a25a19bd27960300542d824f9bb0a96ec
Opcode Fuzzy Hash: 0d51a6c3803de936dcd1d908832a83ef46dc0395a90f303245483b8a1e88f771
Instruction Fuzzy Hash: 27118672500100EFDB429AA9CD44E567FA6FB88358B34859CF6188A136D633D863EB50

Function 02BE26B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 02BE26C3
inet_ntoa.WS2_32(?), ref: 02BE26E4

Strings

localcfg, xrefs: 02BE26CD, 02BE26D2, 02BE26DE

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: 4bd2fbeec08327d5dab13fbd7ac3a54da5beb0f50f5db8c445afd25d1f404cd6
Instruction ID: c15334aa9b2d1251a339c8c7c1581df637de2bcd6f64538cac414b5f865de523
Opcode Fuzzy Hash: 4bd2fbeec08327d5dab13fbd7ac3a54da5beb0f50f5db8c445afd25d1f404cd6
Instruction Fuzzy Hash: 45F037725482097FEF006FA4EC05AAA379DDF05660F148866FE0ADA090DB71E950D798

Function 02BEEAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,02BEEB54,_alldiv,02BEF0B7,80000001,00000000,00989680,00000000,?,?,?,02BEE342,00000000,75B4EA50,80000001,00000000), ref: 02BEEAF2
GetProcAddress.KERNEL32(77310000,00000000), ref: 02BEEB07

Strings

ntdll.dll, xrefs: 02BEEAED

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: f63ce96398684330c9126a15147b6fc2262bc9d7657aea9b878df184b9b70bee
Instruction ID: a21adbe3a04055fc99661121e505a598a2d4084ee57a21718850b3df517b91e6
Opcode Fuzzy Hash: f63ce96398684330c9126a15147b6fc2262bc9d7657aea9b878df184b9b70bee
Instruction Fuzzy Hash: 0ED0C934A84342EB9F925F79998AE0576E8EB50791B404C95F60BD3611E731E468DA00

Function 02BE2F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02BE2D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,02BE2F01,?,02BE20FF,02BF2000), ref: 02BE2D3A
Part of subcall function 02BE2D21: LoadLibraryA.KERNEL32(?), ref: 02BE2D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 02BE2F73
HeapFree.KERNEL32(00000000), ref: 02BE2F7A

Memory Dump Source

Source File: 0000000D.00000002.3361760003.0000000002BE0000.00000040.00000400.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2be0000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: ccfde512e0ab533f3deea976615e050ef00798274d3b3a789ced7913a66c381f
Instruction ID: d120cd9a991b184f422bbe55f6ec5c8fa07b2d6125fbae1f8c129a07e9aefced
Opcode Fuzzy Hash: ccfde512e0ab533f3deea976615e050ef00798274d3b3a789ced7913a66c381f
Instruction Fuzzy Hash: 25519E7190020AAFDF05AF64D888AFAB7B9FF05304F1445A9ED97D7211E732DA19CB90

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6foBmRMlDy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\lnmlavab.exe

C:\Windows\SysWOW64\gqbqwogt\lnmlavab.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
6foBmRMlDy.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre