Edit tour

Windows Analysis Report
uMlLpvdLRU.exe

Overview

General Information

Sample name:	uMlLpvdLRU.exe renamed because original name is a hash value
Original sample name:	7ea98bd7f6a69b385310f5eaa86b6828.exe
Analysis ID:	1532438
MD5:	7ea98bd7f6a69b385310f5eaa86b6828
SHA1:	ab3ee16a99f901336fa6221f4fdc84e562154841
SHA256:	930b96bbec596e80fd6b6e4a37c34000113e1affb5f1aadbce2049f5800a6fce
Tags:	exeuser-abuse_ch
Infos:

Detection

Tofsee

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Tofsee

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious New Service Creation

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Windows Defender Exclusions Added - Registry

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

uMlLpvdLRU.exe (PID: 5748 cmdline: "C:\Users\user\Desktop\uMlLpvdLRU.exe" MD5: 7EA98BD7F6A69B385310F5EAA86B6828)

cmd.exe (PID: 1432 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuzqifwu\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5616 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bndqedvz.exe" C:\Windows\SysWOW64\yuzqifwu\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7072 cmdline: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6480 cmdline: "C:\Windows\System32\sc.exe" description yuzqifwu "wifi internet conection" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6248 cmdline: "C:\Windows\System32\sc.exe" start yuzqifwu MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6008 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 3840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bndqedvz.exe (PID: 6368 cmdline: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d"C:\Users\user\Desktop\uMlLpvdLRU.exe" MD5: 491E03099055090A2BCF55796B5D0830)

svchost.exe (PID: 1600 cmdline: svchost.exe MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 3088 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7092 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tofsee	According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.	No Attribution	https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/ https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html https://blog.talosintelligence.com/tofsee-spam/ https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4 https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee

Malware Configuration

Threatname: Tofsee

{"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1708:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13f0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x27ab:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xf0fc:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Process Memory Space: uMlLpvdLRU.exe PID: 5748	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: bndqedvz.exe PID: 6368	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 1600	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.uMlLpvdLRU.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.uMlLpvdLRU.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.uMlLpvdLRU.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.bndqedvz.exe.d60000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.3.bndqedvz.exe.d60000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.bndqedvz.exe.d60000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bndqedvz.exe.6b0e67.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bndqedvz.exe.6b0e67.1.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.6b0e67.1.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.3.bndqedvz.exe.d60000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.3.bndqedvz.exe.d60000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.bndqedvz.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bndqedvz.exe.400000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.400000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
18.2.svchost.exe.390000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.390000.0.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.390000.0.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.uMlLpvdLRU.exe.2080e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.uMlLpvdLRU.exe.2080e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
18.2.svchost.exe.390000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.svchost.exe.390000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
18.2.svchost.exe.390000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bndqedvz.exe.d60000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bndqedvz.exe.d60000.2.raw.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x2544:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xee95:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.d60000.2.raw.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0x1123e:$s1: n%systemroot%\system32\cmd.exe 0x10310:$s2: loader_id 0x10340:$s3: start_srv 0x10370:$s4: lid_file_upd 0x10364:$s5: localcfg 0x10a94:$s6: Incorrect respons 0x10b74:$s7: mx connect error 0x10af0:$s8: Error sending command (sent = %d/%d) 0x10c28:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bndqedvz.exe.6b0e67.1.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.6b0e67.1.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
0.3.uMlLpvdLRU.exe.20a0000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0xd44:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xd695:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.3.uMlLpvdLRU.exe.20a0000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xe110:$s2: loader_id 0xe140:$s3: start_srv 0xe170:$s4: lid_file_upd 0xe164:$s5: localcfg 0xe894:$s6: Incorrect respons
12.2.bndqedvz.exe.d60000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bndqedvz.exe.d60000.2.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.d60000.2.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
0.2.uMlLpvdLRU.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.uMlLpvdLRU.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
0.2.uMlLpvdLRU.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
12.2.bndqedvz.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
12.2.bndqedvz.exe.400000.0.unpack	Windows_Trojan_Tofsee_26124fe4	unknown	unknown	0x1944:$a: 55 8B EC 8B 45 08 57 8B 7D 10 B1 01 85 FF 74 1D 56 8B 75 0C 2B F0 8A 14 06 32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14 40 4F 75 EA 5E 8B 45 08 5F 5D C3 0xe295:$b: 8B 44 24 04 53 8A 18 84 DB 74 2D 8B D0 2B 54 24 0C 8B 4C 24 0C 84 DB 74 12 8A 19 84 DB 74 1B 38 1C 0A 75 07 41 80 3C 0A 00 75 EE 80 39 00 74 0A 40 8A 18 42 84 DB 75 D9 33 C0 5B C3
12.2.bndqedvz.exe.400000.0.unpack	MALWARE_Win_Tofsee	Detects Tofsee	ditekSHen	0xfc3e:$s1: n%systemroot%\system32\cmd.exe 0xed10:$s2: loader_id 0xed40:$s3: start_srv 0xed70:$s4: lid_file_upd 0xed64:$s5: localcfg 0xf494:$s6: Incorrect respons 0xf574:$s7: mx connect error 0xf4f0:$s8: Error sending command (sent = %d/%d) 0xf628:$s9: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
Click to see the 39 entries

Sigma Signatures

System Summary

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d"C:\Users\user\Desktop\uMlLpvdLRU.exe", ParentImage: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, ParentProcessId: 6368, ParentProcessName: bndqedvz.exe, ProcessCommandLine: svchost.exe, ProcessId: 1600, ProcessName: svchost.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\uMlLpvdLRU.exe", ParentImage: C:\Users\user\Desktop\uMlLpvdLRU.exe, ParentProcessId: 5748, ParentProcessName: uMlLpvdLRU.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7072, ProcessName: sc.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 52.101.11.0, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\SysWOW64\svchost.exe, Initiated: true, ProcessId: 1600, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49911

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d"C:\Users\user\Desktop\uMlLpvdLRU.exe", ParentImage: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, ParentProcessId: 6368, ParentProcessName: bndqedvz.exe, ProcessCommandLine: svchost.exe, ProcessId: 1600, ProcessName: svchost.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 0, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\svchost.exe, ProcessId: 1600, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\yuzqifwu

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\uMlLpvdLRU.exe", ParentImage: C:\Users\user\Desktop\uMlLpvdLRU.exe, ParentProcessId: 5748, ParentProcessName: uMlLpvdLRU.exe, ProcessCommandLine: "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support", ProcessId: 7072, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 3088, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uMlLpvdLRU.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bndqedvz.exe

Avira: detection malicious, Label: TR/AD.Tofsee.fkivj

Found malware configuration

Source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack

Malware Configuration Extractor: Tofsee {"C2 list": ["vanaheim.cn:443", "jotunheim.name:443"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bndqedvz.exe	ReversingLabs: Detection: 87%
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: uMlLpvdLRU.exe	ReversingLabs: Detection: 78%
Source: uMlLpvdLRU.exe	Virustotal: Detection: 77%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\bndqedvz.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: uMlLpvdLRU.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Unpacked PE file: 0.2.uMlLpvdLRU.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Unpacked PE file: 12.2.bndqedvz.exe.400000.0.unpack

Source: uMlLpvdLRU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\yuzqifwu

Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.109 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.228.234.180 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: vanaheim.cn:443
Source: Malware configuration extractor	URLs: jotunheim.name:443

Source: Joe Sandbox View	IP Address: 52.101.40.26 52.101.40.26
Source: Joe Sandbox View	IP Address: 52.101.11.0 52.101.11.0
Source: Joe Sandbox View	IP Address: 67.195.228.109 67.195.228.109
Source: Joe Sandbox View	IP Address: 217.69.139.150 217.69.139.150

Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS
Source: Joe Sandbox View	ASN Name: YAHOO-GQ1US YAHOO-GQ1US

Source: global traffic	TCP traffic: 192.168.2.6:49911 -> 52.101.11.0:25
Source: global traffic	TCP traffic: 192.168.2.6:49987 -> 67.195.228.109:25
Source: global traffic	TCP traffic: 192.168.2.6:49989 -> 64.233.166.26:25
Source: global traffic	TCP traffic: 192.168.2.6:49993 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.6:49999 -> 52.101.40.26:25
Source: global traffic	TCP traffic: 192.168.2.6:50001 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.6:50003 -> 142.251.168.26:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_00402A62

Source: global traffic	DNS traffic detected: DNS query: microsoft-com.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: vanaheim.cn
Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.ru
Source: global traffic	DNS traffic detected: DNS query: mxs.mail.ru
Source: global traffic	DNS traffic detected: DNS query: jotunheim.name

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443

Spam, unwanted Advertisements and Ransom Demands

Yara detected Tofsee

Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uMlLpvdLRU.exe PID: 5748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bndqedvz.exe PID: 6368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1600, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.3.bndqedvz.exe.d60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.3.bndqedvz.exe.d60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.6b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.6b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen
Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 Author: unknown
Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Tofsee Author: ditekSHen

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00408E26

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

0_2_00401280

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\yuzqifwu\

Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_0040C913	0_2_0040C913
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_0041A380	0_2_0041A380
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_0040C913	12_2_0040C913
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_0041A380	12_2_0041A380
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3420	12_2_006E3420
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3230	12_2_006E3230
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3618	12_2_006E3618
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E34E8	12_2_006E34E8
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E32F8	12_2_006E32F8
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3488	12_2_006E3488
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3290	12_2_006E3290
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3168	12_2_006E3168
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3358	12_2_006E3358
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3550	12_2_006E3550
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E31C8	12_2_006E31C8
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E33C0	12_2_006E33C0
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E35B0	12_2_006E35B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_0039C913	18_2_0039C913

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: String function: 020827AB appears 35 times

Source: uMlLpvdLRU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.3.bndqedvz.exe.d60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.3.bndqedvz.exe.d60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.uMlLpvdLRU.exe.2080e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.6b0e67.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.6b0e67.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.3.uMlLpvdLRU.exe.20a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee
Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Tofsee_26124fe4 reference_sample = e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494, os = windows, severity = x86, creation_date = 2022-03-31, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Tofsee, fingerprint = dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31, id = 26124fe4-f2a1-4fc9-8155-585b581476de, last_modified = 2022-04-12
Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Tofsee author = ditekSHen, description = Detects Tofsee

Source: uMlLpvdLRU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/3@12/9

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,CloseHandle,GetLastError,CloseHandle,DeleteFileA,GetLastError,

0_2_00406A60

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_005BA736 CreateToolhelp32Snapshot,Module32First,

0_2_005BA736

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

0_2_00409A6B

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00399A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00399A6B

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3380:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

File created: C:\Users\user\AppData\Local\Temp\bndqedvz.exe

Jump to behavior

Source: uMlLpvdLRU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uMlLpvdLRU.exe	ReversingLabs: Detection: 78%
Source: uMlLpvdLRU.exe	Virustotal: Detection: 77%

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

File read: C:\Users\user\Desktop\uMlLpvdLRU.exe

Jump to behavior

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

graph_12-17934

Source: unknown	Process created: C:\Users\user\Desktop\uMlLpvdLRU.exe "C:\Users\user\Desktop\uMlLpvdLRU.exe"
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuzqifwu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bndqedvz.exe" C:\Windows\SysWOW64\yuzqifwu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description yuzqifwu "wifi internet conection"
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start yuzqifwu
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d"C:\Users\user\Desktop\uMlLpvdLRU.exe"
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuzqifwu\	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bndqedvz.exe" C:\Windows\SysWOW64\yuzqifwu\	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description yuzqifwu "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start yuzqifwu	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: capauthz.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wifidatacapabilityhandler.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cellulardatacapabilityhandler.dll	Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Unpacked PE file: 0.2.uMlLpvdLRU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Unpacked PE file: 12.2.bndqedvz.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Unpacked PE file: 0.2.uMlLpvdLRU.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Unpacked PE file: 12.2.bndqedvz.exe.400000.0.unpack

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_005BDA1E push 0000002Bh; iretd	0_2_005BDA24
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006F0653 push eax; retf	12_2_006F0642
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E7706 push 0000002Bh; iretd	12_2_006E770C

Source: uMlLpvdLRU.exe

Static PE information: section name: .text entropy: 7.4254742701939

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)			Jump to dropped file
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	File created: C:\Users\user\AppData\Local\Temp\bndqedvz.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\yuzqifwu

Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

0_2_00409A6B

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support"

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: inet_addr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetBestInterface,GetProcessHeap,HeapAlloc,GetAdaptersInfo,HeapReAlloc,GetAdaptersInfo,HeapFree,FreeLibrary,FreeLibrary,

18_2_0039199C

Source: C:\Windows\SysWOW64\svchost.exe

Window / User API: threadDelayed 677

Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-15483
Source: C:\Windows\SysWOW64\svchost.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_18-6424
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_12-19268

Source: C:\Windows\SysWOW64\svchost.exe

Evaded block: after key decision

graph_18-6126

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_12-18316
Source: C:\Windows\SysWOW64\svchost.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_18-7314
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes	graph_0-15466

Source: C:\Windows\SysWOW64\svchost.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_18-7407

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_12-17950
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-15047

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	API coverage: 6.7 %
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	API coverage: 5.4 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 5588	Thread sleep count: 677 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5588	Thread sleep time: -677000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5588	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5588	Thread sleep time: -200000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_0041A380 GetSystemTimes followed by cmp: cmp dword ptr [004220dch], 0ah and CTI: jne 0041A5CFh		0_2_0041A380
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_0041A380 GetSystemTimes followed by cmp: cmp dword ptr [004220dch], 0ah and CTI: jne 0041A5CFh		12_2_0041A380

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,HeapCreate,GetTickCount,

0_2_00401D96

Source: svchost.exe, 00000012.00000002.4595103102.0000000002A00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	API call chain: ExitProcess graph end node			graph_0-15478
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node			graph_18-6418

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Windows\SysWOW64\svchost.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_18-7652
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Debugger detection routine: GetTickCount, GetTickCount, DecisionNodes, ExitProcess or Sleep			graph_12-19329

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00406069 IsBadReadPtr,LoadLibraryA,GetProcAddress,GetProcAddress,IsBadReadPtr,

0_2_00406069

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_005BA013 push dword ptr fs:[00000030h]	0_2_005BA013
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_0208092B mov eax, dword ptr fs:[00000030h]	0_2_0208092B
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_02080D90 mov eax, dword ptr fs:[00000030h]	0_2_02080D90
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006B092B mov eax, dword ptr fs:[00000030h]	12_2_006B092B
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006B0D90 mov eax, dword ptr fs:[00000030h]	12_2_006B0D90
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_006E3CFB push dword ptr fs:[00000030h]	12_2_006E3CFB

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

0_2_0040EBCC

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	0_2_00409A6B
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	12_2_00409A6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_00399A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	18_2_00399A6B

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.228.109 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.228.234.180 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.40.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.101.11.0 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.233.166.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.251.168.26 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 67.195.204.74 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.66.75.11 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 390000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 390000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 390000			Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 58D008			Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuzqifwu\	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bndqedvz.exe" C:\Windows\SysWOW64\yuzqifwu\	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support"	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" description yuzqifwu "wifi internet conection"	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start yuzqifwu	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

0_2_00407809

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00406EDD

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

0_2_0040405E

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_0040EC54 GetSystemTimeAsFileTime,GetVolumeInformationA,GetTickCount,

0_2_0040EC54

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

0_2_00407809

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

0_2_0040B211

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Code function: 0_2_00409326 GetVersionExA,GetModuleHandleA,GetModuleFileNameA,wsprintfA,wsprintfA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,

0_2_00409326

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe

Stealing of Sensitive Information

Yara detected Tofsee

Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uMlLpvdLRU.exe PID: 5748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bndqedvz.exe PID: 6368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1600, type: MEMORYSTR

Remote Access Functionality

Yara detected Tofsee

Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.bndqedvz.exe.d60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.2080e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.uMlLpvdLRU.exe.20a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.svchost.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.d60000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.uMlLpvdLRU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.bndqedvz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uMlLpvdLRU.exe PID: 5748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: bndqedvz.exe PID: 6368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1600, type: MEMORYSTR

Source: C:\Users\user\Desktop\uMlLpvdLRU.exe	Code function: 0_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	0_2_004088B0
Source: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe	Code function: 12_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	12_2_004088B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 18_2_003988B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,	18_2_003988B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	41 Native API	1 DLL Side-Loading	1 DLL Side-Loading	3 Disable or Modify Tools	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Service Execution	14 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	14 Windows Service	22 Software Packing	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	412 Process Injection	1 DLL Side-Loading	LSA Secrets	211 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	412 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uMlLpvdLRU.exe	79%	ReversingLabs	Win32.Trojan.RedLineStealer
uMlLpvdLRU.exe	77%	Virustotal		Browse
uMlLpvdLRU.exe	100%	Avira	TR/AD.Tofsee.riokt
uMlLpvdLRU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\bndqedvz.exe	100%	Avira	TR/AD.Tofsee.fkivj
C:\Users\user\AppData\Local\Temp\bndqedvz.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bndqedvz.exe	88%	ReversingLabs	Win32.Trojan.GCleaner
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)	88%	ReversingLabs	Win32.Trojan.GCleaner

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mxs.mail.ru	217.69.139.150	true	true	unknown
mta5.am0.yahoodns.net	67.195.228.109	true	true	unknown
jotunheim.name	80.66.75.11	true	true	unknown
microsoft-com.mail.protection.outlook.com	52.101.11.0	true	true	unknown
vanaheim.cn	185.228.234.180	true	true	unknown
smtp.google.com	64.233.166.26	true	false	unknown
google.com	unknown	unknown	true	unknown
yahoo.com	unknown	unknown	true	unknown
mail.ru	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
vanaheim.cn:443	true		unknown
jotunheim.name:443	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.101.40.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
52.101.11.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
67.195.228.109	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	true
64.233.166.26	smtp.google.com	United States	15169	GOOGLEUS	false
142.251.168.26	unknown	United States	15169	GOOGLEUS	false
185.228.234.180	vanaheim.cn	Russian Federation	64439	ITOS-ASRU	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
67.195.204.74	unknown	United States	26101	YAHOO-3US	true
80.66.75.11	jotunheim.name	Russian Federation	20803	RISS-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532438
Start date and time:	2024-10-13 07:30:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uMlLpvdLRU.exe renamed because original name is a hash value
Original Sample Name:	7ea98bd7f6a69b385310f5eaa86b6828.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/3@12/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.236.44.162, 20.112.250.133, 20.76.201.171, 20.70.246.20, 20.231.239.246
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:32:24	API Interceptor	855x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.101.40.26	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse
	.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Tofsee	Browse
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Tofsee	Browse
52.101.11.0	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	SGn3RtDC8Y.exe	Get hash	malicious	Tofsee	Browse
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	DWoKcG581L.exe	Get hash	malicious	Tofsee	Browse
67.195.228.109	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	l3Qj8QhTYZ.exe	Get hash	malicious	Phorpiex	Browse
185.228.234.180	Crt09EgZK3.exe	Get hash	malicious	Tofsee	Browse
185.228.234.180	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse
217.69.139.150	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse
	foufdsk.exe	Get hash	malicious	Tofsee	Browse
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta5.am0.yahoodns.net	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
	SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	67.195.204.72
	lYWiDKe1In.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	I7ldmFS13W.exe	Get hash	malicious	Phorpiex	Browse	67.195.204.73
jotunheim.name	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	80.66.75.11
	vyrcclmm.exe	Get hash	malicious	Tofsee	Browse	80.66.75.11
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse	80.66.75.11
	kPl1mZTpru.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	Wc4SadetF5.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	L7iza9mNDI.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	file.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	U9dDsItOij.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	t26nL0kcxj.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
	SecuriteInfo.com.Win32.BotX-gen.15544.10747.exe	Get hash	malicious	Tofsee	Browse	80.66.75.77
mxs.mail.ru	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	OPgjjiInNK.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	94.100.180.31
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	217.69.139.150

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YAHOO-GQ1US	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	na.elf	Get hash	malicious	Mirai	Browse	98.137.186.231
	na.elf	Get hash	malicious	Unknown	Browse	98.139.117.51
	na.elf	Get hash	malicious	Mirai	Browse	98.137.77.120
	Remittance_Regulvar.htm	Get hash	malicious	Unknown	Browse	74.6.160.106
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	98.137.11.164
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	98.137.11.164
	27987136e29b3032ad40982c8b7c2e168112c9601e08da806119dcba615524b5.html	Get hash	malicious	Unknown	Browse	98.137.11.163
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	98.137.11.164
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	98.137.11.163
MICROSOFT-CORP-MSN-AS-BLOCKUS	na.elf	Get hash	malicious	Mirai	Browse	137.135.68.55
	SecuriteInfo.com.Linux.Siggen.9999.5011.20467.elf	Get hash	malicious	Mirai	Browse	20.170.240.224
	KU4NMyi8i1.elf	Get hash	malicious	Mirai	Browse	52.228.135.142
	jYEvdBHMOI.elf	Get hash	malicious	Mirai	Browse	143.65.66.173
	o5DbX8v3ZW.elf	Get hash	malicious	Mirai	Browse	20.18.185.9
	YsI7t2OC5q.elf	Get hash	malicious	Mirai	Browse	20.55.77.78
	yQMBCvJVWp.elf	Get hash	malicious	Mirai	Browse	52.225.230.108
	PeleHfdpzX.elf	Get hash	malicious	Mirai	Browse	20.197.35.131
	ULRmk7oYR7.elf	Get hash	malicious	Mirai	Browse	20.1.227.164
	na.elf	Get hash	malicious	Unknown	Browse	158.158.1.110
MICROSOFT-CORP-MSN-AS-BLOCKUS	na.elf	Get hash	malicious	Mirai	Browse	137.135.68.55
	SecuriteInfo.com.Linux.Siggen.9999.5011.20467.elf	Get hash	malicious	Mirai	Browse	20.170.240.224
	KU4NMyi8i1.elf	Get hash	malicious	Mirai	Browse	52.228.135.142
	jYEvdBHMOI.elf	Get hash	malicious	Mirai	Browse	143.65.66.173
	o5DbX8v3ZW.elf	Get hash	malicious	Mirai	Browse	20.18.185.9
	YsI7t2OC5q.elf	Get hash	malicious	Mirai	Browse	20.55.77.78
	yQMBCvJVWp.elf	Get hash	malicious	Mirai	Browse	52.225.230.108
	PeleHfdpzX.elf	Get hash	malicious	Mirai	Browse	20.197.35.131
	ULRmk7oYR7.elf	Get hash	malicious	Mirai	Browse	20.1.227.164
	na.elf	Get hash	malicious	Unknown	Browse	158.158.1.110

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\bndqedvz.exe

Download File

Process:	C:\Users\user\Desktop\uMlLpvdLRU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10786816
Entropy (8bit):	5.269688553800493
Encrypted:	false
SSDEEP:	49152:pp+Le6666666666666666666666666666666666666666666666666666666666T:p
MD5:	491E03099055090A2BCF55796B5D0830
SHA1:	296C19B55B83B7406C31715177974D7E59312808
SHA-256:	C4D820B04DB007D9E2A56C83FDA9C8174FCA33C3C4844F6AA04E7210DB2B911A
SHA-512:	964916B69C34A75C542000C19D822B6EF0F00AB358CE5082C5A88786A123E100EF2A80F7240A9C63286D99A0EF2AAA3123D807A75E2AE36EFD74075180AA20FA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?H..lH..lH..l.QlI..l'.blQ..l'.WlZ..l'.cl-..lA.ZlM..lH..l9..l'.flI..l'.SlI..l'.TlI..lRichH..l........................PE..L.....Oe.....................h....................@..........................0..................................................<....P...............................................................................................................text............................... ..`.rdata...'.......(..................@..@.data...@b....... ..................@....rsrc........P......................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10786816
Entropy (8bit):	5.269688553800493
Encrypted:	false
SSDEEP:	49152:pp+Le6666666666666666666666666666666666666666666666666666666666T:p
MD5:	491E03099055090A2BCF55796B5D0830
SHA1:	296C19B55B83B7406C31715177974D7E59312808
SHA-256:	C4D820B04DB007D9E2A56C83FDA9C8174FCA33C3C4844F6AA04E7210DB2B911A
SHA-512:	964916B69C34A75C542000C19D822B6EF0F00AB358CE5082C5A88786A123E100EF2A80F7240A9C63286D99A0EF2AAA3123D807A75E2AE36EFD74075180AA20FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?H..lH..lH..l.QlI..l'.blQ..l'.WlZ..l'.cl-..lA.ZlM..lH..l9..l'.flI..l'.SlI..l'.TlI..lRichH..l........................PE..L.....Oe.....................h....................@..........................0..................................................<....P...............................................................................................................text............................... ..`.rdata...'.......(..................@..@.data...@b....... ..................@....rsrc........P......................@..@........................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.400043831825845
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uMlLpvdLRU.exe
File size:	243'712 bytes
MD5:	7ea98bd7f6a69b385310f5eaa86b6828
SHA1:	ab3ee16a99f901336fa6221f4fdc84e562154841
SHA256:	930b96bbec596e80fd6b6e4a37c34000113e1affb5f1aadbce2049f5800a6fce
SHA512:	25f618ee87b577eec384fd49c40fe00dfa4caaf50b36227431ba838dd461024256a578857026d0942db495a6894b51a55d84190cbe78ab55f46c3c6471a0eb09
SSDEEP:	3072:vRSPDpmSd0310NWYOTLGp+6vDYCm0aW9s/aL/MOvobE80Ogdh1ei4T6Ql:vyDpmSK3104/LS+alDz/MRP0Vdh1tQ
TLSH:	4734290266E36815FD62C7314E3B82F5FA1EBCA29E75267E31147FDF18721A38552B02
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........?H..lH..lH..l..QlI..l'.blQ..l'.WlZ..l'.cl-..lA.ZlM..lH..l9..l'.flI..l'.SlI..l'.TlI..lRichH..l........................PE..L..

File Icon


Icon Hash:	738733b18ba383e4

Static PE Info

General

Entrypoint:	0x401a87
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x654FCFD1 [Sat Nov 11 19:02:41 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	5107e1e1d9cfa977f2674eeaca10490f

Entrypoint Preview

Instruction
call 00007F9294C05C52h
jmp 00007F9294C017DEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0041FAF0h], eax
mov dword ptr [0041FAECh], ecx
mov dword ptr [0041FAE8h], edx
mov dword ptr [0041FAE4h], ebx
mov dword ptr [0041FAE0h], esi
mov dword ptr [0041FADCh], edi
mov word ptr [0041FB08h], ss
mov word ptr [0041FAFCh], cs
mov word ptr [0041FAD8h], ds
mov word ptr [0041FAD4h], es
mov word ptr [0041FAD0h], fs
mov word ptr [0041FACCh], gs
pushfd
pop dword ptr [0041FB00h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0041FAF4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0041FAF8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0041FB04h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0041FA40h], 00010001h
mov eax, dword ptr [0041FAF8h]
mov dword ptr [0041F9F4h], eax
mov dword ptr [0041F9E8h], C0000409h
mov dword ptr [0041F9ECh], 00000001h
mov eax, dword ptr [0041E004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0041E008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000E8h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ce84	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x1d3c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x194	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1977f	0x19800	ec7567fe8938f53a3781b3c97ef69087	False	0.7754193474264706	data	7.4254742701939	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x27c6	0x2800	8a4f899406b6c07bc94033367c77d80c	False	0.353515625	data	4.982702804137893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x6240	0x2000	01fa0794ef041654340f7c151d43a38f	False	0.184814453125	data	2.126919075500568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x1d3c8	0x1d400	cca7a410f70eb0fbb4c0536c6b918dc7	False	0.43920272435897434	data	5.235838030261332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3d130	0x2	data			5.0
KADORUN	0x3c510	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6020241593209272
RT_CURSOR	0x3d138	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x3d268	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x25aa0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.5868869936034116
RT_ICON	0x26948	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6606498194945848
RT_ICON	0x271f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.7194700460829493
RT_ICON	0x278b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7622832369942196
RT_ICON	0x27e20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5440871369294605
RT_ICON	0x2a3c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.6597091932457786
RT_ICON	0x2b470	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.6782786885245902
RT_ICON	0x2bdf8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.8023049645390071
RT_ICON	0x2c2d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.35154584221748403
RT_ICON	0x2d180	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5464801444043321
RT_ICON	0x2da28	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6146313364055299
RT_ICON	0x2e0f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.680635838150289
RT_ICON	0x2e658	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.4262448132780083
RT_ICON	0x30c00	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5217213114754098
RT_ICON	0x31588	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.5106382978723404
RT_ICON	0x31a58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.4069829424307036
RT_ICON	0x32900	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.572202166064982
RT_ICON	0x331a8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.625
RT_ICON	0x33870	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.630057803468208
RT_ICON	0x33dd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.4643527204502814
RT_ICON	0x34e80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4504098360655738
RT_ICON	0x35808	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.49556737588652483
RT_ICON	0x35cd8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.2798507462686567
RT_ICON	0x36b80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.365072202166065
RT_ICON	0x37428	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.3784562211981567
RT_ICON	0x37af0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.3764450867052023
RT_ICON	0x38058	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.25653526970954355
RT_ICON	0x3a600	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.274624765478424
RT_ICON	0x3b6a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.28975409836065574
RT_ICON	0x3c030	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.32092198581560283
RT_DIALOG	0x3f9e8	0x84	data			0.7651515151515151
RT_STRING	0x3fa70	0x362	data			0.4653579676674365
RT_STRING	0x3fdd8	0x54a	data			0.44091580502215655
RT_STRING	0x40328	0xa0	data			0.61875
RT_STRING	0x403c8	0x8ca	data			0.41244444444444445
RT_STRING	0x40c98	0x8ec	data			0.4106830122591944
RT_STRING	0x41588	0x8b0	data			0.4123201438848921
RT_STRING	0x41e38	0x4fe	data			0.44209702660406885
RT_STRING	0x42338	0x8e	data			0.6056338028169014
RT_ACCELERATOR	0x3d108	0x28	data			1.025
RT_GROUP_CURSOR	0x3f810	0x22	data			1.088235294117647
RT_GROUP_ICON	0x319f0	0x68	data	Turkish	Turkey	0.7019230769230769
RT_GROUP_ICON	0x3c498	0x76	data	Turkish	Turkey	0.6779661016949152
RT_GROUP_ICON	0x2c260	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x35c70	0x68	data	Turkish	Turkey	0.7211538461538461
RT_VERSION	0x3f838	0x1ac	data			0.5864485981308412

Imports

DLL

Import

KERNEL32.dll

FillConsoleOutputCharacterA, SearchPathW, GetConsoleAliasesLengthW, GetNumaProcessorNode, DebugActiveProcessStop, GetDefaultCommConfigW, CallNamedPipeA, WriteConsoleOutputW, HeapAlloc, InterlockedDecrement, GlobalSize, GetEnvironmentStringsW, CreateDirectoryW, GetComputerNameW, GetSystemDefaultLCID, GetModuleHandleW, GetCommandLineA, GetSystemTimes, GlobalAlloc, LoadLibraryW, GetConsoleAliasExesLengthW, SetConsoleMode, GetFileAttributesW, GetBinaryTypeW, GetStartupInfoW, SetConsoleTitleA, GetShortPathNameA, InterlockedExchange, GetLastError, GetProcAddress, CopyFileA, SetStdHandle, EnterCriticalSection, BuildCommDCBW, GetNumaHighestNodeNumber, OpenWaitableTimerA, LoadLibraryA, UnhandledExceptionFilter, WritePrivateProfileStringA, QueryDosDeviceW, VirtualLock, FoldStringW, GetModuleFileNameA, FreeEnvironmentStringsW, SetCalendarInfoA, FindAtomW, CopyFileExA, SetFilePointer, WriteConsoleW, EncodePointer, DecodePointer, MultiByteToWideChar, ExitProcess, GetCommandLineW, HeapSetInformation, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, WriteFile, GetStdHandle, GetModuleFileNameW, HeapCreate, LeaveCriticalSection, Sleep, HeapSize, GetCPInfo, InterlockedIncrement, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapFree, RtlUnwind, HeapReAlloc, WideCharToMultiByte, LCMapStringW, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, IsProcessorFeaturePresent, ReadFile, CloseHandle, CreateFileW

USER32.dll

GetUserObjectInformationW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 07:31:41.171617985 CEST	49911	25	192.168.2.6	52.101.11.0
Oct 13, 2024 07:31:42.267782927 CEST	49911	25	192.168.2.6	52.101.11.0
Oct 13, 2024 07:31:44.267798901 CEST	49911	25	192.168.2.6	52.101.11.0
Oct 13, 2024 07:31:44.535778046 CEST	49931	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:31:44.535800934 CEST	443	49931	185.228.234.180	192.168.2.6
Oct 13, 2024 07:31:44.535862923 CEST	49931	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:31:48.267802954 CEST	49911	25	192.168.2.6	52.101.11.0
Oct 13, 2024 07:31:56.361764908 CEST	49911	25	192.168.2.6	52.101.11.0
Oct 13, 2024 07:32:01.190821886 CEST	49987	25	192.168.2.6	67.195.228.109
Oct 13, 2024 07:32:02.267898083 CEST	49987	25	192.168.2.6	67.195.228.109
Oct 13, 2024 07:32:04.267837048 CEST	49987	25	192.168.2.6	67.195.228.109
Oct 13, 2024 07:32:08.271430969 CEST	49987	25	192.168.2.6	67.195.228.109
Oct 13, 2024 07:32:16.283514977 CEST	49987	25	192.168.2.6	67.195.228.109
Oct 13, 2024 07:32:21.208293915 CEST	49989	25	192.168.2.6	64.233.166.26
Oct 13, 2024 07:32:22.221020937 CEST	49989	25	192.168.2.6	64.233.166.26
Oct 13, 2024 07:32:24.236604929 CEST	49989	25	192.168.2.6	64.233.166.26
Oct 13, 2024 07:32:24.533627987 CEST	49931	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:32:24.533830881 CEST	443	49931	185.228.234.180	192.168.2.6
Oct 13, 2024 07:32:24.533971071 CEST	49931	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:32:24.644153118 CEST	49991	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:32:24.644200087 CEST	443	49991	185.228.234.180	192.168.2.6
Oct 13, 2024 07:32:24.644314051 CEST	49991	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:32:28.236608028 CEST	49989	25	192.168.2.6	64.233.166.26
Oct 13, 2024 07:32:36.236696959 CEST	49989	25	192.168.2.6	64.233.166.26
Oct 13, 2024 07:32:41.237548113 CEST	49993	25	192.168.2.6	217.69.139.150
Oct 13, 2024 07:32:42.266685963 CEST	49993	25	192.168.2.6	217.69.139.150
Oct 13, 2024 07:32:44.392898083 CEST	49993	25	192.168.2.6	217.69.139.150
Oct 13, 2024 07:32:48.408504009 CEST	49993	25	192.168.2.6	217.69.139.150
Oct 13, 2024 07:32:56.408580065 CEST	49993	25	192.168.2.6	217.69.139.150
Oct 13, 2024 07:33:04.658687115 CEST	49991	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:04.658756971 CEST	443	49991	185.228.234.180	192.168.2.6
Oct 13, 2024 07:33:04.658819914 CEST	49991	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:04.793772936 CEST	49994	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:04.793836117 CEST	443	49994	185.228.234.180	192.168.2.6
Oct 13, 2024 07:33:04.793915987 CEST	49994	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:44.783699989 CEST	49994	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:44.783778906 CEST	443	49994	185.228.234.180	192.168.2.6
Oct 13, 2024 07:33:44.783850908 CEST	49994	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:44.893660069 CEST	49997	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:33:44.893768072 CEST	443	49997	185.228.234.180	192.168.2.6
Oct 13, 2024 07:33:44.893845081 CEST	49997	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:34:09.040118933 CEST	49999	25	192.168.2.6	52.101.40.26
Oct 13, 2024 07:34:10.049206972 CEST	49999	25	192.168.2.6	52.101.40.26
Oct 13, 2024 07:34:12.080558062 CEST	49999	25	192.168.2.6	52.101.40.26
Oct 13, 2024 07:34:16.080488920 CEST	49999	25	192.168.2.6	52.101.40.26
Oct 13, 2024 07:34:24.080688000 CEST	49999	25	192.168.2.6	52.101.40.26
Oct 13, 2024 07:34:24.893203020 CEST	49997	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:34:24.893372059 CEST	443	49997	185.228.234.180	192.168.2.6
Oct 13, 2024 07:34:24.893501043 CEST	49997	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:34:25.004162073 CEST	50000	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:34:25.004242897 CEST	443	50000	185.228.234.180	192.168.2.6
Oct 13, 2024 07:34:25.004414082 CEST	50000	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:34:29.058312893 CEST	50001	25	192.168.2.6	67.195.204.74
Oct 13, 2024 07:34:30.064985991 CEST	50001	25	192.168.2.6	67.195.204.74
Oct 13, 2024 07:34:32.064874887 CEST	50001	25	192.168.2.6	67.195.204.74
Oct 13, 2024 07:34:36.065046072 CEST	50001	25	192.168.2.6	67.195.204.74
Oct 13, 2024 07:34:44.080607891 CEST	50001	25	192.168.2.6	67.195.204.74
Oct 13, 2024 07:34:49.073718071 CEST	50003	25	192.168.2.6	142.251.168.26
Oct 13, 2024 07:34:50.080715895 CEST	50003	25	192.168.2.6	142.251.168.26
Oct 13, 2024 07:34:52.096220016 CEST	50003	25	192.168.2.6	142.251.168.26
Oct 13, 2024 07:34:56.111861944 CEST	50003	25	192.168.2.6	142.251.168.26
Oct 13, 2024 07:35:04.111838102 CEST	50003	25	192.168.2.6	142.251.168.26
Oct 13, 2024 07:35:05.018198013 CEST	50000	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:35:05.018282890 CEST	443	50000	185.228.234.180	192.168.2.6
Oct 13, 2024 07:35:05.018335104 CEST	50000	443	192.168.2.6	185.228.234.180
Oct 13, 2024 07:35:05.235737085 CEST	50004	443	192.168.2.6	80.66.75.11
Oct 13, 2024 07:35:05.235788107 CEST	443	50004	80.66.75.11	192.168.2.6
Oct 13, 2024 07:35:05.235856056 CEST	50004	443	192.168.2.6	80.66.75.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 07:31:41.096226931 CEST	54147	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:31:41.149579048 CEST	53	54147	1.1.1.1	192.168.2.6
Oct 13, 2024 07:31:44.034889936 CEST	63765	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:31:44.512211084 CEST	53	63765	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:01.174846888 CEST	64645	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:01.181720972 CEST	53	64645	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:01.182400942 CEST	60575	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:01.190041065 CEST	53	60575	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:21.190434933 CEST	57882	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:21.198569059 CEST	53	57882	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:21.199302912 CEST	50508	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:21.207596064 CEST	53	50508	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:41.221612930 CEST	58732	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:41.229285955 CEST	53	58732	1.1.1.1	192.168.2.6
Oct 13, 2024 07:32:41.229984045 CEST	55199	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:32:41.237015009 CEST	53	55199	1.1.1.1	192.168.2.6
Oct 13, 2024 07:34:09.032377005 CEST	62026	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:34:09.039556026 CEST	53	62026	1.1.1.1	192.168.2.6
Oct 13, 2024 07:34:29.050172091 CEST	60948	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:34:29.057626009 CEST	53	60948	1.1.1.1	192.168.2.6
Oct 13, 2024 07:34:49.065900087 CEST	61419	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:34:49.073086977 CEST	53	61419	1.1.1.1	192.168.2.6
Oct 13, 2024 07:35:05.128333092 CEST	53367	53	192.168.2.6	1.1.1.1
Oct 13, 2024 07:35:05.235069990 CEST	53	53367	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 07:31:41.096226931 CEST	192.168.2.6	1.1.1.1	0x1b4b	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:31:44.034889936 CEST	192.168.2.6	1.1.1.1	0x42c3	Standard query (0)	vanaheim.cn	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.174846888 CEST	192.168.2.6	1.1.1.1	0x13d0	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:01.182400942 CEST	192.168.2.6	1.1.1.1	0xee2c	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.190434933 CEST	192.168.2.6	1.1.1.1	0x55c6	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:21.199302912 CEST	192.168.2.6	1.1.1.1	0xbb0d	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:41.221612930 CEST	192.168.2.6	1.1.1.1	0xb646	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:41.229984045 CEST	192.168.2.6	1.1.1.1	0x5f19	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:09.032377005 CEST	192.168.2.6	1.1.1.1	0xf002	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.050172091 CEST	192.168.2.6	1.1.1.1	0xc44b	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.065900087 CEST	192.168.2.6	1.1.1.1	0x6634	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:35:05.128333092 CEST	192.168.2.6	1.1.1.1	0x796d	Standard query (0)	jotunheim.name	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 07:31:41.149579048 CEST	1.1.1.1	192.168.2.6	0x1b4b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:31:41.149579048 CEST	1.1.1.1	192.168.2.6	0x1b4b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:31:41.149579048 CEST	1.1.1.1	192.168.2.6	0x1b4b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:31:41.149579048 CEST	1.1.1.1	192.168.2.6	0x1b4b	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:31:44.512211084 CEST	1.1.1.1	192.168.2.6	0x42c3	No error (0)	vanaheim.cn	185.228.234.180	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.181720972 CEST	1.1.1.1	192.168.2.6	0x13d0	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:01.181720972 CEST	1.1.1.1	192.168.2.6	0x13d0	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:01.181720972 CEST	1.1.1.1	192.168.2.6	0x13d0	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.204.72	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:01.190041065 CEST	1.1.1.1	192.168.2.6	0xee2c	No error (0)	mta5.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.198569059 CEST	1.1.1.1	192.168.2.6	0x55c6	No error (0)	google.com		MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:21.207596064 CEST	1.1.1.1	192.168.2.6	0xbb0d	No error (0)	smtp.google.com	64.233.166.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.207596064 CEST	1.1.1.1	192.168.2.6	0xbb0d	No error (0)	smtp.google.com	74.125.206.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.207596064 CEST	1.1.1.1	192.168.2.6	0xbb0d	No error (0)	smtp.google.com	64.233.167.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.207596064 CEST	1.1.1.1	192.168.2.6	0xbb0d	No error (0)	smtp.google.com	64.233.167.27	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:21.207596064 CEST	1.1.1.1	192.168.2.6	0xbb0d	No error (0)	smtp.google.com	74.125.206.27	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:41.229285955 CEST	1.1.1.1	192.168.2.6	0xb646	No error (0)	mail.ru		MX (Mail exchange)	IN (0x0001)	false
Oct 13, 2024 07:32:41.237015009 CEST	1.1.1.1	192.168.2.6	0x5f19	No error (0)	mxs.mail.ru	217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:32:41.237015009 CEST	1.1.1.1	192.168.2.6	0x5f19	No error (0)	mxs.mail.ru	94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:09.039556026 CEST	1.1.1.1	192.168.2.6	0xf002	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.40.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:09.039556026 CEST	1.1.1.1	192.168.2.6	0xf002	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.42.0	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:09.039556026 CEST	1.1.1.1	192.168.2.6	0xf002	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.11.0	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:09.039556026 CEST	1.1.1.1	192.168.2.6	0xf002	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.8.49	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:29.057626009 CEST	1.1.1.1	192.168.2.6	0xc44b	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.073086977 CEST	1.1.1.1	192.168.2.6	0x6634	No error (0)	smtp.google.com	142.251.168.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.073086977 CEST	1.1.1.1	192.168.2.6	0x6634	No error (0)	smtp.google.com	142.251.168.27	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.073086977 CEST	1.1.1.1	192.168.2.6	0x6634	No error (0)	smtp.google.com	142.251.173.27	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.073086977 CEST	1.1.1.1	192.168.2.6	0x6634	No error (0)	smtp.google.com	64.233.184.26	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:34:49.073086977 CEST	1.1.1.1	192.168.2.6	0x6634	No error (0)	smtp.google.com	64.233.184.27	A (IP address)	IN (0x0001)	false
Oct 13, 2024 07:35:05.235069990 CEST	1.1.1.1	192.168.2.6	0x796d	No error (0)	jotunheim.name	80.66.75.11	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	01:31:01
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\uMlLpvdLRU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uMlLpvdLRU.exe"
Imagebase:	0x400000
File size:	243'712 bytes
MD5 hash:	7EA98BD7F6A69B385310F5EAA86B6828
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000000.00000003.2212033064.00000000020A0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:31:07
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yuzqifwu\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:31:07
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:31:07
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\bndqedvz.exe" C:\Windows\SysWOW64\yuzqifwu\
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:31:07
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:31:08
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" create yuzqifwu binPath= "C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d\"C:\Users\user\Desktop\uMlLpvdLRU.exe\"" type= own start= auto DisplayName= "wifi support"
Imagebase:	0x8a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:31:08
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:31:09
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" description yuzqifwu "wifi internet conection"
Imagebase:	0x8a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:31:09
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:31:09
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start yuzqifwu
Imagebase:	0x8a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:31:09
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:31:09
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe /d"C:\Users\user\Desktop\uMlLpvdLRU.exe"
Imagebase:	0x400000
File size:	10'786'816 bytes
MD5 hash:	491E03099055090A2BCF55796B5D0830
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000003.2433806648.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 0000000C.00000002.2738933008.0000000000D60000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:31:10
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:31:10
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:31:29
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x650000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Tofsee_26124fe4, Description: unknown, Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_Tofsee, Description: Detects Tofsee, Source: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	01:31:46
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	01:33:10
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	26.2%
Total number of Nodes:	1608
Total number of Limit Nodes:	21

Executed Functions

Function 00409A6B Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
\, xrefs: 00409D0C
D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A078
", xrefs: 0040A189
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 603121095b7679364f468b5179938349acae34033f0d3c12a89c9af7faf008a0
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0041A380 Relevance: 56.3, APIs: 30, Strings: 2, Instructions: 293
timelibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedDecrement.KERNEL32(?), ref: 0041A43D
SetConsoleTitleA.KERNEL32(00000000), ref: 0041A445
GlobalSize.KERNEL32(00000000), ref: 0041A44D
FindAtomW.KERNEL32(00000000), ref: 0041A455
SearchPathW.KERNEL32(0041CA08,0041C9CC,0041C98C,00000000,?,?), ref: 0041A479
SetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A483
GetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A4AB
CopyFileExA.KERNEL32(0041CA54,0041CA48,00000000,00000000,00000000,00000000), ref: 0041A4C3
GetEnvironmentStringsW.KERNEL32 ref: 0041A4C9
WriteConsoleOutputW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0041A4E8
GetNumaHighestNodeNumber.KERNEL32(?), ref: 0041A4F3
DebugActiveProcessStop.KERNEL32(00000000), ref: 0041A4FB
GetSystemDefaultLCID.KERNEL32 ref: 0041A515
RtlEnterCriticalSection.NTDLL(?), ref: 0041A529
LoadLibraryW.KERNEL32(00000000), ref: 0041A542
GetUserObjectInformationW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041A58C
GetSystemTimes.KERNELBASE(?,?,?), ref: 0041A5A1
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A5C9
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A5EC
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A5F9
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041A601
CopyFileA.KERNEL32(0041CAD8,0041CAB0,00000000), ref: 0041A612
GetFileAttributesW.KERNEL32(00000000), ref: 0041A619
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A61F
OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 0041A628
GetBinaryTypeW.KERNEL32(00000000,00000000), ref: 0041A630
GlobalAlloc.KERNELBASE(00000000,004220DC), ref: 0041A66F

Strings

k`, xrefs: 0041A6FD
}$, xrefs: 0041A721

Memory Dump Source

Source File: 00000000.00000002.4594975942.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_uMlLpvdLRU.jbxd

Similarity

API ID: Console$File$CopyDefaultGlobalLengthSystem$ActiveAliasAliasesAllocAtomAttributesBinaryCallCommComputerConfigCriticalDebugDecrementEnterEnvironmentExesFindFoldHighestInformationInterlockedLibraryLoadModeNameNamedNodeNumaNumberObjectOpenOutputPathPipeProcessSearchSectionSizeStopStringStringsTimerTimesTitleTypeUserWaitableWrite
String ID: k`$}$
API String ID: 1387190455-956986773
Opcode ID: 0cdf8472348f809f2fd8f217c0fd777b165f73a7af62ccbf81e5d6157e6b6df5
Instruction ID: 37379827b28c5908f82b0116f8609ffbc644b13a744a3271631f23acd6dce4b9
Opcode Fuzzy Hash: 0cdf8472348f809f2fd8f217c0fd777b165f73a7af62ccbf81e5d6157e6b6df5
Instruction Fuzzy Hash: E4A12471A45310AFD320AB61EC49BDF7B68EB4C705F00803AF659961A0C7785985CBEE

Function 00409326 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040405E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: 7de862f9e9b35a1df311cf9a4407cf261d5ef3a80a072fcdc92d6b04e029e81b
Instruction ID: a90c6c4c2b7f8b8208d93dc1fe438bcf4b3bc6ab1fe170e3c7599fd426c471ab
Opcode Fuzzy Hash: 7de862f9e9b35a1df311cf9a4407cf261d5ef3a80a072fcdc92d6b04e029e81b
Instruction Fuzzy Hash: 3851A3B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 00406A60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID: PromptOnSecureDesktop
API String ID: 3188212458-2980165447
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 005BA736 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005BA75E
Module32First.KERNEL32(00000000,00000224), ref: 005BA77E

Memory Dump Source

Source File: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, Offset: 005B9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b9000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0adb77cdc99369f9463b5b6ba448cdc19a057c1994a37b68d8b6ed23f73855f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0FF09631100711AFD7203BF9988DBAE7AF8FF49725F104529E642910C0DF74FC454662

Function 0040EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Function 004073FF Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040704C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 0208003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0208024D

Strings

cess, xrefs: 0208018D
kernel32.dll, xrefs: 0208008F, 02080095

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 094ada9956a38843da231dd86c67634bf040858582ffe9a2bc1163de5be843d6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7D527A75A01229DFDBA4CF58C984BADBBB1BF09304F1480D9E54DAB351DB30AA89DF14

Function 0041A696 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(0041CB10), ref: 0041A6C1
GlobalSize.KERNEL32(00000000), ref: 0041A6EB
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A71A

Strings

k`, xrefs: 0041A6FD
}$, xrefs: 0041A721

Memory Dump Source

Source File: 00000000.00000002.4594975942.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_uMlLpvdLRU.jbxd

Similarity

API ID: ExchangeGlobalInterlockedLibraryLoadSize
String ID: k`$}$
API String ID: 1230614907-956986773
Opcode ID: ad299a3146fbd31aa4e72491768b5ec2b553fdd1698bae50372d489600919617
Instruction ID: 3691dabe03090a73b08bcf6b98ad8fa90aa58e4902adf23636a8ed1bf61f499c
Opcode Fuzzy Hash: ad299a3146fbd31aa4e72491768b5ec2b553fdd1698bae50372d489600919617
Instruction Fuzzy Hash: 5C1108307462408AC734AB20DC467DFB761EB48315F15443FE6AA962A1CB7894A1C7DF

Function 004099D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction ID: c4e01e0c9c22f42140b45f86cbdbc152d24ce0e59ed2090f1037bb69612005af
Opcode Fuzzy Hash: e18185d0f37ace2058eb608823ad36cbc71581f24a02a40a50f5e6d881590964
Instruction Fuzzy Hash: 0501A27294020877EA103F62EC47F9F3F1DEB44728F00483AF619790D2D9BA95709AAC

Function 0041A0A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00421FB0), ref: 0041A13E
GetProcAddress.KERNEL32(00000000,00420720), ref: 0041A171
VirtualProtect.KERNELBASE(00421DFC,004220DC,00000040,?), ref: 0041A190

Strings

, xrefs: 0041A0D6

Memory Dump Source

Source File: 00000000.00000002.4594975942.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_uMlLpvdLRU.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 66c140271c644cc1f2ccc4ee16bc6603007ca1d7cd4741005967d982a08338d1
Instruction ID: df23f584a4b94a56a47cf0700e1bb303751c1b2e60a1d636fe9a2e96d66d9807
Opcode Fuzzy Hash: 66c140271c644cc1f2ccc4ee16bc6603007ca1d7cd4741005967d982a08338d1
Instruction Fuzzy Hash: 52112964718240DED720CF64FE05B067AF1FBAC784F815238D1548B2B2DBB526468B6D

Function 00404000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 004091EB Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction ID: 2238cefa34e52eac0eed51a1b9fc18e9663c37cde2c16e9a3df151323357230f
Opcode Fuzzy Hash: 3372c8ca0f183eb5491d8b73672d2af1eba7a86cb059b25099cdfc4087d6fc87
Instruction Fuzzy Hash: E941EE718083497EEB269664988C7E73BA49B52300F2809FFD492B72D3D7BC4D818759

Function 02080E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02080223,?,?), ref: 02080E19
SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E1E

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0594162c44c975425590a9f4248303b472abad866a18c321087184769bf3c7dc
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 20D0123214522877D7413A94DC09BCE7B5CDF05B66F008011FB0DD9080C770954046E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 005BA3F5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005BA446

Memory Dump Source

Source File: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, Offset: 005B9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b9000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 41ca8431402b37fb4b33560d8e28f6fd7751c16f61ee0f9e86efbfcf5c9f8d01
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C7112A79A00208EFDB01DF98C989E98BFF5AB08350F058094F9489B362D771EA50DF81

Non-executed Functions

Function 0040C913 Relevance: 113.4, APIs: 45, Strings: 19, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0040CA4E
closesocket.WS2_32(?), ref: 0040CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0040CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040CCB4
WriteFile.KERNEL32(0040A4B3,?,-000000E8,?,00000000), ref: 0040CCDC
CloseHandle.KERNEL32(0040A4B3), ref: 0040CCED
wsprintfA.USER32 ref: 0040CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0040CD89
CloseHandle.KERNEL32(?), ref: 0040CD98
CloseHandle.KERNEL32(?), ref: 0040CD9D
DeleteFileA.KERNEL32(?), ref: 0040CDC4
CloseHandle.KERNEL32(0040A4B3), ref: 0040CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040D033
lstrcatA.KERNEL32(?,?), ref: 0040D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040D171
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040D195
CloseHandle.KERNEL32(00000000), ref: 0040D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0040D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D231
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0040D372
lstrcatA.KERNEL32(?,?,?,?,?,?,?,?,?,00000100), ref: 0040D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0040D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D408
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0040D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0040D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0040D45B
CreateProcessA.KERNEL32(?,00410264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0040D513
closesocket.WS2_32(?), ref: 0040D56C
Sleep.KERNEL32(000003E8), ref: 0040D577
ExitProcess.KERNEL32 ref: 0040D583
wsprintfA.USER32 ref: 0040D81F

Part of subcall function 0040C65C: send.WS2_32(00000000,?,00000000), ref: 0040C74B

closesocket.WS2_32(?), ref: 0040DAD5

Strings

local_time, xrefs: 0040CACD
localcfg, xrefs: 0040CA89, 0040CA93, 0040CAC0, 0040CAD2, 0040CE4F, 0040CE6F, 0040D8D3, 0040D8FC
\, xrefs: 0040D39D
wtm_w, xrefs: 0040C96C
srv_time, xrefs: 0040CABB
4, xrefs: 0040D9F7
time_cfg, xrefs: 0040C95B, 0040C962, 0040C971, 0040C984
wtm_c, xrefs: 0040C956
.dat, xrefs: 0040D0D7, 0040D138, 0040D1AE, 0040D1D4, 0040D28E, 0040D308, 0040D3CF, 0040D441
\, xrefs: 0040D3A7
drivers\, xrefs: 0040D067
PromptOnSecureDesktop, xrefs: 0040CC79, 0040CC7E, 0040CC99, 0040CD10, 0040CD29, 0040CFA2, 0040CFA7, 0040CFBD, 0040D0EF, 0040D223, 0040D239, 0040D364, 0040D37A, 0040D80B
work_srv, xrefs: 0040D607, 0040D60F, 0040D62C
@, xrefs: 0040D754
lid_file_upd, xrefs: 0040CE6A
.sys, xrefs: 0040D0CC
except_info, xrefs: 0040D8CD, 0040D8D2, 0040D8FB
flags_upd, xrefs: 0040CE4A
wtm_r, xrefs: 0040C97F

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$PromptOnSecureDesktop$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-3791576231
Opcode ID: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction ID: 1bec03d5b3261cfbda03ea9d0ba23ae7472bbf6119f1c93de8fbd0284471d070
Opcode Fuzzy Hash: 9e4fe3788f012a04d44cc6c5e4c1fd3e816f3d6647e3ed2456f4b6deaabaf357
Instruction Fuzzy Hash: 1BB2B471D00209BBEB209FA4DD85FEA7BB9EB08304F14457BF505B22D1D7789A898B5C

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
NtSetInformationToken, xrefs: 00401175
RtlNtStatusToDosError, xrefs: 00401194
NtQueryInformationToken, xrefs: 00401262
NtFilterToken, xrefs: 0040122B
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtClose, xrefs: 004011B4
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtOpenProcessToken, xrefs: 004011D4
RtlFreeSid, xrefs: 00401116
NtTerminateProcess, xrefs: 004010F6

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Mar, xrefs: 0040B264
Dec, xrefs: 0040B2A3
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
May, xrefs: 0040B272
Thu, xrefs: 0040B241
Sun, xrefs: 0040B225
Nov, xrefs: 0040B29C
Jan, xrefs: 0040B256
Mon, xrefs: 0040B22C
Jul, xrefs: 0040B280
Apr, xrefs: 0040B26B
Tue, xrefs: 0040B233
Fri, xrefs: 0040B248
Sat, xrefs: 0040B24F
Oct, xrefs: 0040B295
Wed, xrefs: 0040B23A
Sep, xrefs: 0040B28E
Aug, xrefs: 0040B287
Feb, xrefs: 0040B25D

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
<, xrefs: 00401378
@, xrefs: 00401380
uac, xrefs: 00401628
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
work_srv, xrefs: 00401E5E
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
lid_file_upd, xrefs: 00401E25
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 020865E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 020865F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02086610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 02086631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 02086652

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 8f2f23149897569958edf0afc58b27ad45b992c6b2ff9c1b4757461061f986fd
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 38119171600358BFDB21AF65DC0AF9B3FACEB057A5F014024FA09E7250DBB2DD109AA4

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 00408E26 Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Function 0208092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 020809DC, 020809DF, 020809E4
l, xrefs: 02080966
., xrefs: 0208095F

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 761247b40084aa777b878560d26c120f0ea522af0afc58718300f8bafaa69f72
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F5313BB6910709DFDB11DF99C880AAEBBF6FF48324F15405AD881A7310D771EA49CBA4

Function 004088B0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Function 005BA013 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4595280010.00000000005B9000.00000040.00000020.00020000.00000000.sdmp, Offset: 005B9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b9000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c1a9553dca1298fd443102da148385c740c5326787231f819f24dbc6eebee13c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B8115A72340204AFD754EE69DC85EA677EAFB89320B298065E904CB312E67AE841C760

Function 02080D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 62ef794621d5ea3b2d77e87dd9d73198f7d5adc64546af18e458383c1f14b76b
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: C701F272A107008FDF22EF20C805BAB33E6FB86316F0540A4D94A97281E770A8498B80

Function 02089EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 02089E6D
lstrcpy.KERNEL32(?,00000000), ref: 02089FE1
lstrcat.KERNEL32(?,?), ref: 02089FF2
lstrcat.KERNEL32(?,0041070C), ref: 0208A004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0208A054
DeleteFileA.KERNEL32(?), ref: 0208A09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0208A0D6
lstrcpy.KERNEL32 ref: 0208A12F
lstrlen.KERNEL32(00000022), ref: 0208A13C
GetTempPathA.KERNEL32(000001F4,?), ref: 02089F13

Part of subcall function 02087029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 02087081

Part of subcall function 02086F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eafwolca,02087043), ref: 02086F4E
Part of subcall function 02086F30: GetProcAddress.KERNEL32(00000000), ref: 02086F55
Part of subcall function 02086F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02086F7B
Part of subcall function 02086F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02086F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0208A1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0208A1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0208A214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0208A21B
GetDriveTypeA.KERNEL32(?), ref: 0208A265
lstrcat.KERNEL32(?,00000000), ref: 0208A29F
lstrcat.KERNEL32(?,00410A34), ref: 0208A2C5
lstrcat.KERNEL32(?,00000022), ref: 0208A2D9
lstrcat.KERNEL32(?,00410A34), ref: 0208A2F4
wsprintfA.USER32 ref: 0208A31D
lstrcat.KERNEL32(?,00000000), ref: 0208A345
lstrcat.KERNEL32(?,?), ref: 0208A364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0208A387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0208A398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0208A1D1

Part of subcall function 02089966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0208999D
Part of subcall function 02089966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 020899BD
Part of subcall function 02089966: RegCloseKey.ADVAPI32(?), ref: 020899C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0208A3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0208A3E2
GetDriveTypeA.KERNEL32(00000022), ref: 0208A41D

Strings

\, xrefs: 02089F73
", xrefs: 0208A2DF
P, xrefs: 0208A011
", xrefs: 0208A142
D, xrefs: 0208A1F5
", xrefs: 0208A3F0

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: e50d70cb48baee6486e2e3203cd51a62262520df80a5830ac0e732d3276c1df1
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: F4F140B1D4035DAFDF22EBA08C88FEF7BBCAB08304F0444A6E645E2141E77596859F65

Function 02087CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 02087D21
GetUserNameA.ADVAPI32(?,?), ref: 02087D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02087D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 02087DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02087DC0
EqualSid.ADVAPI32(?,?), ref: 02087DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 02087DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02087DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02087E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 02087E12
LocalFree.KERNEL32(00000000), ref: 02087E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02087E35

Strings

PromptOnSecureDesktop, xrefs: 02087FA0
D, xrefs: 02087D73

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: c91c96f5e7614949d112064d2daf416f60de55ce0c3a00dbf0d7bca7b5f16cf0
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 95A18B7690021DAFDB12DFA1DC88FEFBBB8FB08304F148169E541E6160D7758A84DB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

plgs:, xrefs: 004066AA
localcfg, xrefs: 0040672D
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

mail from:<%s>, xrefs: 0040A848
localcfg, xrefs: 0040AB0B
ehlo %s, xrefs: 0040A7F5
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
helo %s, xrefs: 0040A803
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
ESMTP, xrefs: 0040AA38
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
data, xrefs: 0040A85E

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 02087A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 02087A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02087ACD
GetLengthSid.ADVAPI32(?), ref: 02087ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 02087B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 02087B1F
EqualSid.ADVAPI32(?,?), ref: 02087B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 02087B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02087B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 02087B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 02087B77
LocalFree.KERNEL32(00000000), ref: 02087B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 02087B9A
GetAce.ADVAPI32(?,?,?), ref: 02087BCA
EqualSid.ADVAPI32(?,?), ref: 02087BF1
DeleteAce.ADVAPI32(?,?), ref: 02087C0A
EqualSid.ADVAPI32(?,?), ref: 02087C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 02087CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 02087CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 02087CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 02087CE0
LocalFree.KERNEL32(00000000), ref: 02087CEE

Strings

D, xrefs: 02087AC3

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 991c8fe0ae6e99c1eaf19421a5fa049f30636ebbda74af3405e4848decb59f10
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B0816C75900209AFDB12DFA4DD84FEFBBB8BF08304F14806AE645E7160DB759641DB64

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 0208858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 0208865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 0208867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 020886A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 020886B1

Strings

PromptOnSecureDesktop, xrefs: 020885B6, 02088645, 020886BD, 02088708, 020887C5, 02088812, 020888E9, 02088905
", xrefs: 0208896C

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: bc47f7fb476407937a73f3e942d2dbb13ee43b126af854ff649f120592a1976a
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: A6C1A37190034DBEEB52BBA4DD84EEF7BBDEB04300F548065F685E2050E7B04A94AF65

Function 020814E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 02081601
lstrlenW.KERNEL32(-00000003), ref: 020817D8

Strings

<, xrefs: 020815DF
@, xrefs: 020815E7
, xrefs: 020816C9
D, xrefs: 0208182D

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 0f6bd7a36943a8d09cdd4f973a34866938da563235029bb0c1e0df911e7ca785
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 35F168B15083419FD721EF64C888BABBBE5FF88304F00892DF6DA97290D7B49945CB56

Function 02087666 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020876D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 02087757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 0208778F
___ascii_stricmp.LIBCMT ref: 020878B4
RegCloseKey.ADVAPI32(?), ref: 0208794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0208796D
RegCloseKey.ADVAPI32(?), ref: 0208797E
RegCloseKey.ADVAPI32(?), ref: 020879AC
RegCloseKey.ADVAPI32(?), ref: 02087A56

Part of subcall function 0208F40C: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,0208772A,?), ref: 0208F414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 020879F6
RegCloseKey.ADVAPI32(?), ref: 02087A4D

Strings

PromptOnSecureDesktop, xrefs: 020876C5, 020876CA, 020876E5, 02087782, 020877E6, 02087862, 0208787B, 020879C2
", xrefs: 02087800

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: b3e6dedc1450e185f6d10526c236965bbc9473b30d983d21b0d16372f6b917c8
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: D3C1B675900319AFDB12ABA4DC44FEFBBB9EF49310F2400A5E584E6164EB71DA80DF60

Function 02082CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02082CED
socket.WS2_32(00000002,00000002,00000011), ref: 02082D07
htons.WS2_32(00000000), ref: 02082D42
select.WS2_32 ref: 02082D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 02082DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02082E62

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: e6a871217094e9b3b903aa19e4cc1c22140071cf43365d648cdeb6415f53aa08
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 0161D072504385AFC321BF64DC08BABBBE8EB48745F004819FDC497251D7B5D880EBAA

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_HST, xrefs: 0040AEC5
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0208958D Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 020895A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020895D5
GetModuleFileNameA.KERNEL32(00000000), ref: 020895DC
wsprintfA.USER32 ref: 02089635
wsprintfA.USER32 ref: 02089673
wsprintfA.USER32 ref: 020896F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 02089758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 0208978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 020897D8

Strings

PromptOnSecureDesktop, xrefs: 02089604, 02089624, 02089662, 02089683, 020896B6, 020896DF, 02089701, 02089734, 02089780, 020897B7

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: c58be2975ff8c26e661c0a9a8f1dca7667c0a6d6902cc6766e0e1fa697224ab6
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 2BA159B190034CAFEB21EFA1CC45FEF3BADAB04741F104026FA55A6251E7B595849FA4

Function 0040BE31 Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
smtp_ban, xrefs: 0040BE55, 0040BF77
86A, xrefs: 0040BF98

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_USER, xrefs: 0040B431
%TO_HASH, xrefs: 0040B4B0
%TO_EMAIL, xrefs: 0040B473
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9
%DATE, xrefs: 0040B4D2
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%s@%s, xrefs: 0040B461
%TO_USER, xrefs: 0040B488

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 02081FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0208202D
GetSystemInfo.KERNEL32(?), ref: 0208204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 0208206A
GetProcAddress.KERNEL32(00000000), ref: 02082071
GetCurrentProcess.KERNEL32(?), ref: 02082082
GetTickCount.KERNEL32 ref: 02082230

Part of subcall function 02081E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 02081E7C

Strings

localcfg, xrefs: 02082091, 02082098, 020820AB, 020820E4, 020820F3, 02082119, 02082138, 0208214E, 02082166, 02082183, 0208219B, 020821B7, 020821D7
work_srv, xrefs: 020820C5
hi_id, xrefs: 0208217D, 02082182, 0208219A
flags_upd, xrefs: 020820A5, 020820AA, 020820E3

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 2364e96a5c8d2ab1394b859847e1d09051a5a8d5f15e41134ac96f0206ec9e24
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: 6B51A3B0900344AFE370BF758C85FA7BAECEB55704F00492DFAD682142D7B9A584DB65

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 02083059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 02083068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02083078
GetProcAddress.KERNEL32(00000000,00410408), ref: 02083095
RtlAllocateHeap.NTDLL(00000000), ref: 020830B6
htons.WS2_32(00000035), ref: 020830EF
inet_addr.WS2_32(?), ref: 020830FA
gethostbyname.WS2_32(?), ref: 0208310D
HeapFree.KERNEL32(00000000), ref: 0208314D

Strings

iphlpapi.dll, xrefs: 02083062, 02083067, 02083077

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: eeffcc8ca208f68e89b0066492fda497da2aee10249669ccbcdfbe4c173ffa14
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 7C31D331A00306ABDF52ABB8DC48BBF77F8AF84F24F1441A5E558E3290DB74D5819B58

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 00406CC9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 0040977C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 02086778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 020867C3
htonl.WS2_32(?), ref: 020867DF
htonl.WS2_32(?), ref: 020867EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 020868F1
ExitProcess.KERNEL32 ref: 020869BC

Strings

localcfg, xrefs: 02086994
except_info, xrefs: 0208698F

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: fb5f790557eebdf9d0531b3a12fd1690d7a86f647aff611c5379811f0633af7e
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: 39615E71A40308AFDB60AFB4DC45FEA77E9FB08300F148066FAADD2161EB7599909F54

Function 0208F57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0208CC84), ref: 0208F5B4
socket.WS2_32(00000002,00000001,00000000), ref: 0208F5CE
closesocket.WS2_32(00000000), ref: 0208F5DC

Strings

time_cfg, xrefs: 0208F58A

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: f2fa2add3c1d964694db8bd94245ff0733faee41245f38ef13adea976e3f5593
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: EC315A72900219ABDB11AFB5DC889EF7BBCEB88350F104566FA45E3150E7708A919BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 02082F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 02082FA1
LoadLibraryA.KERNEL32(?), ref: 02082FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 02082FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 02083000
RtlAllocateHeap.NTDLL(00000000), ref: 02083007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 02083032

Strings

dnsapi.dll, xrefs: 02082F90

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: f3fc77bd00f95d34168370d4fc717fbddc257c3a9fb1d10f28fa8cc22fd05e79
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 0B219271D00729BBCB22AB94DC48AEFBBB8EF48B14F004461F941E7141D7B49A81DBD4

Function 02086F30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eafwolca,02087043), ref: 02086F4E
GetProcAddress.KERNEL32(00000000), ref: 02086F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 02086F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 02086F92

Strings

PromptOnSecureDesktop, xrefs: 02086F9D, 02086FBF, 02086FCF, 02086FE5, 02086FF5
C:\Windows\SysWOW64\, xrefs: 02086F30, 02086F38, 02086F65, 02086F6C, 02086F7A, 02086F85, 02086F91, 02086FA9, 02086FC6, 02086FEC
\\.\pipe\eafwolca, xrefs: 02086F37

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\eafwolca
API String ID: 1082366364-3864767741
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: c0bd8873821a63704d3387d6d9b9e99f63c7b9e3e795c2ef59342c5f425780fa
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 902104617403407DF76373319C8CFFB2E8C8B52724F2840A5F984D6591DBD984D6966D

Function 00406BA7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 020892CB Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 020892E2
wsprintfA.USER32 ref: 02089350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02089375
lstrlen.KERNEL32(?,?,00000000), ref: 02089389
WriteFile.KERNEL32(00000000,?,00000000), ref: 02089394
CloseHandle.KERNEL32(00000000), ref: 0208939B

Strings

PromptOnSecureDesktop, xrefs: 0208932B, 02089343, 0208935E

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 8cbabf148e6aa2465cd4a58c27dc0634c28c63623dd077f2c4927a69c44838fb
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: DB1172B27406247BE7207732EC0DFEF3A6EDBC8B11F008065BB49A5191EBB44A459B64

Function 00409064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 020899E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02089A18
GetThreadContext.KERNEL32(?,?), ref: 02089A52
TerminateProcess.KERNEL32(?,00000000), ref: 02089A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02089A98
SetThreadContext.KERNEL32(?,00010002), ref: 02089AB5
ResumeThread.KERNEL32(?), ref: 02089AC2

Strings

D, xrefs: 02089A10

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 17c4471a119d96f0040c32f6f5c15383d851344a2d2f07ced2f440c76a4e044b
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: EE216BB1A01219BBDB12ABA1DC08EEF7BBCEF04750F404061FA19E1150E7718A40DBA4

Function 02081C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 02081C18
LoadLibraryA.KERNEL32(004102C8), ref: 02081C26
GetProcessHeap.KERNEL32 ref: 02081C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 02081C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 02081CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 02081D02
FreeLibrary.KERNEL32(?), ref: 02081D0B

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 49cc952ca1260fe180e50dfde48c7bbb928e0981796092fa327e2b617c756526
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 15315E32D00309BFCB52AFA4DC889AFFBF9EF45305B24447AE549A2110D7B54E81EB94

Function 0040E3CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 00404280 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 02086CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02086CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02086D22
GetLastError.KERNEL32 ref: 02086DA7
CloseHandle.KERNEL32(?), ref: 02086DB5
GetLastError.KERNEL32 ref: 02086DD6
DeleteFileA.KERNEL32(?), ref: 02086DE7
GetLastError.KERNEL32 ref: 02086DFD

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ebd2f88b88f38dec5427a190003c64ab1c93759932554d61670a1a23ff671fa5
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 7431EE72D00349BFCB01AFA4DD48ADF7FBDEB48310F158475E291A3211E7728A85AB61

Function 0041A230 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041A25D
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A275
UnhandledExceptionFilter.KERNEL32(00000000), ref: 0041A27D
SetCalendarInfoA.KERNEL32(00000000,00000000,00000000,0041C980), ref: 0041A2C4
GetShortPathNameA.KERNEL32(00000000,?,00000000), ref: 0041A2D5

Strings

-, xrefs: 0041A2E2

Memory Dump Source

Source File: 00000000.00000002.4594975942.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_uMlLpvdLRU.jbxd

Similarity

API ID: BuildCalendarCommExceptionFilterInfoNamePathPrivateProfileShortStringUnhandledWrite
String ID: -
API String ID: 1417380309-2547889144
Opcode ID: 2c70b2e27553c37d51635817894fb92d35fd66a59e975567011c2500a9255d00
Instruction ID: a6596ea4d5d39f75678243f646b5f7fb3d1533af8648bb96340218ed538d7df8
Opcode Fuzzy Hash: 2c70b2e27553c37d51635817894fb92d35fd66a59e975567011c2500a9255d00
Instruction Fuzzy Hash: BA212970745304ABD760DF64EC85BDE7BA4EB0C711F5000E9F709AA2C1CA7519C18B5E

Function 020893AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 020893C6
GetModuleFileNameA.KERNEL32(00000000), ref: 020893CD
CharToOemA.USER32(?,?), ref: 020893DB
wsprintfA.USER32 ref: 02089410

Part of subcall function 020892CB: GetTempPathA.KERNEL32(00000400,?), ref: 020892E2
Part of subcall function 020892CB: wsprintfA.USER32 ref: 02089350
Part of subcall function 020892CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 02089375
Part of subcall function 020892CB: lstrlen.KERNEL32(?,?,00000000), ref: 02089389
Part of subcall function 020892CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 02089394
Part of subcall function 020892CB: CloseHandle.KERNEL32(00000000), ref: 0208939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 02089448

Strings

PromptOnSecureDesktop, xrefs: 020893FA, 020893FF, 0208941C

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 2e060224dcb71bbabad60b893cf483993aae151987f228b44cee016a6e6d59ab
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 8E015EF69002587BDB21A7619D8DEEF3B7CDB95701F0040A2BB49E2080EAB497C58F75

Function 00409145 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 0208AA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0208AAE5

Strings

localcfg, xrefs: 0208AD72
, xrefs: 0208ABB3

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 580edfd530c70db6533a615802e04309f00183adbe2bc6f23c84ccf8a4ece042
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: C8715B71B00304AADF72BB54DC85FEF3BA99B00718F244027FA85E6890EF7695C4AB55

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 0208E8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0208DF6C: GetCurrentThreadId.KERNEL32 ref: 0208DFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 0208E8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,02086128), ref: 0208E950
lstrcmp.KERNEL32(?,00000008), ref: 0208E989

Strings

A, xrefs: 0208E960, 0208E965
A, xrefs: 0208E9A0
A, xrefs: 0208E8C6, 0208E8CD, 0208E936, 0208E998

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 0e130995b376facff2f863763d52b2beeb73cc9b622ce95781bb4352be93b439
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: EA319E31A00715EBDBB2AF24C884BAB7BE4EB05724F00892AF5D587551D7B0E880EB81

Function 02086E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 02086E19

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: f6772974e50ec96c48ce860673332e4777531919152353c2b25b63134c9cb243
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 7C214D73104219BFDB11BB64FC49EDF3FAEDB49264B118425F542D1091EB71DA40A674

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 0208C543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0208C6B4
InterlockedIncrement.KERNEL32(0208C74B), ref: 0208C715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0208C747), ref: 0208C728
CloseHandle.KERNEL32(00000000,?,0208C747,00413588,02088A77), ref: 0208C733

Strings

localcfg, xrefs: 0208C544

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: ad7802854727092c5cb676bd010c12dd24aeb8aea43383852e170b006bc2d0f2
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 3E515DB1A00B418FE768AF29C58462BBBF9FB48304B50593FE18BC7A90D774E440DB20

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 0208E2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0208E50A,00000000,00000000,00000000,00020106,00000000,0208E50A,00000000,000000E4), ref: 0208E319
RegSetValueExA.ADVAPI32(0208E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0208E38E
RegDeleteValueA.ADVAPI32(0208E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0208E3BF
RegCloseKey.ADVAPI32(0208E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0208E50A), ref: 0208E3C8

Strings

PromptOnSecureDesktop, xrefs: 0208E33A

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 5e56b570d59e4ce8178cce3ddfda0903a2687287925dbed8b3ce94cbf59010e2
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 09212D71A00219BBDB21AFA5EC89EDF7FA9EF08750F048061F944A6150E7718A54EB90

Function 0040E095 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 020871C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 020871E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 02087228
LocalFree.KERNEL32(?,?,?), ref: 02087286
wsprintfA.USER32 ref: 0208729D

Strings

|, xrefs: 0208721A

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: a63f57db9597029000ff4f8d0fe4bc5d960c7dc636aaefd909503b73018d6aee
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 2A313A76900209BFDB41EFA8DC49BDB7BACEF04314F148066F859DB214EB75D6488B94

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0208B478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0208B51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0208B529
SystemTimeToFileTime.KERNEL32(?,?), ref: 0208B548
GetTimeZoneInformation.KERNEL32(?), ref: 0208B590
wsprintfA.USER32 ref: 0208B61E

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 89561329c8317dd72b2e9856f366803a62c44ebd6037ee89c6b7e63d2cf666ba
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 38512EB1D0021DAACF54DFD5D8885EEBBF9BF48304F10812AF501A6150E7B84AC9DF98

Function 020862D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 02086303
LoadLibraryA.KERNEL32(?), ref: 0208632A
GetProcAddress.KERNEL32(00000000,?), ref: 020863B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 02086405

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: e9a8919af375cf8ded5a946453885d255e92373b06e9554dc47347bc373ff34a
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 8B417C71A00305AFDB55EF58C884BAEB7F8FF05318F168069E995D7290D772E980EB50

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 0208E795 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0208DF6C: GetCurrentThreadId.KERNEL32 ref: 0208DFBA

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0208A6AC), ref: 0208E7BF
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0208A6AC), ref: 0208E7EA
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0208A6AC), ref: 0208E819

Strings

PromptOnSecureDesktop, xrefs: 0208E840, 0208E845, 0208E87C, 0208E89B

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 1846aee8e1ad59ae9c0d8563558433b7be7f2c056bde8e2a84dd5e9bb428c570
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: B821E5B1A403007EE2217B319C09FEF3E5DDB65B60F100124FA8EA55D3EAA59450AAB5

Function 0040E52E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 02087665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 020876D9
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0208796D
RegCloseKey.ADVAPI32(?), ref: 0208797E

Strings

PromptOnSecureDesktop, xrefs: 020876C5, 020876CA, 020876E5

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 3aa7920e38aeb8f5dc3b253b6c4c272fcea1656b35d38f6cf5b03703f271298b
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 8611DC70A00209AFDB12AFA9DC44FEFBFB9EB91314F240161F551E62A4E3B08950DB60

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 02089966 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 0208999D
RegDeleteValueA.ADVAPI32(?,00000000), ref: 020899BD
RegCloseKey.ADVAPI32(?), ref: 020899C6

Strings

PromptOnSecureDesktop, xrefs: 02089989, 0208998E, 020899B0, 020899D3

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: fd83014183e0f56e3d990b065027e0b32d58bd00216c49600da3c46b88e24f73
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 6AF0F6B2680218BFF7117B55EC06FDF3A2CDB94B14F100060FA45B5081F6E59A9096B9

Function 004096FF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Function 020828EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 020828FA
gethostbyname.WS2_32(u6A), ref: 02082906

Strings

time_cfg, xrefs: 020828EB
u6A, xrefs: 020828EC, 020828F9, 02082905

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 9faf818588b09c7dd415d233e9ad87b8e3038c083b23a76e77bddff0786243d5
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 4BE0C230605251DFCB81AB2CF848AC637E4EF0A230F008180F8C0C31A0CB34DCC0A740

Function 020869C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 020869E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 02086A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 02086A3A
CloseHandle.KERNEL32(000000FF), ref: 02086BD8

Part of subcall function 0208EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02081DCF,?), ref: 0208EEA8
Part of subcall function 0208EE95: HeapFree.KERNEL32(00000000), ref: 0208EEAF

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 6543dae48372f8aac3f293bc485867bc7e60c65d638edd194f6fb80bd77aa19d
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 8671377190021DEFDF11EFA4CC81AEEBBB9FB04318F10456AE555A6290D7319E92EB60

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0208417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 020841AB
GetLastError.KERNEL32 ref: 020841B5
WaitForSingleObject.KERNEL32(?,?), ref: 020841C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 020841D9

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 84ab2b3d483db2de3ddd0446ba7fcca05cf9655ab7f64e9b7cb64f8a249f7f82
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 9501CC7651120AAFDF01EF91ED84BEF7BACEB18255F104061F901E2050D774DA549BB5

Function 020841F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 0208421F
GetLastError.KERNEL32 ref: 02084229
WaitForSingleObject.KERNEL32(?,?), ref: 0208423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0208424D

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 76e4934d3476f9001860cbae04dd53a185140269f848e10cc5c46de5c8c97336
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: F501087251520AAFDF02EF90ED84BEF7BACEB08255F418061F901E2050D770DA549BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 0208E036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0208E066

Strings

A, xrefs: 0208E036
A, xrefs: 0208E07F
A, xrefs: 0208E037, 0208E03C

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 9e9754b466fccb918e933cc051f2bbb5acf9e05625caaf8e0252586d648b7226
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: D8F0CD322003069BCB62DF64DC84A83B7E8FB09325B048A2AF698C3060D370F4D8CF55

Function 0041A310 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,00000000,00000000,00000000,0041B044,0041A6D1), ref: 0041A32C
FreeEnvironmentStringsW.KERNEL32(00000000,00000000,0041B044,0041A6D1), ref: 0041A347
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0041A36A
GetNumaProcessorNode.KERNEL32(00000000,00000000), ref: 0041A374

Memory Dump Source

Source File: 00000000.00000002.4594975942.0000000000415000.00000020.00000001.01000000.00000003.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_415000_uMlLpvdLRU.jbxd

Similarity

API ID: AllocateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2305449109-0
Opcode ID: 817948169098ee1c181d8f2d6ff3379bb376ad68d85d1d4e020b05e7d4706848
Instruction ID: 6d2837cc59693e195cef3f5a479ad1203b8954106daa288a17772126bb345ff7
Opcode Fuzzy Hash: 817948169098ee1c181d8f2d6ff3379bb376ad68d85d1d4e020b05e7d4706848
Instruction Fuzzy Hash: 60F0FE31785204FBEA30A7A4ED4AF963764E718716F508032F715A92E0D6A42895CE6E

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 0208E3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,020844E2,00000000,00000000,00000000), ref: 0208E470
CloseHandle.KERNEL32(00000001,00000003), ref: 0208E484

Part of subcall function 0208E2FC: RegCreateKeyExA.ADVAPI32(80000001,0208E50A,00000000,00000000,00000000,00020106,00000000,0208E50A,00000000,000000E4), ref: 0208E319
Part of subcall function 0208E2FC: RegSetValueExA.ADVAPI32(0208E50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0208E38E
Part of subcall function 0208E2FC: RegDeleteValueA.ADVAPI32(0208E50A,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0208E3BF
Part of subcall function 0208E2FC: RegCloseKey.ADVAPI32(0208E50A,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0208E50A), ref: 0208E3C8

Strings

PromptOnSecureDesktop, xrefs: 0208E4F1, 0208E4F6, 0208E537, 0208E561

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 2b98ff685954140c816a65b74b25de078f968a8bf133daad0dd8e89027b85047
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 4E41A4B2900314BBEB217E61CC45FEB3BADEB04724F148035FE49A4191E7B58650EAA5

Function 0040E177 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Function 02088330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 020883C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 02088477

Part of subcall function 020869C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 020869E5
Part of subcall function 020869C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 02086A26
Part of subcall function 020869C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 02086A3A

Part of subcall function 0208EE95: GetProcessHeap.KERNEL32(00000000,?,00000000,02081DCF,?), ref: 0208EEA8
Part of subcall function 0208EE95: HeapFree.KERNEL32(00000000), ref: 0208EEAF

Strings

PromptOnSecureDesktop, xrefs: 020883B2, 020883B7, 02088483

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 2724858bd519a30ad1be6d2ae0aba5c1749d747f9f184cd50d72b4e1b9a4c2ab
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 864171B290020DBFEB11FBA09D80EFF77ADEB04304F5484A6E584D6110FBB05A94AB64

Function 0208E631 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0208E859,00000000,00020119,0208E859,PromptOnSecureDesktop), ref: 0208E64D
RegCloseKey.ADVAPI32(0208E859,?,?,?,?,000000C8,000000E4), ref: 0208E787

Strings

PromptOnSecureDesktop, xrefs: 0208E637

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: c257cf7e6b94d81f34863d2b954edc28be7cd67dc6b021f1ba82f4bda334e80e
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 434109B2D0021DBFDF11EFA4DC84DEEBBB9FB08344F144466FA40A6150E3719A559B60

Function 0208AFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0208AFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 0208B00D

Part of subcall function 0208AF6F: gethostname.WS2_32(?,00000080), ref: 0208AF83
Part of subcall function 0208AF6F: lstrcpy.KERNEL32(?,00410B90), ref: 0208AFE6

Part of subcall function 0208331C: gethostname.WS2_32(?,00000080), ref: 0208333F
Part of subcall function 0208331C: gethostbyname.WS2_32(?), ref: 02083349

Part of subcall function 0208AA0A: inet_ntoa.WS2_32(00000000), ref: 0208AA10

Strings

%OUTLOOK_BND_, xrefs: 0208B076, 0208B07B, 0208B0BE, 0208B0DD

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 325e11499c122cf16a0d6d67822d6b8668a70156c8ba697a81960d0e9256c09b
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 3F41FCB290034CABDB25AFA0DC45EEF3BADFB08304F14442AF92592151EA75E6549F54

Function 02089452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 02089536
Sleep.KERNEL32(000001F4), ref: 0208955D

Strings

, xrefs: 020894D9

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 697e8c19050f8e433c75cff2aa1ee8a9f716dd48bf4e9bffb99940f7f3e6591a
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: 2E41E4B190438D6FEBB7BB64D888BBB3BE49B02314F1401A5D4C2973A2D7B44981E711

Function 0208BC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0208B9D9
InterlockedIncrement.KERNEL32(00413648), ref: 0208BA3A
InterlockedIncrement.KERNEL32(?), ref: 0208BA94
GetTickCount.KERNEL32 ref: 0208BB79
GetTickCount.KERNEL32 ref: 0208BB99
InterlockedIncrement.KERNEL32(?), ref: 0208BE15
closesocket.WS2_32(00000000), ref: 0208BEB4

Strings

%FROM_EMAIL, xrefs: 0208BC7D

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 0333b5a0ab3b6e0270b1a9a042e86047f2cee39b6ad9d7a08e7be6a59af01e56
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 23318B72500348EFDF65EFA4DC84AEEB7A9EB48304F204056FA64C2160EB709685DF14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 0208709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 020870BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 020870F4

Strings

|, xrefs: 020870E6

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: aeaecfcc7673227d1802c771807a239085fca7687d45ce6d91001a718f86b38a
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: DB112E76900218EBDF51DBD8DC84AEFB7BCAB04305F2441A6E551E6068D7709784DBA0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 02083189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02082F88: GetModuleHandleA.KERNEL32(?), ref: 02082FA1
Part of subcall function 02082F88: LoadLibraryA.KERNEL32(?), ref: 02082FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 020831DA
HeapFree.KERNEL32(00000000), ref: 020831E1

Memory Dump Source

Source File: 00000000.00000002.4595679659.0000000002080000.00000040.00001000.00020000.00000000.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2080000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 9af67915a81f682cb6152b7de1d3b9b56323341f0991eaeefa239b0316db8274
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 48519A3190034AAFCF02AF64D888AFAB7B5FF55705F1441A9EC96C7210E7329A19DB90

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000000.00000002.4594901128.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4594901128.0000000000414000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_uMlLpvdLRU.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: bndqedvz.exePID: 6368, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	97%
Signature Coverage:	0%
Total number of Nodes:	1622
Total number of Limit Nodes:	16

Executed Functions

Function 00409A6B Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNEL32(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,004122F8,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(C:\Users\user\Desktop\uMlLpvdLRU.exe), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00001A90), ref: 0040A4C3

Strings

", xrefs: 0040A189
C:\Users\user\Desktop\uMlLpvdLRU.exe, xrefs: 0040A2CB, 0040A3CC, 0040A3E1, 0040A406, 0040A413
P, xrefs: 00409DAA
\, xrefs: 00409D0C
D, xrefs: 00409F8E
", xrefs: 0040A078
yuzqifwu, xrefs: 0040A389, 0040A397
%X%08X, xrefs: 0040A0B0
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 0040A1D9
", xrefs: 00409EDB

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Users\user\Desktop\uMlLpvdLRU.exe$C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$D$P$\$yuzqifwu
API String ID: 2089075347-260218807
Opcode ID: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction ID: 9e8e6158c267d4507ba39c142606b205eb09e8ef63bc9ae6e883bbf27c052806
Opcode Fuzzy Hash: 69071e7f72711d21cff6056459b1329949a0fa875525a2a87badba31d3a6a59d
Instruction Fuzzy Hash: 4A5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Function 0041A380 Relevance: 56.3, APIs: 30, Strings: 2, Instructions: 293
timelibraryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedDecrement.KERNEL32(?), ref: 0041A43D
SetConsoleTitleA.KERNEL32(00000000), ref: 0041A445
GlobalSize.KERNEL32(00000000), ref: 0041A44D
FindAtomW.KERNEL32(00000000), ref: 0041A455
SearchPathW.KERNEL32(0041CA08,0041C9CC,0041C98C,00000000,?,?), ref: 0041A479
SetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A483
GetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A4AB
CopyFileExA.KERNEL32(0041CA54,0041CA48,00000000,00000000,00000000,00000000), ref: 0041A4C3
GetEnvironmentStringsW.KERNEL32 ref: 0041A4C9
WriteConsoleOutputW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0041A4E8
GetNumaHighestNodeNumber.KERNEL32(?), ref: 0041A4F3
DebugActiveProcessStop.KERNEL32(00000000), ref: 0041A4FB
GetSystemDefaultLCID.KERNEL32 ref: 0041A515
RtlEnterCriticalSection.NTDLL(?), ref: 0041A529
LoadLibraryW.KERNEL32(00000000), ref: 0041A542
GetUserObjectInformationW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041A58C
GetSystemTimes.KERNELBASE(?,?,?), ref: 0041A5A1
FoldStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A5C9
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A5EC
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A5F9
GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041A601
CopyFileA.KERNEL32(0041CAD8,0041CAB0,00000000), ref: 0041A612
GetFileAttributesW.KERNEL32(00000000), ref: 0041A619
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A61F
OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 0041A628
GetBinaryTypeW.KERNEL32(00000000,00000000), ref: 0041A630
GlobalAlloc.KERNELBASE(00000000,004220DC), ref: 0041A66F

Strings

k`, xrefs: 0041A6FD
}$, xrefs: 0041A721

Memory Dump Source

Source File: 0000000C.00000002.2734672491.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_bndqedvz.jbxd

Similarity

API ID: Console$File$CopyDefaultGlobalLengthSystem$ActiveAliasAliasesAllocAtomAttributesBinaryCallCommComputerConfigCriticalDebugDecrementEnterEnvironmentExesFindFoldHighestInformationInterlockedLibraryLoadModeNameNamedNodeNumaNumberObjectOpenOutputPathPipeProcessSearchSectionSizeStopStringStringsTimerTimesTitleTypeUserWaitableWrite
String ID: k`$}$
API String ID: 1387190455-956986773
Opcode ID: 0cdf8472348f809f2fd8f217c0fd777b165f73a7af62ccbf81e5d6157e6b6df5
Instruction ID: 37379827b28c5908f82b0116f8609ffbc644b13a744a3271631f23acd6dce4b9
Opcode Fuzzy Hash: 0cdf8472348f809f2fd8f217c0fd777b165f73a7af62ccbf81e5d6157e6b6df5
Instruction Fuzzy Hash: E4A12471A45310AFD320AB61EC49BDF7B68EB4C705F00803AF659961A0C7785985CBEE

Function 0040637C Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNELBASE(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNELBASE(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Function 004073FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00407472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 004074F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.KERNELBASE(?), ref: 004077E6

Strings

", xrefs: 00407599

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 58688efdc745e23d79e1c9d42d0b110b33b2b67bc428880df89735915a056cb6
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Function 0040405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 7de862f9e9b35a1df311cf9a4407cf261d5ef3a80a072fcdc92d6b04e029e81b
Instruction ID: a90c6c4c2b7f8b8208d93dc1fe438bcf4b3bc6ab1fe170e3c7599fd426c471ab
Opcode Fuzzy Hash: 7de862f9e9b35a1df311cf9a4407cf261d5ef3a80a072fcdc92d6b04e029e81b
Instruction Fuzzy Hash: 3851A3B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Function 006B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006B024D

Strings

kernel32.dll, xrefs: 006B008F, 006B0095
cess, xrefs: 006B018D

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1cbfe1bad8ad953d37be5dc3ae992457c84081cda89f7c9b413a08e1e8265b97
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 275279B5A00229DFDB64CF58C984BA9BBB1BF09304F1480E9E50DAB351DB30AE85DF14

Function 0040977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82
threadprocessinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,004122F8), ref: 004097B1
Wow64GetThreadContext.KERNEL32(?,?,?,?,?,?,?,004122F8), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 004097F9
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,004122F8), ref: 00409831
Wow64SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040984E
ResumeThread.KERNELBASE(?,?,?,?,?,?,?,?,?,?,004122F8), ref: 0040985B

Strings

D, xrefs: 004097A9

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ProcessThread$ContextWow64$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2098669666-2746444292
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Function 0041A696 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(0041CB10), ref: 0041A6C1
GlobalSize.KERNEL32(00000000), ref: 0041A6EB
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A71A

Strings

k`, xrefs: 0041A6FD
}$, xrefs: 0041A721

Memory Dump Source

Source File: 0000000C.00000002.2734672491.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_bndqedvz.jbxd

Similarity

API ID: ExchangeGlobalInterlockedLibraryLoadSize
String ID: k`$}$
API String ID: 1230614907-956986773
Opcode ID: ad299a3146fbd31aa4e72491768b5ec2b553fdd1698bae50372d489600919617
Instruction ID: 3691dabe03090a73b08bcf6b98ad8fa90aa58e4902adf23636a8ed1bf61f499c
Opcode Fuzzy Hash: ad299a3146fbd31aa4e72491768b5ec2b553fdd1698bae50372d489600919617
Instruction Fuzzy Hash: 5C1108307462408AC734AB20DC467DFB761EB48315F15443FE6AA962A1CB7894A1C7DF

Function 00404280 Relevance: 7.6, APIs: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Function 0041A0A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00421FB0), ref: 0041A13E
GetProcAddress.KERNEL32(00000000,00420720), ref: 0041A171
VirtualProtect.KERNELBASE(00421DFC,004220DC,00000040,?), ref: 0041A190

Strings

, xrefs: 0041A0D6

Memory Dump Source

Source File: 0000000C.00000002.2734672491.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_bndqedvz.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: 66c140271c644cc1f2ccc4ee16bc6603007ca1d7cd4741005967d982a08338d1
Instruction ID: df23f584a4b94a56a47cf0700e1bb303751c1b2e60a1d636fe9a2e96d66d9807
Opcode Fuzzy Hash: 66c140271c644cc1f2ccc4ee16bc6603007ca1d7cd4741005967d982a08338d1
Instruction Fuzzy Hash: 52112964718240DED720CF64FE05B067AF1FBAC784F815238D1548B2B2DBB526468B6D

Function 00404000 Relevance: 4.5, APIs: 3, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,004122F8,004042B6,00000000,00000001,004122F8,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404046

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Function 0040EC54 Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Function 00406E36 Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Function 006E441E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006E4446
Module32First.KERNEL32(00000000,00000224), ref: 006E4466

Memory Dump Source

Source File: 0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006E3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6e3000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c54481a68dd48520dcc6c5b577859663d9b7b2b0c63d03e7ee0a26606bc8d4b2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E5F0F632201350BBDB203BF6988DBAE72E9EF48724F100128E652915C0CF74EC058A61

Function 006B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006B0223,?,?), ref: 006B0E19
SetErrorMode.KERNELBASE(00000000,?,?,006B0223,?,?), ref: 006B0E1E

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5ec0122905795958cf8b6ea84eb92189ad46b0a0d2fb6fa6a8bc84ef3f06bca4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 19D0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9180C770994147E5

Function 00406DC2 Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Function 00409892 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SetServiceStatus.SECHOST(00413394), ref: 004098EB

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction ID: dd676a4af3dd8f9e000b524091363a81fd6157f1888c947a943bd607f736cbf1
Opcode Fuzzy Hash: ed568b8bb23c32db7e8f15f5619feefc651b0b7a3ef30a3dcb983adc29e58fc0
Instruction Fuzzy Hash: 02F0F271514208EFCB18CF14E89869A7BA0F348706B20C83EE82AD2371CB749A80DF0D

Function 006E40DD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006E412E

Memory Dump Source

Source File: 0000000C.00000002.2737258671.00000000006E3000.00000040.00000020.00020000.00000000.sdmp, Offset: 006E3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6e3000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: dec849b39e0adcc75bf3005ca7ead91d4f867ae444d7190d734c03e3cc8bdccc
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AA113979A00208EFDB01DF99C985E99BBF5EF08350F1580A4F9489B362D771EA90DF80

Function 004098F2 Relevance: 1.3, APIs: 1, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00404280: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,004122F8,0040A3C7), ref: 00404290

Sleep.KERNEL32(000003E8,00000100,004122F8,0040A3C7), ref: 00409909

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CreateEventSleep
String ID:
API String ID: 3100162736-0
Opcode ID: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction ID: e56085e6bf9507d1b9c0d1fa6774ae3e34a200a1ca8b69066151cd7271dcc025
Opcode Fuzzy Hash: 4d41be995d42169e7907864f945f5cc175d4e7c56b3013806251050fc082db50
Instruction Fuzzy Hash: 58F05472A81360A6E62226566C07F8F19040B95B24F05417EF744BA2C395E8495141ED

Non-executed Functions

Function 006B65E3 Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006B65F6
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006B6610
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 006B6631
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006B6652

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 4bd01ec6da9f1f18e8a70a1e8ad7fc44212b1e80f68a73fe51c77a47cb7ed226
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 151173B2600218BFDB219F65DC46FDB3FA9EB057A5F104024FA08E7251E7B5DD9087A4

Function 006B9EA0 Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006B9E6D
lstrcpy.KERNEL32(?,00000000), ref: 006B9FE1
lstrcat.KERNEL32(?,?), ref: 006B9FF2
lstrcat.KERNEL32(?,0041070C), ref: 006BA004
GetFileAttributesExA.KERNEL32(?,?,?), ref: 006BA054
DeleteFileA.KERNEL32(?), ref: 006BA09F
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 006BA0D6
lstrcpy.KERNEL32 ref: 006BA12F
lstrlen.KERNEL32(00000022), ref: 006BA13C
GetTempPathA.KERNEL32(000001F4,?), ref: 006B9F13

Part of subcall function 006B7029: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 006B7081

Part of subcall function 006B6F30: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eafwolca,006B7043), ref: 006B6F4E
Part of subcall function 006B6F30: GetProcAddress.KERNEL32(00000000), ref: 006B6F55
Part of subcall function 006B6F30: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006B6F7B
Part of subcall function 006B6F30: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006B6F92

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 006BA1A2
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006BA1C5
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 006BA214
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 006BA21B
GetDriveTypeA.KERNEL32(?), ref: 006BA265
lstrcat.KERNEL32(?,00000000), ref: 006BA29F
lstrcat.KERNEL32(?,00410A34), ref: 006BA2C5
lstrcat.KERNEL32(?,00000022), ref: 006BA2D9
lstrcat.KERNEL32(?,00410A34), ref: 006BA2F4
wsprintfA.USER32 ref: 006BA31D
lstrcat.KERNEL32(?,00000000), ref: 006BA345
lstrcat.KERNEL32(?,?), ref: 006BA364
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 006BA387
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 006BA398
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006BA1D1

Part of subcall function 006B9966: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006B999D
Part of subcall function 006B9966: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006B99BD
Part of subcall function 006B9966: RegCloseKey.ADVAPI32(?), ref: 006B99C6

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 006BA3DB
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 006BA3E2
GetDriveTypeA.KERNEL32(00000022), ref: 006BA41D

Strings

", xrefs: 006BA142
\, xrefs: 006B9F73
D, xrefs: 006BA1F5
", xrefs: 006BA3F0
P, xrefs: 006BA011
", xrefs: 006BA2DF

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction ID: 5c4c9c5d38c69f00c30ea41f63ae349bda08e306d23cebc31d4b3e4f78aca414
Opcode Fuzzy Hash: 2004a96a3fb695a35ebb74482f6fad10186942e4c1f31b0e0affa7522a4f957f
Instruction Fuzzy Hash: 4DF130F1D40259AFDF21DBA08C49EEE7BBDAB08304F0484AAF605E2151E7758AC58F65

Function 00401000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlNtStatusToDosError, xrefs: 00401194
NtFilterToken, xrefs: 0040122B
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlFreeSid, xrefs: 00401116
RtlSetLastWin32Error, xrefs: 004010D6
ntdll.dll, xrefs: 0040100D
NtQueryInformationToken, xrefs: 00401262
NtSetInformationToken, xrefs: 00401175
NtDuplicateToken, xrefs: 004011F3
NtTerminateProcess, xrefs: 004010F6
RtlInitUnicodeString, xrefs: 00401135
NtClose, xrefs: 004011B4
RtlLengthSid, xrefs: 00401246
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationThread, xrefs: 00401155

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Function 0040B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jan, xrefs: 0040B256
Jun, xrefs: 0040B279
Feb, xrefs: 0040B25D
May, xrefs: 0040B272
Wed, xrefs: 0040B23A
Mon, xrefs: 0040B22C
Nov, xrefs: 0040B29C
Sep, xrefs: 0040B28E
Tue, xrefs: 0040B233
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Aug, xrefs: 0040B287
Apr, xrefs: 0040B26B
Thu, xrefs: 0040B241
Sat, xrefs: 0040B24F
Dec, xrefs: 0040B2A3
Fri, xrefs: 0040B248
Sun, xrefs: 0040B225
Jul, xrefs: 0040B280
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Function 006B7CFC Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 006B7D21
GetUserNameA.ADVAPI32(?,?), ref: 006B7D46
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006B7D7D
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 006B7DA2
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006B7DC0
EqualSid.ADVAPI32(?,?), ref: 006B7DD1
LocalAlloc.KERNEL32(00000040,00000014), ref: 006B7DE5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006B7DF3
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006B7E03
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 006B7E12
LocalFree.KERNEL32(00000000), ref: 006B7E19
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006B7E35

Strings

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 006B7F49, 006B7F76, 006B7F8A, 006B7F8B
D, xrefs: 006B7D73

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$D
API String ID: 2976863881-493086155
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 4e2a49b303780a28f3f45141dad7bcd9aa070fa366006832f4bd4a3bdc8c9f4a
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: C5A14CB1900219AFDB119FA0DD88FEEBBBEFF48340F148069E505E7250DB758A85CB64

Function 00407A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,?,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 00407CE2, 00407D0F, 00407D23, 00407D24

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$D
API String ID: 2976863881-493086155
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Function 00406511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
plgs:, xrefs: 004066AA
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
except_info, xrefs: 00406728

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Function 0040A7C1 Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
localcfg, xrefs: 0040AB0B
helo %s, xrefs: 0040A803
Incorrect respons, xrefs: 0040AB39
ESMTP, xrefs: 0040AA38
mail from:<%s>, xrefs: 0040A848
ehlo %s, xrefs: 0040A7F5
data, xrefs: 0040A85E
AUTH LOGIN, xrefs: 0040A80C
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
quit, xrefs: 0040A86C

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Function 006B7A70 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006B7A96
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006B7ACD
GetLengthSid.ADVAPI32(?), ref: 006B7ADF
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 006B7B01
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006B7B1F
EqualSid.ADVAPI32(?,?), ref: 006B7B39
LocalAlloc.KERNEL32(00000040,00000014), ref: 006B7B4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006B7B58
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006B7B68
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 006B7B77
LocalFree.KERNEL32(00000000), ref: 006B7B7E
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006B7B9A
GetAce.ADVAPI32(?,?,?), ref: 006B7BCA
EqualSid.ADVAPI32(?,?), ref: 006B7BF1
DeleteAce.ADVAPI32(?,?), ref: 006B7C0A
EqualSid.ADVAPI32(?,?), ref: 006B7C2C
LocalAlloc.KERNEL32(00000040,00000014), ref: 006B7CB1
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006B7CBF
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 006B7CD0
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 006B7CE0
LocalFree.KERNEL32(00000000), ref: 006B7CEE

Strings

D, xrefs: 006B7AC3

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 6c5e1e8f4022bffd71ebdc9bca60ad62b60e5900099cc5b722cb224e1ba1b24a
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 72815DB190421AAFDB11CFA4DD84FEEBFB9AF48304F04806AE505E6250D7759A85CF64

Function 00407809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Function 00408328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 004085C8, 004085D5, 004085E5

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$localcfg
API String ID: 237177642-3478224671
Opcode ID: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: 9b9e109144e0e2d50cf6e1315f69990f798a8bf7c84e3a195e658084b19d70a6
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Function 00401280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

@, xrefs: 00401380
useless, xrefs: 0040161E
uac, xrefs: 00401628
, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388
<, xrefs: 00401378
D, xrefs: 004015C6

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Function 00401D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

net_type, xrefs: 00401E87
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
start_srv, xrefs: 00401E6C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
loader_id, xrefs: 00401F4B, 00401F6B
lid_file_upd, xrefs: 00401E25
kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction ID: 8f9aaa01d81d5e00f35a14cef107f65a3e8f5b831808d54868c05c9eb27f2f66
Opcode Fuzzy Hash: 9f3abc139dc6c88613093014c78d45ea21c86ec42b9258ba851d748653af05de
Instruction Fuzzy Hash: D451D9B05043446FD320AF768C85F67BAECEB84708F04493FF955A2292D7BDA94487A9

Function 0040199C Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 106memorylibraryloaderCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF
Iphlpapi.dll, xrefs: 004019B7
localcfg, xrefs: 004019A3
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 835516345-270533642
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Function 006B858F Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 006B865A
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 006B867B
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006B86A8
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006B86B1

Strings

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 006B882F, 006B883C, 006B884C
", xrefs: 006B896C

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe
API String ID: 237177642-1929718735
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: f1bf46f929f46855e42fcd04f3f37a9b265612a67bb396e98ba9973200eebf51
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: E4C191F1940109BFEB11ABA4DD85EEE7BBEEB04300F14407AF604E3151EA718AD5CB69

Function 00402A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Function 006B14E7 Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006B1601
lstrlenW.KERNEL32(-00000003), ref: 006B17D8

Strings

, xrefs: 006B16C9
D, xrefs: 006B182D
<, xrefs: 006B15DF
@, xrefs: 006B15E7

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: e410baf7a7e5af30da6f562a300801daeeb5cd0399b31361967e0f7eb666eace
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 24F1ADF1108341AFD320DF64C898BEAB7E6FB8A300F50892DF5959B390D7B49984CB56

Function 006B7666 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006B76D9
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 006B7757
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 006B778F
___ascii_stricmp.LIBCMT ref: 006B78B4
RegCloseKey.ADVAPI32(?), ref: 006B794E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006B796D
RegCloseKey.ADVAPI32(?), ref: 006B797E
RegCloseKey.ADVAPI32(?), ref: 006B79AC
RegCloseKey.ADVAPI32(?), ref: 006B7A56

Part of subcall function 006BF40C: lstrlen.KERNEL32(000000E4,00000000,004122F8,000000E4,006B772A,?), ref: 006BF414

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006B79F6
RegCloseKey.ADVAPI32(?), ref: 006B7A4D

Strings

", xrefs: 006B7800

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction ID: 27295b0998f55caf9fcd4ce4a13e76b2b216bcae065b51824183e50912d95a1e
Opcode Fuzzy Hash: 6662dee372d798d6f1e3baf347185b0c176791543b489e25c2cc06528122fd8e
Instruction Fuzzy Hash: 01C193B1904209AFDB61ABA4DC45FEE7BBAEF85310F1040A5F504E6291EB71DEC48B64

Function 0040704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 004070C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0040719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(76230F10), ref: 00407208
RegCloseKey.ADVAPI32(76230F10), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(76230F10), ref: 004072D0
RegCloseKey.ADVAPI32(76230F10), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(76230F10), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,004122F8,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 74e128f8df151d438ab4d1c82f82d45ce79a9eea08151c9b6eb13cdb2253fb65
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Function 006B2CC9 Relevance: 21.2, APIs: 14, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006B2CED
socket.WS2_32(00000002,00000002,00000011), ref: 006B2D07
htons.WS2_32(00000000), ref: 006B2D42
select.WS2_32 ref: 006B2D8F
recv.WS2_32(?,00000000,00001000,00000000), ref: 006B2DB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006B2E62

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID:
API String ID: 127016686-0
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: ab0f6b5c08476fbbbc9167ef1f2b2c33828152dc97dc4cb4724b9a8d73801337
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 0761F3B1504306ABC320AF65DC18BEBBBF9FF88341F144819F98497261D7B4D8C18BA6

Function 0040AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Function 00402DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Function 0040675C Relevance: 19.7, APIs: 13, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,76230F10,00000000), ref: 0040688B
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,?,00000000,00408244,00000000,?,76230F10,00000000), ref: 0040691C
CloseHandle.KERNEL32(000000FF,?,76230F10,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Function 00409326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction ID: b6d0878b1d73306239325ce20442e1ed3f1d42e4277a972a89fda7ad6b3a58d4
Opcode Fuzzy Hash: b115644d8fcf1706915678c94d32f66e2b06ae170b0cb428a55680f7bdd6b1eb
Instruction Fuzzy Hash: A7A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A2192D7B999848FA9

Function 0040B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%P5DATE, xrefs: 0040B4F2
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9
%DATE, xrefs: 0040B4D2
%TO_DOMAIN, xrefs: 0040B44B
%TO_HASH, xrefs: 0040B4B0

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Function 006B1FFD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 006B202D
GetSystemInfo.KERNEL32(?), ref: 006B204F
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 006B206A
GetProcAddress.KERNEL32(00000000), ref: 006B2071
GetCurrentProcess.KERNEL32(?), ref: 006B2082
GetTickCount.KERNEL32 ref: 006B2230

Part of subcall function 006B1E46: GetComputerNameA.KERNEL32(?,0000000F), ref: 006B1E7C

Strings

hi_id, xrefs: 006B217D, 006B2182, 006B219A
localcfg, xrefs: 006B2091, 006B2098, 006B20AB, 006B20E4, 006B20F3, 006B2119, 006B2138, 006B214E, 006B2166, 006B2183, 006B219B, 006B21B7, 006B21D7
flags_upd, xrefs: 006B20A5, 006B20AA, 006B20E3
work_srv, xrefs: 006B20C5

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction ID: 25c40fef5e06bfd1e9136d32a7d48409c6e9e73b2a25da020fc226429138068f
Opcode Fuzzy Hash: a6853c32b60f2cc87b9b05c4564022504dbed896d64d3d62fe446b684c9c1410
Instruction Fuzzy Hash: EB51D4F05003446FE370AF758C86FE7BAEDEB54704F00491DF99692242D7B9A9C48769

Function 00402011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000,0040E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Function 0040F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Function 0040C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Function 006B3059 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 006B3068
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 006B3078
GetProcAddress.KERNEL32(00000000,00410408), ref: 006B3095
RtlAllocateHeap.NTDLL(00000000), ref: 006B30B6
htons.WS2_32(00000035), ref: 006B30EF
inet_addr.WS2_32(?), ref: 006B30FA
gethostbyname.WS2_32(?), ref: 006B310D
HeapFree.KERNEL32(00000000), ref: 006B314D

Strings

iphlpapi.dll, xrefs: 006B3062, 006B3067, 006B3077

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 8563423c9a6a87528293bea945ac5a5b523114916a72650a232d0c637f98e104
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: C53193B1B00216ABDB119BB89C48AEE77BDAF04760F148125E518E7390DB74DAC18B58

Function 006B958D Relevance: 15.3, APIs: 10, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006B95A7
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006B95D5
GetModuleFileNameA.KERNEL32(00000000), ref: 006B95DC
wsprintfA.USER32 ref: 006B9635
wsprintfA.USER32 ref: 006B9673
wsprintfA.USER32 ref: 006B96F4
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 006B9758
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006B978D
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006B97D8

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID:
API String ID: 3696105349-0
Opcode ID: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction ID: 33a3cb1ad8b4d67d492f212fdb03cbd963b23e083c4a00e69871bce7fc93824a
Opcode Fuzzy Hash: 0ac1c7cf1312716136e7fb6a36e28e3fd6dbc7c146b39f469b2464a0e942be83
Instruction Fuzzy Hash: 73A16FF1940208AFEB21DFA0DC45FDA3BADEB05741F10402AFA1596252E775D9C4CBA9

Function 00402D21 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Function 0040BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Function 00406A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNEL32(00409E9D,00409A60,?,?,?,004122F8,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: ab228a986819567a034f5778c60117e3a6ddbbfebf067212e33de9fc62893814
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 6C31F1B2900108BFDB00DFA09D44ADF7F78EF48310F158076E212F7291D674A9618F69

Function 006B6778 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000008), ref: 006B67C3
htonl.WS2_32(?), ref: 006B67DF
htonl.WS2_32(?), ref: 006B67EE
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006B68F1
ExitProcess.KERNEL32 ref: 006B69BC

Strings

except_info, xrefs: 006B698F
localcfg, xrefs: 006B6994

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitRead
String ID: except_info$localcfg
API String ID: 1430491713-3605449297
Opcode ID: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction ID: ad1428be797c06e35cb4f0e8b6f83faf1583cab4b0f8b81e013b3fa6e7108300
Opcode Fuzzy Hash: 9895dd2e79d38ff6447f40a868429f3d8bfef7524ed1ea596fca3f6cba339201
Instruction Fuzzy Hash: FA6160B2940208AFDB609FB4DC45FEA77E9FF08300F14806AFA6DD2161DA759990CF54

Function 006BF57C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(006BCC84), ref: 006BF5B4
socket.WS2_32(00000002,00000001,00000000), ref: 006BF5CE
closesocket.WS2_32(00000000), ref: 006BF5DC

Strings

time_cfg, xrefs: 006BF58A

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: b614c7865280534aa9c9632b5a6ced31c8737fbec1af767094421a8510ff0bff
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 8B316EB6900118ABDB10DFA5DC89DEFBBBDEF89310F10457AF915D3160E7709A818BA4

Function 00406F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Function 006B2F88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 006B2FA1
LoadLibraryA.KERNEL32(?), ref: 006B2FB1
GetProcAddress.KERNEL32(00000000,004103F0), ref: 006B2FC8
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006B3000
RtlAllocateHeap.NTDLL(00000000), ref: 006B3007
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 006B3032

Strings

dnsapi.dll, xrefs: 006B2F90

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: a96281e48dfff0d0a973ee1f708d05a9a42083d5648bdcdaa2dd334407f9e1d6
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 7721A4B1A41226BBCB219B54DC489EEBBBDEF08B50F104421F901E7240D7B49EC187D4

Function 00406CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,004122F8,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Function 006B99E3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 006B9A18
GetThreadContext.KERNEL32(?,?), ref: 006B9A52
TerminateProcess.KERNEL32(?,00000000), ref: 006B9A60
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 006B9A98
SetThreadContext.KERNEL32(?,00010002), ref: 006B9AB5
ResumeThread.KERNEL32(?), ref: 006B9AC2

Strings

D, xrefs: 006B9A10

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f2e0e42580501e5d8aa5cdbdab5bb6220977772b2a54f4d1d8c6baeb4dd6b3dd
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 6E213BB1A01219BBDB119BA1DC09EEFBBBDEF04750F404061BA19E1151EB758A84CBA4

Function 006B1C03 Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 006B1C18
LoadLibraryA.KERNEL32(004102C8), ref: 006B1C26
GetProcessHeap.KERNEL32 ref: 006B1C84
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 006B1C9D
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 006B1CC1
HeapFree.KERNEL32(?,00000000,00000000), ref: 006B1D02
FreeLibrary.KERNEL32(?), ref: 006B1D0B

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 84918c03ea162fd62e06558f0c749231b3e352f7220cbf63271e04ef29771a63
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 9E313EB1E00219BFCB119FA4DC988EEBFBAEF46711B64447AE501E6210D7B54EC0DB94

Function 006B6CC7 Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 006B6CE4
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 006B6D22
GetLastError.KERNEL32 ref: 006B6DA7
CloseHandle.KERNEL32(?), ref: 006B6DB5
GetLastError.KERNEL32 ref: 006B6DD6
DeleteFileA.KERNEL32(?), ref: 006B6DE7
GetLastError.KERNEL32 ref: 006B6DFD

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction ID: 2f64cd09de63f185deacac8ea5549fbe2bacf4ee24bc096796643ca526ed0928
Opcode Fuzzy Hash: 362dcede7d5d7e1862a192dbfd3c9a0fc2e91233da1497f7250b4d19aff3169c
Instruction Fuzzy Hash: 9231E3B6A00249BFCB01DFA4DD44ADEBF7AEF48310F14807AF251E3261D7748A958B65

Function 006B6F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eafwolca,006B7043), ref: 006B6F4E
GetProcAddress.KERNEL32(00000000), ref: 006B6F55
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006B6F7B
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006B6F92

Strings

\\.\pipe\eafwolca, xrefs: 006B6F37
C:\Windows\SysWOW64\, xrefs: 006B6F30, 006B6F38, 006B6F65, 006B6F6C, 006B6F7A, 006B6F85, 006B6F91, 006B6FA9, 006B6FC6, 006B6FEC

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$\\.\pipe\eafwolca
API String ID: 1082366364-3742500519
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 15ca61cffbfacf7e0abe9dac50789dbaf13d2751111648b4266baca4b92553e1
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 442138E174434479F7226735AC89FFB2E4E8B52710F1880A9F504D5292DADD88D6836D

Function 0041A230 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

BuildCommDCBW.KERNEL32(00000000,?), ref: 0041A25D
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A275
UnhandledExceptionFilter.KERNEL32(00000000), ref: 0041A27D
SetCalendarInfoA.KERNEL32(00000000,00000000,00000000,0041C980), ref: 0041A2C4
GetShortPathNameA.KERNEL32(00000000,?,00000000), ref: 0041A2D5

Strings

-, xrefs: 0041A2E2

Memory Dump Source

Source File: 0000000C.00000002.2734672491.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_bndqedvz.jbxd

Similarity

API ID: BuildCalendarCommExceptionFilterInfoNamePathPrivateProfileShortStringUnhandledWrite
String ID: -
API String ID: 1417380309-2547889144
Opcode ID: 2c70b2e27553c37d51635817894fb92d35fd66a59e975567011c2500a9255d00
Instruction ID: a6596ea4d5d39f75678243f646b5f7fb3d1533af8648bb96340218ed538d7df8
Opcode Fuzzy Hash: 2c70b2e27553c37d51635817894fb92d35fd66a59e975567011c2500a9255d00
Instruction Fuzzy Hash: BA212970745304ABD760DF64EC85BDE7BA4EB0C711F5000E9F709AA2C1CA7519C18B5E

Function 006BAA28 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 006BAAE5

Strings

, xrefs: 006BABB3
localcfg, xrefs: 006BAD72

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 74053ba8178b23985ab5d92ef51cb47675ff35c71b4fc412fe83397c9531a25c
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: AC711AF1A40314AADF319BD8DC85FEE3B6B9F00705F24442BF904A62A1DB629DC4875B

Function 0040E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Function 006BE8BB Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006BDF6C: GetCurrentThreadId.KERNEL32 ref: 006BDFBA

lstrcmp.KERNEL32(00410178,00000000), ref: 006BE8FA
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,006B6128), ref: 006BE950
lstrcmp.KERNEL32(?,00000008), ref: 006BE989

Strings

A, xrefs: 006BE960, 006BE965
A, xrefs: 006BE9A0
A, xrefs: 006BE8C6, 006BE8CD, 006BE936, 006BE998

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: 0536a573064547d0b04232564c4ad65d176856580b32ba604d7145b37bb6168a
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 6F31DEB16007059FDB71AF24C884BE63BEAEB04321F10892AE55687652D376E8C8CB85

Function 006B6E0E Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 006B6E19

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: f459e290a05e33cf45612fcb91665dcf790117a2189e053b51c5553fb3d88190
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: CB215EBA108119BFDB109B70FC49EDF3FAEEB49361B208425F502D1091EB75DA829778

Function 00406BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Function 006B92CB Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006B92E2
wsprintfA.USER32 ref: 006B9350
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006B9375
lstrlen.KERNEL32(?,?,00000000), ref: 006B9389
WriteFile.KERNEL32(00000000,?,00000000), ref: 006B9394
CloseHandle.KERNEL32(00000000), ref: 006B939B

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 1be7b2fe78daf1b1c9082bd96cd65f8ca3822c15a3a88750ea45fa635b720791
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 8F1175F16401147BE7606B31DC0EFEF3A6EDBC5B10F008069BB05A5092EEB54A818768

Function 00409064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Function 0040DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0040E538,?,76230F10,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Function 006BC543 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006BC6B4
InterlockedIncrement.KERNEL32(006BC74B), ref: 006BC715
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,006BC747), ref: 006BC728
CloseHandle.KERNEL32(00000000,?,006BC747,00413588,006B8A77), ref: 006BC733

Strings

localcfg, xrefs: 006BC544

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 23ded12b5c176d12ee769dc57cdfddf77dfe4e10016bc28ce02b4ece58f86a1f
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 3A516DB1A00B418FD7748F69C5C556ABBEAFB48310B50593EE18BC7A90EB74F980CB14

Function 004080C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,00000040,00408244,00000000,?,76230F10,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNEL32(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNEL32(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 00408225, 0040823A

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe
API String ID: 124786226-729601064
Opcode ID: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: 3deeb1ea8207cc87c011d2a4d6b1370e46491988774d06f984d994a05b286973
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Function 006BE2FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,006BE50A,00000000,00000000,00000000,00020106,00000000,006BE50A,00000000,000000E4), ref: 006BE319
RegSetValueExA.ADVAPI32(006BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 006BE38E
RegDeleteValueA.ADVAPI32(006BE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dk), ref: 006BE3BF
RegCloseKey.ADVAPI32(006BE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dk,006BE50A), ref: 006BE3C8

Strings

Dk, xrefs: 006BE2FC

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: Dk
API String ID: 2667537340-2856625741
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 4cc6f4fbd06c128ed311dcccea2bd4c17da698489058b4e577cb930936ab2250
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 58213071A0021DBBDF209FA5EC85EDE7FB9EF08750F048065F904E7161E6728A94D790

Function 006B71C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006B71E1
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006B7228
LocalFree.KERNEL32(?,?,?), ref: 006B7286
wsprintfA.USER32 ref: 006B729D

Strings

|, xrefs: 006B721A

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 09d3af7159d2dcfeb0ac0dfbdfc522f6efa54dfff2d850ef965bc7f5b641d2a0
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 60314DB2904108BFCB01DFA8DC45ADA3BADEF04314F14C066F959DB251EA75D7888BA4

Function 0040AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Function 0040E3CA Relevance: 7.6, APIs: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,004122F8), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Function 006BB478 Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006BB51A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006BB529
SystemTimeToFileTime.KERNEL32(?,?), ref: 006BB548
GetTimeZoneInformation.KERNEL32(?), ref: 006BB590
wsprintfA.USER32 ref: 006BB61E

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 9c11a758eba6fa2df1a945dd717de70b1c48309a7c81316d1b213546623a8ccf
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: E55100B1D0021DAACF24DFD5D8895EEBBB9BF48304F10816AF505A6150E7F94AC9CF98

Function 006B62D0 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 006B6303
LoadLibraryA.KERNEL32(?), ref: 006B632A
GetProcAddress.KERNEL32(00000000,?), ref: 006B63B1
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 006B6405

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 68eabd08c11c9f1f8b7fc32a638833010fd6402f4ce3bb1f1341f352a82d09e1
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 724147B1A00619ABDB14CF58C884BE9B7EAEF04358F288169F915D7390E779ED81CB50

Function 00406069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Function 00402923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Function 0040E654 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,76230F10,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Function 004026FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: HeapAlloc.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocCountProcessTicksendto
String ID:
API String ID: 1802437671-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Function 0040F26D Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 006B93AC Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006B93C6
GetModuleFileNameA.KERNEL32(00000000), ref: 006B93CD
CharToOemA.USER32(?,?), ref: 006B93DB
wsprintfA.USER32 ref: 006B9410

Part of subcall function 006B92CB: GetTempPathA.KERNEL32(00000400,?), ref: 006B92E2
Part of subcall function 006B92CB: wsprintfA.USER32 ref: 006B9350
Part of subcall function 006B92CB: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006B9375
Part of subcall function 006B92CB: lstrlen.KERNEL32(?,?,00000000), ref: 006B9389
Part of subcall function 006B92CB: WriteFile.KERNEL32(00000000,?,00000000), ref: 006B9394
Part of subcall function 006B92CB: CloseHandle.KERNEL32(00000000), ref: 006B939B

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 006B9448

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: 9db4bccc620a3744e032da898d5bb17b0e6f02c36b390199d231dbfb049ed944
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: E9019EF69001187BDB20A7619D89EDF3B7CDB85701F0040A6BB09E2080EAB49BC58F79

Function 00409145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,004122F8), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32(?,?), ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,004122F8), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(004122F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Function 00402419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Function 00401AC3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

GetAdaptersAddresses, xrefs: 00401AE3
Iphlpapi.dll, xrefs: 00401ACC

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Function 00401BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Function 00406EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Function 006B28EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006B28FA
gethostbyname.WS2_32(u6A), ref: 006B2906

Strings

time_cfg, xrefs: 006B28EB
u6A, xrefs: 006B28EC, 006B28F9, 006B2905

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 2b543db22de2a1722aedc879ff42c815d961ec5518d060d3a3f7d84f873e3c12
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: BBE0C2306041229FCB009B2CF848AC637E6EF0A330F008580F044C32A0C734DCC09780

Function 006B69C3 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006B69E5
SetFileAttributesA.KERNEL32(?,00000002), ref: 006B6A26
GetFileSize.KERNEL32(000000FF,00000000), ref: 006B6A3A
CloseHandle.KERNEL32(000000FF), ref: 006B6BD8

Part of subcall function 006BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,006B1DCF,?), ref: 006BEEA8
Part of subcall function 006BEE95: HeapFree.KERNEL32(00000000), ref: 006BEEAF

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 930ff50f156b4da0f67ee69f8894bb97a8a50beff4a971d08a2575a6198077a7
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 1A7107B190021DEFDF119FA4CC809EEBBBAFB04354F10456AF515E6290D7349E92DB50

Function 00401C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Function 0040E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,004122F8), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Function 006B417F Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006B41AB
GetLastError.KERNEL32 ref: 006B41B5
WaitForSingleObject.KERNEL32(?,?), ref: 006B41C6
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006B41D9

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 5a34bea5c9dfc7e56ca08f76080b8e730c461b1cece87c3911cffb5e72414fdc
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: 09014C7691110AAFDF01DF94ED84BEF3B6DEB18355F004061F901E2150DB70DA908BB5

Function 006B41F3 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006B421F
GetLastError.KERNEL32 ref: 006B4229
WaitForSingleObject.KERNEL32(?,?), ref: 006B423A
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006B424D

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: c163c1a251810128c633f55dc3141daa9a8a34e2700b5e1d4b73a0c081c3278a
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: C401A5B2911109ABDF01DF90ED84BEE7BADEB08355F108461F901E2151DB709A949BB6

Function 00403F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Function 00403F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Function 006BE036 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 006BE066

Strings

A, xrefs: 006BE036
A, xrefs: 006BE07F
A, xrefs: 006BE037, 006BE03C

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 8f61d6842d1c0a7df0d632f66cfa5ea2b857aa46adb3c36a28dce09f3e7abe17
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: A3F062B12007029BCB20DF25D884AC2B7FAFB15321B44862BE155C3260D3B5A8E8CB51

Function 0041A310 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,00000000,00000000,00000000,0041B044,0041A6D1), ref: 0041A32C
FreeEnvironmentStringsW.KERNEL32(00000000,00000000,0041B044,0041A6D1), ref: 0041A347
RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 0041A36A
GetNumaProcessorNode.KERNEL32(00000000,00000000), ref: 0041A374

Memory Dump Source

Source File: 0000000C.00000002.2734672491.0000000000415000.00000020.00000001.01000000.00000005.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_415000_bndqedvz.jbxd

Similarity

API ID: AllocateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2305449109-0
Opcode ID: 817948169098ee1c181d8f2d6ff3379bb376ad68d85d1d4e020b05e7d4706848
Instruction ID: 6d2837cc59693e195cef3f5a479ad1203b8954106daa288a17772126bb345ff7
Opcode Fuzzy Hash: 817948169098ee1c181d8f2d6ff3379bb376ad68d85d1d4e020b05e7d4706848
Instruction Fuzzy Hash: 60F0FE31785204FBEA30A7A4ED4AF963764E718716F508032F715A92E0D6A42895CE6E

Function 0040A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Function 00404E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Function 00404BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Function 004030FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Function 006BE3DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,Dk,00000000,00000000,00000000), ref: 006BE470
CloseHandle.KERNEL32(00000001,00000003), ref: 006BE484

Part of subcall function 006BE2FC: RegCreateKeyExA.ADVAPI32(80000001,006BE50A,00000000,00000000,00000000,00020106,00000000,006BE50A,00000000,000000E4), ref: 006BE319
Part of subcall function 006BE2FC: RegSetValueExA.ADVAPI32(006BE50A,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,004122F8), ref: 006BE38E
Part of subcall function 006BE2FC: RegDeleteValueA.ADVAPI32(006BE50A,?,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dk), ref: 006BE3BF
Part of subcall function 006BE2FC: RegCloseKey.ADVAPI32(006BE50A,?,?,?,?,000000C8,004122F8,?,?,?,?,?,?,?,Dk,006BE50A), ref: 006BE3C8

Strings

Dk, xrefs: 006BE498, 006BE4BD, 006BE41A, 006BE447, 006BE4C0, 006BE41D, 006BE459, 006BE45A, 006BE46C, 006BE49B

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: Dk
API String ID: 4151426672-2856625741
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 7bbdb8af29cf22917ea4a947e496e2295b544a8d413c1bf88761fbcdf6ad2bc2
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 4841BAF2900214BAEB306B558C46FDB3BADDF05724F148139FA0994192E7B6CAD0D7B9

Function 006B8330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006B83C6
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 006B8477

Part of subcall function 006B69C3: SetFileAttributesA.KERNEL32(?,00000080), ref: 006B69E5
Part of subcall function 006B69C3: SetFileAttributesA.KERNEL32(?,00000002), ref: 006B6A26
Part of subcall function 006B69C3: GetFileSize.KERNEL32(000000FF,00000000), ref: 006B6A3A

Part of subcall function 006BEE95: GetProcessHeap.KERNEL32(00000000,?,00000000,006B1DCF,?), ref: 006BEEA8
Part of subcall function 006BEE95: HeapFree.KERNEL32(00000000), ref: 006BEEAF

Strings

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 006B848C, 006B84A1

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe
API String ID: 359188348-729601064
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: c2e9182f06fbab6fab5434b4d706d346d245c3935e2e72656f2fd83f94895bf1
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 534150F290110ABEEB10ABA49E81DFF77AEEB04340F1444AAF504D7151EAB19AD5CB64

Function 006BAFF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006BAFFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 006BB00D

Part of subcall function 006BAF6F: gethostname.WS2_32(?,00000080), ref: 006BAF83
Part of subcall function 006BAF6F: lstrcpy.KERNEL32(?,00410B90), ref: 006BAFE6

Part of subcall function 006B331C: gethostname.WS2_32(?,00000080), ref: 006B333F
Part of subcall function 006B331C: gethostbyname.WS2_32(?), ref: 006B3349

Part of subcall function 006BAA0A: inet_ntoa.WS2_32(00000000), ref: 006BAA10

Strings

%OUTLOOK_BND_, xrefs: 006BB076, 006BB07B, 006BB0BE, 006BB0DD

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: fa46622967c40357ad717dfcb3ffdd1d8d1ca4161840553c4f020f83c8059f87
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 404144B290020CABDB65EFA4DC46EEF3B6DFF04304F14442AF92492162EB75D6948B58

Function 006B9452 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 006B9536
Sleep.KERNEL32(000001F4), ref: 006B955D

Strings

, xrefs: 006B94D9

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction ID: 25e3eb5d971479210e59fa89943929a8cb4874589d42bb6192ef9a50cacd86a9
Opcode Fuzzy Hash: 441ad30f2646d1b8623b46c1d7e45f404d08a6258c9d37c2b51fbe89c32dcb37
Instruction Fuzzy Hash: B441F5F28443986EEB378B64D8987F63BE69B02314F2441A5D686972A2D6744DC2C731

Function 00406987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNEL32(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Function 006BBC7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006BB9D9
InterlockedIncrement.KERNEL32(00413648), ref: 006BBA3A
InterlockedIncrement.KERNEL32(?), ref: 006BBA94
GetTickCount.KERNEL32 ref: 006BBB79
GetTickCount.KERNEL32 ref: 006BBB99
InterlockedIncrement.KERNEL32(?), ref: 006BBE15
closesocket.WS2_32(00000000), ref: 006BBEB4

Strings

%FROM_EMAIL, xrefs: 006BBC7D

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: a89054514313d45f67cc999684ef9ffeb2e840fc5a1a052ea1c340f5be6d0c6a
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 7831B1B1500248DFDF65DFA4DC85AED77BAEB48700F20405AFA2482161DBB4DAC6CF14

Function 00408CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Function 0040BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Function 004038F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Function 006B709D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006B70BC
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006B70F4

Strings

|, xrefs: 006B70E6

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: cdeacaa47fa52bc7df9677e09817c03b854a777e7c1fd6521c85a1e140859660
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 321121B290411CEBDF11CFD8DC84ADEB7BEAB45711F1841A6E501E6190D7709B88DBB0

Function 00401B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Function 0040AB81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Function 004026B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Function 00402684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000001), ref: 00402693
gethostbyname.WS2_32(00000001), ref: 0040269F

Strings

time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Function 0040EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,75B4EA50,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Function 006B3189 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B2F88: GetModuleHandleA.KERNEL32(?), ref: 006B2FA1
Part of subcall function 006B2F88: LoadLibraryA.KERNEL32(?), ref: 006B2FB1

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006B31DA
HeapFree.KERNEL32(00000000), ref: 006B31E1

Memory Dump Source

Source File: 0000000C.00000002.2736938227.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6b0000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: bdb9d342fc083dba44b2461bd35db4b3d59f00c650d890a9dbdbcd9b347af529
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: DB51AEB1A00256EFCB019F68DC849FAB77AFF15300B144168EC9687321E732DB99CB94

Function 00402F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000000C.00000002.2734567554.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_bndqedvz.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Analysis Process: svchost.exePID: 1600, Parent PID: 6368COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1807
Total number of Limit Nodes:	18

Executed Functions

Function 0039C913 Relevance: 115.1, APIs: 45, Strings: 20, Instructions: 1397filestringprocessCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0039CA4E
closesocket.WS2_32(?), ref: 0039CB63
GetTempPathA.KERNEL32(00000120,?), ref: 0039CC28
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0039CCB4
WriteFile.KERNEL32(0039A4B3,?,-000000E8,?,00000000), ref: 0039CCDC
CloseHandle.KERNEL32(0039A4B3), ref: 0039CCED
wsprintfA.USER32 ref: 0039CD21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0039CD77
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 0039CD89
CloseHandle.KERNEL32(?), ref: 0039CD98
CloseHandle.KERNEL32(?), ref: 0039CD9D
DeleteFileA.KERNEL32(?), ref: 0039CDC4
CloseHandle.KERNEL32(0039A4B3), ref: 0039CDCC
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0039CFB1
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0039CFEF
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0039D033
lstrcatA.KERNEL32(?,03B00108), ref: 0039D10C
SetFileAttributesA.KERNEL32(?,00000080), ref: 0039D155
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0039D171
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000), ref: 0039D195
CloseHandle.KERNEL32(00000000), ref: 0039D19C
SetFileAttributesA.KERNEL32(?,00000002), ref: 0039D1C8
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0039D231
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 0039D27C
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0039D2AB
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0039D2C7
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0039D2EB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0039D2F2
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0039D326
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,00000100), ref: 0039D372
lstrcatA.KERNEL32(?,03B00108,?,?,?,?,?,?,?,00000100), ref: 0039D3BD
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,00000100), ref: 0039D3EC
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,00000100), ref: 0039D408
WriteFile.KERNEL32(00000000,03B0012C,?,?,00000000,?,?,?,?,?,?,?,00000100), ref: 0039D428
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,00000100), ref: 0039D42F
SetFileAttributesA.KERNEL32(?,00000002,?,?,?,?,?,?,?,00000100), ref: 0039D45B
CreateProcessA.KERNEL32(?,003A0264,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0039D4DE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0039D4F4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0039D4FC
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000100), ref: 0039D513
closesocket.WS2_32(?), ref: 0039D56C
Sleep.KERNEL32(000003E8), ref: 0039D577
ExitProcess.KERNEL32 ref: 0039D583
wsprintfA.USER32 ref: 0039D81F

Part of subcall function 0039C65C: send.WS2_32(00000000,?,00000000), ref: 0039C74B

closesocket.WS2_32(?), ref: 0039DAD5

Strings

wtm_c, xrefs: 0039C956
time_cfg, xrefs: 0039C95B, 0039C962, 0039C971, 0039C984
wtm_w, xrefs: 0039C96C
flags_upd, xrefs: 0039CE4A
drivers\, xrefs: 0039D067
.sys, xrefs: 0039D0CC
.dat, xrefs: 0039D0D7, 0039D138, 0039D1AE, 0039D1D4, 0039D28E, 0039D308, 0039D3CF, 0039D441
except_info, xrefs: 0039D8CD, 0039D8D2, 0039D8FB
srv_time, xrefs: 0039CABB
\, xrefs: 0039D39D
X :, xrefs: 0039C927, 0039C93C, 0039C9BE
wtm_r, xrefs: 0039C97F
local_time, xrefs: 0039CACD
@, xrefs: 0039D754
4, xrefs: 0039D9F7
work_srv, xrefs: 0039D607, 0039D60F, 0039D62C
\, xrefs: 0039D3A7
localcfg, xrefs: 0039CA89, 0039CA93, 0039CAC0, 0039CAD2, 0039CE4F, 0039CE6F, 0039D8D3, 0039D8FC
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 0039CC10, 0039CCF3, 0039D975, 0039D98E
lid_file_upd, xrefs: 0039CE6A

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$AttributesCreate$Writeclosesocket$EnvironmentProcessVariablelstrcat$DeleteDirectorySystemwsprintf$ExitObjectPathSingleSleepTempWaitsend
String ID: .dat$.sys$4$@$C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$X :$\$\$drivers\$except_info$flags_upd$lid_file_upd$local_time$localcfg$srv_time$time_cfg$work_srv$wtm_c$wtm_r$wtm_w
API String ID: 562065436-1124047327
Opcode ID: dbb14f96a78b2f962b86f57393ba482b1a99706d84013be14fc92c61593e8e83
Instruction ID: 96f7ddda8afc410ad32f51093a3d1f30e829d80c2c621cce764bc9f80b85a82a
Opcode Fuzzy Hash: dbb14f96a78b2f962b86f57393ba482b1a99706d84013be14fc92c61593e8e83
Instruction Fuzzy Hash: D3B2A272940209AFEF27DFA4DC8AEEEBBBCEB06304F150469F545A7191D7309A45CB50

Function 00399A6B Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 799stringsleepregistryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00399A7F
SetErrorMode.KERNELBASE(00000003), ref: 00399A83
SetUnhandledExceptionFilter.KERNEL32(00396511), ref: 00399A8A

Part of subcall function 0039EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0039EC5E
Part of subcall function 0039EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0039EC72
Part of subcall function 0039EC54: GetTickCount.KERNEL32 ref: 0039EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00399AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00399ABA
GetCommandLineA.KERNEL32 ref: 00399AFD
lstrlenA.KERNEL32(?), ref: 00399B99
ExitProcess.KERNEL32 ref: 00399C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00399CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00399D7A
lstrcatA.KERNEL32(?,?), ref: 00399D8B
lstrcatA.KERNEL32(?,003A070C), ref: 00399D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00399DED
DeleteFileA.KERNEL32(00000022), ref: 00399E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00399E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00399EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00399ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00399F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00399F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00399F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00399FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00399FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00399FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0039A038
lstrcatA.KERNEL32(00000022,003A0A34), ref: 0039A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0039A072
lstrcatA.KERNEL32(00000022,003A0A34), ref: 0039A08D
wsprintfA.USER32 ref: 0039A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0039A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0039A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0039A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0039A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0039A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0039A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0039A1B6
GetCommandLineA.KERNEL32 ref: 0039A1E5

Part of subcall function 003999D2: lstrcpyA.KERNEL32(?,?,00000100,003A22F8,00000000,?,00399E9D,?,00000022,?,?,?,?,?,?,?), ref: 003999DF
Part of subcall function 003999D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00399E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00399A3C
Part of subcall function 003999D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00399E9D,?,00000022,?,?,?), ref: 00399A52

lstrlenA.KERNEL32(?), ref: 0039A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0039A3B7
GetLastError.KERNEL32 ref: 0039A3ED
Sleep.KERNELBASE(000003E8), ref: 0039A400
DeleteFileA.KERNELBASE(003A33D8), ref: 0039A407
CreateThread.KERNELBASE(00000000,00000000,0039405E,00000000,00000000,00000000), ref: 0039A42C
WSAStartup.WS2_32(00001010,?), ref: 0039A43A
CreateThread.KERNELBASE(00000000,00000000,0039877E,00000000,00000000,00000000), ref: 0039A469
Sleep.KERNELBASE(00000BB8), ref: 0039A48A
GetTickCount.KERNEL32 ref: 0039A49F
GetTickCount.KERNEL32 ref: 0039A4B7
Sleep.KERNELBASE(00001A90), ref: 0039A4C3

Strings

", xrefs: 00399EDB
%X%08X, xrefs: 0039A0B0
", xrefs: 0039A078
", xrefs: 0039A189
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 0039A1D9
\, xrefs: 00399D0C
yuzqifwu, xrefs: 0039A389, 0039A397
D, xrefs: 00399F8E
P, xrefs: 00399DAA

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$D$P$\$yuzqifwu
API String ID: 2089075347-3744760464
Opcode ID: 5f8666e67b57d1ba8aae4623c8f58dc0bc062e1b9a09d022a86c526bc6e04d31
Instruction ID: 58580bb01277af12c5db38b19c51ae660bd2b5f95934d15c9225c409f485e52e
Opcode Fuzzy Hash: 5f8666e67b57d1ba8aae4623c8f58dc0bc062e1b9a09d022a86c526bc6e04d31
Instruction Fuzzy Hash: 67529FB1D40259AFDF23DFA4CC89EEE7BBCEB05300F1545AAF509A6141E7709A448F61

Function 0039199C Relevance: 35.1, APIs: 14, Strings: 6, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(123.45.67.89), ref: 003919B1
LoadLibraryA.KERNELBASE(Iphlpapi.dll,?,?,?,?,00000001,00391E9E), ref: 003919BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 003919E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 003919ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 003919F9
GetBestInterface.IPHLPAPI(?,?,?,?,?,?,00000001,00391E9E), ref: 00391A1B
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00391E9E), ref: 00391A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00391E9E), ref: 00391A36
GetAdaptersInfo.IPHLPAPI(00000000,00391E9E,?,?,?,?,00000001,00391E9E), ref: 00391A4A
HeapReAlloc.KERNEL32(?,00000000,00000000,00391E9E,?,?,?,?,00000001,00391E9E), ref: 00391A5A
GetAdaptersInfo.IPHLPAPI(00000000,00391E9E,?,?,?,?,00000001,00391E9E), ref: 00391A6E
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00391E9E), ref: 00391A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00391E9E), ref: 00391AA4

Strings

GetAdaptersInfo, xrefs: 003919DC
GetBestInterface, xrefs: 003919EF
Iphlpapi.dll, xrefs: 003919B7
localcfg, xrefs: 003919A3
GetIfEntry, xrefs: 003919E4
123.45.67.89, xrefs: 003919A6

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AdaptersAllocFreeInfoLibrary$BestInterfaceLoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg
API String ID: 293628436-270533642
Opcode ID: d1559768d52802eec1f86a1e7eab7d6b28ef83170b01104c0097222b5724d20d
Instruction ID: a9252751060b5e0344f1bc9b74073f6c51dc20b045db041a1a722a9dcbbd9636
Opcode Fuzzy Hash: d1559768d52802eec1f86a1e7eab7d6b28ef83170b01104c0097222b5724d20d
Instruction Fuzzy Hash: 26314736E4125AAFCF169FE4CC888BEBBB9EF46341F25056AE501B2110D7308E40DB90

Function 00397A95 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00397ABA
GetUserNameA.ADVAPI32(?,?), ref: 00397ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,003A070C,?,?,?), ref: 00397B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00397B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00397B59
EqualSid.ADVAPI32(?,00000022), ref: 00397B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00397B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00397B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00397B9C
RegSetKeySecurity.KERNELBASE(00000000,00000001,00000000), ref: 00397BAB
LocalFree.KERNEL32(00000000), ref: 00397BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00397FC9,?,00000000), ref: 00397BCE

Strings

D, xrefs: 00397B0C
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 00397CE2, 00397D0F, 00397D23, 00397D24

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$D
API String ID: 2976863881-493086155
Opcode ID: 93c52175b265c2a65b7b833018675e9e442dc52467f7ca284db61d4b189f77ac
Instruction ID: 21ddcc69f01bf43dfb83d8f6c386ae3ad5e18b50cf44c4e6aa294439b97a27ba
Opcode Fuzzy Hash: 93c52175b265c2a65b7b833018675e9e442dc52467f7ca284db61d4b189f77ac
Instruction Fuzzy Hash: 7BA12772A04219ABEF16DFA4DC88FEEBBBDFF49700F054069E505E2190E7359A45CB60

Function 00397809 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0039782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00397866
GetLengthSid.ADVAPI32(?), ref: 00397878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0039789A
GetSecurityDescriptorOwner.ADVAPI32(?,00397F63,?), ref: 003978B8
EqualSid.ADVAPI32(?,00397F63), ref: 003978D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 003978E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 003978F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00397901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00397910
LocalFree.KERNEL32(00000000), ref: 00397917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00397933
GetAce.ADVAPI32(?,00000000,?), ref: 00397963
EqualSid.ADVAPI32(?,00397F63), ref: 0039798A
DeleteAce.ADVAPI32(?,00000000), ref: 003979A3
EqualSid.ADVAPI32(?,00397F63), ref: 003979C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00397A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00397A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00397A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00397A79
LocalFree.KERNEL32(00000000), ref: 00397A87

Strings

D, xrefs: 0039785C

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 130c90072749249fcc0fac1f306d832a33528c5c38f76cae19d07b7c11ab388b
Instruction ID: 13acd9f2e20a53bc0146f0f7124136e96cf0fa1bd404323145c1c545af851fa5
Opcode Fuzzy Hash: 130c90072749249fcc0fac1f306d832a33528c5c38f76cae19d07b7c11ab388b
Instruction Fuzzy Hash: 2081287191421AABDF22CFA4CD84FEEBBBCFF09740F15416AE505E2290D7359A41CBA1

Function 00398328 Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000103,003A0750,?,?,00000000,localcfg,00000000), ref: 003983F3
RegQueryValueExA.KERNELBASE(003A0750,?,00000000,?,00398893,?,?,?,00000000,00000103,003A0750,?,?,00000000,localcfg,00000000), ref: 00398414
RegSetValueExA.KERNELBASE(003A0750,?,00000000,00000004,00398893,00000004,?,?,00000000,00000103,003A0750,?,?,00000000,localcfg,00000000), ref: 00398441
RegCloseKey.ADVAPI32(003A0750,?,?,00000000,00000103,003A0750,?,?,00000000,localcfg,00000000), ref: 0039844A

Strings

localcfg, xrefs: 00398348
C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 003985C8, 003985D5, 003985E5

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe$localcfg
API String ID: 237177642-3478224671
Opcode ID: 6038392cf7b28b50e25f8b587b135abe2bd2f75a2ad144ecdb9f37a59be65898
Instruction ID: 3e902f436b0d562ae8d11392898f85c7120afa4431c5ffc1a99fa4cf10e34eff
Opcode Fuzzy Hash: 6038392cf7b28b50e25f8b587b135abe2bd2f75a2ad144ecdb9f37a59be65898
Instruction Fuzzy Hash: 6AC190B2D40209BEEF13EFA4DC85EEF7BBCEB46300F154465F605A6051EA709E848B61

Function 00391D96 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32 ref: 00391DC6
GetSystemInfo.KERNELBASE(?), ref: 00391DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00391E03
GetProcAddress.KERNEL32(00000000), ref: 00391E0A
GetCurrentProcess.KERNEL32(?), ref: 00391E1B
GetTickCount.KERNEL32 ref: 00391FC9

Part of subcall function 00391BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00391C15

Strings

loader_id, xrefs: 00391F4B, 00391F6B
flags_upd, xrefs: 00391E3E, 00391E43, 00391E7C
net_type, xrefs: 00391E87
IsWow64Process, xrefs: 00391DF2
localcfg, xrefs: 00391E2A, 00391E31, 00391E44, 00391E7D, 00391E8C, 00391EB2, 00391ED1, 00391EE7, 00391EFF, 00391F1C, 00391F34, 00391F50, 00391F70
start_srv, xrefs: 00391E6C
born_date, xrefs: 00391EAD, 00391ECC
lid_file_upd, xrefs: 00391E25
kernel32, xrefs: 00391DF7
hi_id, xrefs: 00391F16, 00391F1B, 00391F33
work_srv, xrefs: 00391E5E

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 9d6ffb8321dcede3feb8a15ef169449e999527eb7dbd7589d2542c985e1be97b
Instruction ID: 36d1809c5f8fd7f8eb4ca58bfe683d50c080e9b1d20df690f7b997039ceb9308
Opcode Fuzzy Hash: 9d6ffb8321dcede3feb8a15ef169449e999527eb7dbd7589d2542c985e1be97b
Instruction Fuzzy Hash: FF5125B09043456FEB36EF758C86F67BAECEF46704F04091CF58696282E774A904C7A1

Function 003973FF Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,76230F10,00000000), ref: 00397472
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00000101,?,?,?,?,?,?,?,76230F10,00000000), ref: 003974F0
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,76230F10,00000000), ref: 00397528
___ascii_stricmp.LIBCMT ref: 0039764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,76230F10,00000000), ref: 003976E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00397706
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 00397717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,76230F10,00000000), ref: 00397745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,76230F10,00000000), ref: 003977EF

Part of subcall function 0039F1A5: lstrlenA.KERNEL32(000000C8,000000E4,003A22F8,000000C8,00397150,?), ref: 0039F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0039778F
RegCloseKey.KERNELBASE(?), ref: 003977E6

Strings

", xrefs: 00397599

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "
API String ID: 3433985886-123907689
Opcode ID: f35494994152cf0d84539d8432929a41d0d0c2a9627f26f60e10b0ce39c73003
Instruction ID: 984d055457387c5b19c050dd55183c021162930a982185314451e98126148751
Opcode Fuzzy Hash: f35494994152cf0d84539d8432929a41d0d0c2a9627f26f60e10b0ce39c73003
Instruction Fuzzy Hash: 10C18E72914209AFEF23DBA4DC45BEEBBBDEF45310F1500A5F504EA191EA31DE448B60

Function 0039675C Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0039677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0039679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 003967B0
SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 003967BF
GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 003967D3
ReadFile.KERNELBASE(000000FF,?,00000040,00398244,00000000,?,76230F10,00000000), ref: 00396807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0039681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0039683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0039685C
ReadFile.KERNEL32(000000FF,?,00000028,00398244,00000000,?,76230F10,00000000), ref: 0039688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,76230F10,00000000), ref: 00396906
ReadFile.KERNEL32(000000FF,?,00000000,00398244,00000000,?,76230F10,00000000), ref: 0039691C
CloseHandle.KERNELBASE(000000FF,?,76230F10,00000000), ref: 00396971

Part of subcall function 0039EC2E: GetProcessHeap.KERNEL32(00000000,'9,00000000,0039EA27,00000000), ref: 0039EC41
Part of subcall function 0039EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0039EC48

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 2622201749-0
Opcode ID: 952f2bace849d2f3c756d580176f12b987342e97328ea1a27c69fa3b358734ed
Instruction ID: 4cde3309cbb7d6a8b41980fcd4819754dca8ba5f004aa3595930a60f269cc7d9
Opcode Fuzzy Hash: 952f2bace849d2f3c756d580176f12b987342e97328ea1a27c69fa3b358734ed
Instruction Fuzzy Hash: D0714771C0521DEFDF12DFA4CC81AEEBBB8FB04314F10456AE915A6290E7309E92DB60

Function 0039F315 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htons.WS2_32(0039CA1D), ref: 0039F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0039F367
closesocket.WS2_32(00000000), ref: 0039F375

Strings

time_cfg, xrefs: 0039F323

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: time_cfg
API String ID: 311057483-2401304539
Opcode ID: aa80ad85c37498f144f86053f95f01255461a90f5e81f5f8904b09545c837bb2
Instruction ID: f2cb1a64f5293e66503c0c3bea487ac43ad56d30341bb285ba33708301990852
Opcode Fuzzy Hash: aa80ad85c37498f144f86053f95f01255461a90f5e81f5f8904b09545c837bb2
Instruction Fuzzy Hash: 4B317A76900218AFDB12DFA5DC89AEF7BBCEF89310F104566F915E3151E7709A418BA0

Function 0039405E Relevance: 16.7, APIs: 11, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00394070
ExitProcess.KERNEL32 ref: 00394121

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID:
API String ID: 2404124870-0
Opcode ID: 12be798f8fdfb69ca9de172491d444926ca88dcd94043a03ceb8b4ed9fbc240c
Instruction ID: 0a782d981b3326e39dc92b8059adcb0e3d0c2850638a71aa662ddb2313b921bf
Opcode Fuzzy Hash: 12be798f8fdfb69ca9de172491d444926ca88dcd94043a03ceb8b4ed9fbc240c
Instruction Fuzzy Hash: 1C518EB1D40219BBEF22ABA08C86FBF7B7CEB15714F110065F615AA190E7318E42D7A1

Function 00392D21 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00392F01,?,003920FF,003A2000), ref: 00392D3A
LoadLibraryA.KERNEL32(?), ref: 00392D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00392D61
DnsQuery_A.DNSAPI(00000000,0000000F,00000000,00000000,?,00000000), ref: 00392D77
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00392D99
HeapAlloc.KERNEL32(00000000), ref: 00392DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00392DCB

Strings

DnsQuery_A, xrefs: 00392D5B
dnsapi.dll, xrefs: 00392D29

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcessQuery_lstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 233223969-3847274415
Opcode ID: be3b9000530ee3e764c6672a9fff76a10531f2be2ddab70585ee049158a49134
Instruction ID: 3a3042daada7da703cb097d1b9d451abc48f265436b9eabfedfeeb651ffd7b5e
Opcode Fuzzy Hash: be3b9000530ee3e764c6672a9fff76a10531f2be2ddab70585ee049158a49134
Instruction Fuzzy Hash: 1D214A75901A26BBCF239B64DC44AAFBBBCEF09B50F114011F915A7150D770AA8587D0

Function 003980C9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 0039815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0039A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00398187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0039A45F,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 003981BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,76230F10,00000000), ref: 00398210

Part of subcall function 0039675C: SetFileAttributesA.KERNEL32(?,00000080,?,76230F10,00000000), ref: 0039677E
Part of subcall function 0039675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,76230F10,00000000), ref: 0039679A
Part of subcall function 0039675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,76230F10,00000000), ref: 003967B0
Part of subcall function 0039675C: SetFileAttributesA.KERNEL32(?,00000002,?,76230F10,00000000), ref: 003967BF
Part of subcall function 0039675C: GetFileSize.KERNEL32(000000FF,00000000,?,76230F10,00000000), ref: 003967D3
Part of subcall function 0039675C: ReadFile.KERNELBASE(000000FF,?,00000040,00398244,00000000,?,76230F10,00000000), ref: 00396807
Part of subcall function 0039675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0039681F
Part of subcall function 0039675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,76230F10,00000000), ref: 0039683E
Part of subcall function 0039675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,76230F10,00000000), ref: 0039685C

Part of subcall function 0039EC2E: GetProcessHeap.KERNEL32(00000000,'9,00000000,0039EA27,00000000), ref: 0039EC41
Part of subcall function 0039EC2E: RtlFreeHeap.NTDLL(00000000), ref: 0039EC48

Strings

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe, xrefs: 00398225, 0039823A

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe
API String ID: 124786226-729601064
Opcode ID: 036ae5541718df06387278a41624d0efe079ddba08c7c1d510e7562570d299be
Instruction ID: 908578d0d88c0e3c40512b8727b15939c74b938fb7f20b09ac8138acfd75fa70
Opcode Fuzzy Hash: 036ae5541718df06387278a41624d0efe079ddba08c7c1d510e7562570d299be
Instruction Fuzzy Hash: 2441AEB2901209BFEF17EFA4DD81DBFB77CEB46300F05086AF541A6111EA309E448B20

Function 00391AC3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00391AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00391AE9
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00391B20

Strings

Iphlpapi.dll, xrefs: 00391ACC
GetAdaptersAddresses, xrefs: 00391AE3

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 3646706440-1087626847
Opcode ID: 0796e5d02a647c7d653526e965cebe074eab5af946bc8df3ea8e3bfb71815f2f
Instruction ID: 71d0899245eeefcbefc8c0e38596ff3a5f51e62d7aad15032f721476b142d91d
Opcode Fuzzy Hash: 0796e5d02a647c7d653526e965cebe074eab5af946bc8df3ea8e3bfb71815f2f
Instruction Fuzzy Hash: 5011D371E02228AFCF17DBA4CC858EEFBBBEB44B50B154056E009B7150E7304E40CB90

Function 0039E3CA Relevance: 7.6, APIs: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,0039E5F2,00000000,00020119,0039E5F2,003A22F8), ref: 0039E3E6
RegQueryValueExA.ADVAPI32(0039E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0039E44E
RegQueryValueExA.ADVAPI32(0039E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0039E482
RegQueryValueExA.ADVAPI32(0039E5F2,?,00000000,?,80000001,?), ref: 0039E4CF
RegCloseKey.ADVAPI32(0039E5F2,?,?,?,?,000000C8,000000E4), ref: 0039E520

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7435f3549f851e63aac5bf37db24a1b520e8b78647280b484ab90a2f3566da6a
Instruction ID: eabe1a50d7b711e8ec9510db720851b9cccec877213b5f7f508ee6248a3399ad
Opcode Fuzzy Hash: 7435f3549f851e63aac5bf37db24a1b520e8b78647280b484ab90a2f3566da6a
Instruction Fuzzy Hash: 844104B2D00219BFEF12DF95DC85DEEBBBDEB09344F154466FA10A6160E3319A158BA0

Function 0039F26D Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0039F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0039F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0039F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0039F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0039F2FD

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: f2f1a642763f4a40b4b32a0f98e02560eddc539df2ea09ec6368d46f2638ebb4
Instruction ID: b20f2724a2e5d8385bf2c1205bc24f87ffc7d84974957f809bd248f4d35c5228
Opcode Fuzzy Hash: f2f1a642763f4a40b4b32a0f98e02560eddc539df2ea09ec6368d46f2638ebb4
Instruction Fuzzy Hash: 72110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Function 00391BDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00391AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00391AD4
Part of subcall function 00391AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00391AE9
Part of subcall function 00391AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00391B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00391C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00391C51

Strings

localcfg, xrefs: 00391BE7
hi_id, xrefs: 00391BE5

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2794401326-2393279970
Opcode ID: 2410e95c084e316a2cd3a23cf42844dda0bb76c4634762553b4e6fdefacd99ef
Instruction ID: cdae7bc3b8894bfbaac312950efb0c0ea43c9294c3369ab9cb62f36b2a37b92e
Opcode Fuzzy Hash: 2410e95c084e316a2cd3a23cf42844dda0bb76c4634762553b4e6fdefacd99ef
Instruction Fuzzy Hash: C2018072A44119BBEF11DAE8C8C59EFBABCAB44745F110475E602F2140D2309E448AA0

Function 00391B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00391AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00391AD4
Part of subcall function 00391AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00391AE9
Part of subcall function 00391AC3: GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,?,00000001), ref: 00391B20

GetComputerNameA.KERNEL32(?,0000000F), ref: 00391BA3
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,00391EFD,00000000,00000000,00000000,00000000), ref: 00391BB8

Strings

localcfg, xrefs: 00391B7B

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AdaptersAddressAddressesComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2794401326-1857712256
Opcode ID: 53e10c3bc91e3d29c45f76faf78191d5d7cac790f3131a7d66aca38400b9d62b
Instruction ID: 4ac34213a37106e59dcf63dfe8841c94e0f4bab8f70912aed9a0bb9e855613e9
Opcode Fuzzy Hash: 53e10c3bc91e3d29c45f76faf78191d5d7cac790f3131a7d66aca38400b9d62b
Instruction Fuzzy Hash: 0F014BB7E00108BFEB029BE9CC819EFFABDAB48750F150162A601F7151D670AE084AA0

Function 00392684 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000002), ref: 00392693
gethostbyname.WS2_32(00000002), ref: 0039269F

Strings

time_cfg, xrefs: 00392684

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg
API String ID: 1594361348-2401304539
Opcode ID: 94d133a06be48e09fff65c8d252aa1710a92785805a50a8e743a74c109ec2df1
Instruction ID: 1d4a4889772e9bd322e4fdb618ac2d7aa695abf1316d81690d6b534d146ce411
Opcode Fuzzy Hash: 94d133a06be48e09fff65c8d252aa1710a92785805a50a8e743a74c109ec2df1
Instruction Fuzzy Hash: 73E0C230204911AFCF128B28F848BC677E8EF16330F024580F440C31A0C770DC808780

Function 0039EC2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0039EBA0: GetProcessHeap.KERNEL32(00000000,00000000,0039EC0A,00000000,80000001,?,0039DB55,7FFF0001), ref: 0039EBAD
Part of subcall function 0039EBA0: HeapSize.KERNEL32(00000000,?,0039DB55,7FFF0001), ref: 0039EBB4

GetProcessHeap.KERNEL32(00000000,'9,00000000,0039EA27,00000000), ref: 0039EC41
RtlFreeHeap.NTDLL(00000000), ref: 0039EC48

Strings

'9, xrefs: 0039EC2F, 0039EC37, 0039EC3E

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeSize
String ID: '9
API String ID: 1305341483-4222858423
Opcode ID: b0026bcd81dcaf95a58d4fe8afbe1f32bc6d9237d2dd4aff047ebab4f0cf8a9d
Instruction ID: 09c10fb0fefd5cf6bfefe08ae52ef12400df6e2809f3d5744ed76c1b129e1402
Opcode Fuzzy Hash: b0026bcd81dcaf95a58d4fe8afbe1f32bc6d9237d2dd4aff047ebab4f0cf8a9d
Instruction Fuzzy Hash: 0AC01232506230ABD9576750BC0DFDB6B5C9F47711F0A4409F4056A0508760584146E1

Function 0039E52E Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039DD05: GetTickCount.KERNEL32 ref: 0039DD0F
Part of subcall function 0039DD05: InterlockedExchange.KERNEL32(003A36B4,00000001), ref: 0039DD44
Part of subcall function 0039DD05: GetCurrentThreadId.KERNEL32 ref: 0039DD53

GetFileSize.KERNEL32(00000000,00000000,?,76230F10,?,00000000,?,0039A445), ref: 0039E558
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,76230F10,?,00000000,?,0039A445), ref: 0039E583
CloseHandle.KERNEL32(00000000,?,76230F10,?,00000000,?,0039A445), ref: 0039E5B2

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID:
API String ID: 3683885500-0
Opcode ID: 117443ab15cd31bc622aca69d42ae725da09811f6af24d2ce43fddf44ac8497d
Instruction ID: 611b825c92b4bee6339e4331b4d8e96eab9be0c94f043367570e21568aacc30e
Opcode Fuzzy Hash: 117443ab15cd31bc622aca69d42ae725da09811f6af24d2ce43fddf44ac8497d
Instruction Fuzzy Hash: 4F2138B2A403003AEA27BB229C4BFAB7A1CDF57750F010514FE09A91E3F951D90082F1

Function 0039877E Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 003988A5

Part of subcall function 0039F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0039E342,00000000,75B4EA50,80000001,00000000,0039E513,?,00000000,00000000,?,000000E4), ref: 0039F089
Part of subcall function 0039F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0039E342,00000000,75B4EA50,80000001,00000000,0039E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0039F093

Strings

rresolv, xrefs: 003987F6, 0039885C
localcfg, xrefs: 003987CA, 003987CF, 003987FB, 00398835, 00398861

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Sleep
String ID: localcfg$rresolv
API String ID: 1561729337-486471987
Opcode ID: ac61ab6d077d5f790795f0f783f86d0993366db8aede86ab261ef3f030053a89
Instruction ID: f009147a571bb909db8b2c52d721c4fce94bb2d7511de2e19d65510a8a907ef2
Opcode Fuzzy Hash: ac61ab6d077d5f790795f0f783f86d0993366db8aede86ab261ef3f030053a89
Instruction Fuzzy Hash: F221A53164C3016EFB17FBA96C87BAB3AACDB47710F910419FA04DA1C2EEA1954081B2

Function 00394000 Relevance: 4.5, APIs: 3, Instructions: 35sleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,003A22F8,003942B6,00000000,00000001,003A22F8,00000000,?,003998FD), ref: 00394021
GetLastError.KERNEL32(?,003998FD,00000001,00000100,003A22F8,0039A3C7), ref: 0039402C
Sleep.KERNEL32(000001F4,?,003998FD,00000001,00000100,003A22F8,0039A3C7), ref: 00394046

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID:
API String ID: 408151869-0
Opcode ID: 5aaa21cd1099ab44975ee8a266d0a9f463b94ed463bf4812d24565340f88b18d
Instruction ID: ad7115165144fb9f56985d0578ae7450f15bc5ea44c54c537e5c78d79880edd0
Opcode Fuzzy Hash: 5aaa21cd1099ab44975ee8a266d0a9f463b94ed463bf4812d24565340f88b18d
Instruction Fuzzy Hash: B9F0A7712441016ADF374B25AC49F1AB365DB82720F264B24F3B5E21E0C63048879B14

Function 0039DB67 Relevance: 4.5, APIs: 3, Instructions: 32filestringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0039DC19,?,00000104), ref: 0039DB7F
lstrcpyA.KERNEL32(?,003A28F8), ref: 0039DBA4
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000080,00000000), ref: 0039DBC2

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CreateEnvironmentFileVariablelstrcpy
String ID:
API String ID: 2536392590-0
Opcode ID: e099533f5ac410c8c6535dd8b20752d4ca81ff3d6d28a9c35207bd0087e405a6
Instruction ID: a6b8f5f71aacc377c1d588e6e93f56e06324f214651b29f0cab8fb9b16f58c32
Opcode Fuzzy Hash: e099533f5ac410c8c6535dd8b20752d4ca81ff3d6d28a9c35207bd0087e405a6
Instruction Fuzzy Hash: 08F0B470100209ABEF12DF64DD4AFD93B6DBB10308F114194BB55A40D0D7F2D545CF10

Function 0039EC54 Relevance: 4.5, APIs: 3, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0039EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0039EC72
GetTickCount.KERNEL32 ref: 0039EC78

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 1d3b788d7906f5b907045f2ee2abd71eba2a833b8e6faf5ceef32d15f1df1c85
Instruction ID: e0d71cccb4339f4783a691ad217988f04f7284db8ac937eee0224e89b50c5660
Opcode Fuzzy Hash: 1d3b788d7906f5b907045f2ee2abd71eba2a833b8e6faf5ceef32d15f1df1c85
Instruction Fuzzy Hash: E7E0BFF5810104BFE706EBB0DC4EEBB77BCFB09314F500650B911D60A0DA709A048B60

Function 003930B5 Relevance: 3.0, APIs: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 003930D8
gethostbyname.WS2_32(?), ref: 003930E2

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 5189ee1e774955fbfe51da1ecadae880cf5bdee8c6f89f64c2dcf85ee0d9bbf5
Instruction ID: 7c7182f246f30e9bd119bb52652cb6a993325272dc95cdec31cdcb0cdb4a75f6
Opcode Fuzzy Hash: 5189ee1e774955fbfe51da1ecadae880cf5bdee8c6f89f64c2dcf85ee0d9bbf5
Instruction Fuzzy Hash: 1CE09272900219ABCF00EBA8EC89FCA77ECFF05308F080461F946E7250EA34E90487A0

Function 0039EBED Relevance: 3.0, APIs: 2, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,7FFF0001,80000001,?,0039DB55,7FFF0001), ref: 0039EC13
RtlReAllocateHeap.NTDLL(00000000,?,0039DB55,7FFF0001), ref: 0039EC1A

Part of subcall function 0039EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0039EBFE,7FFF0001,?,0039DB55,7FFF0001), ref: 0039EBD3
Part of subcall function 0039EBCC: RtlAllocateHeap.NTDLL(00000000,?,0039DB55,7FFF0001), ref: 0039EBDA

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 86140f0240d94e56d88fab2aff432197ed77de3de41b377fee86e8d0cb0a98b3
Instruction ID: 4dfad51891a1e5b0344bfc2aa011fb4e7c178e6c93b762167fc4efbc0129bb9f
Opcode Fuzzy Hash: 86140f0240d94e56d88fab2aff432197ed77de3de41b377fee86e8d0cb0a98b3
Instruction Fuzzy Hash: 94E01A36108218BADF066B94EC09AE93B59EB05362F108015FA0D89561CB328990DA94

Function 0039EBCC Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0039EBFE,7FFF0001,?,0039DB55,7FFF0001), ref: 0039EBD3
RtlAllocateHeap.NTDLL(00000000,?,0039DB55,7FFF0001), ref: 0039EBDA

Part of subcall function 0039EB74: GetProcessHeap.KERNEL32(00000000,00000000,0039EC28,00000000,?,0039DB55,7FFF0001), ref: 0039EB81
Part of subcall function 0039EB74: HeapSize.KERNEL32(00000000,?,0039DB55,7FFF0001), ref: 0039EB88

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: a4cc7078b9de69fcafd2990802b6d64414b15f4bb0b6c8bab921917e8c470206
Instruction ID: 4650248986d8a3b7784eb76c67c785e22fb3c6fa98dd95aa9699d00b0f566cf5
Opcode Fuzzy Hash: a4cc7078b9de69fcafd2990802b6d64414b15f4bb0b6c8bab921917e8c470206
Instruction Fuzzy Hash: EEC08C3A2082206BCA0727A8BC0CEDE3E9CEF0B3A2F044004F609C6260CB304C4087A2

Function 0039F43E Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(000000C8,?,00000000,0039CA44), ref: 0039F476

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 906b5caf40ec68007fa3c723fed68fdd71d14e790398368db2dcefbd18208779
Instruction ID: ddc9f3ae5658c77c99fe01adf4072e97abe22fce828238513068b24213cd6f24
Opcode Fuzzy Hash: 906b5caf40ec68007fa3c723fed68fdd71d14e790398368db2dcefbd18208779
Instruction Fuzzy Hash: E6F01C7220155AAF9F129E9EDC84CAB3BAEFB89350B050522FA14D7110D631E8218BA0

Function 00391978 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00000000), ref: 00391992

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 69de287d24503e2767df8473c37ff68d4ee906953f1e537266d34ed652205260
Instruction ID: 64d77d0221d88c5444bda99a78d373cd9a3b5ac93a91cb4f2ca2cdf59b78c861
Opcode Fuzzy Hash: 69de287d24503e2767df8473c37ff68d4ee906953f1e537266d34ed652205260
Instruction Fuzzy Hash: 2DD012261486326A96162759BC055BFAB9CDF45762B11842AFC48D4150D735CC4183D6

Function 0039DD84 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(80000011,00000000), ref: 0039DDB5

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 03b9c3440e783d47a30d14cf77a270142c92602d90fc5c696ff158ac8f515302
Instruction ID: 2bff3854164ee628113de829572af09e1b2f45f11f9be7018b74a78ab2a7ef36
Opcode Fuzzy Hash: 03b9c3440e783d47a30d14cf77a270142c92602d90fc5c696ff158ac8f515302
Instruction Fuzzy Hash: 6AF08C35200242CFCF22CE389885656B3E8EF86365F16483EE155D2150D730DC45CB11

Non-executed Functions

Function 0039637C Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00399816,EntryPoint), ref: 0039638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00399816,EntryPoint), ref: 003963A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 003963CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 003963EB

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 4a9898dc84e88ad05d03d714ce34c7984193698952c504c756ec13ab3940ea5b
Instruction ID: 8576269374da29543f4ee86fc2de00abede24519a29e40afe39243fb614159e2
Opcode Fuzzy Hash: 4a9898dc84e88ad05d03d714ce34c7984193698952c504c756ec13ab3940ea5b
Instruction Fuzzy Hash: 341133B5601219BFEF169F65DC4AF9B3BACEB057A5F114024F905E7290D671DD008AA0

Function 00391000 Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00391839,00399646), ref: 00391012
GetProcAddress.KERNEL32(00000000,RtlExpandEnvironmentStrings_U), ref: 003910C2
GetProcAddress.KERNEL32(00000000,RtlSetLastWin32Error), ref: 003910E1
GetProcAddress.KERNEL32(00000000,NtTerminateProcess), ref: 00391101
GetProcAddress.KERNEL32(00000000,RtlFreeSid), ref: 00391121
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00391140
GetProcAddress.KERNEL32(00000000,NtSetInformationThread), ref: 00391160
GetProcAddress.KERNEL32(00000000,NtSetInformationToken), ref: 00391180
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0039119F
GetProcAddress.KERNEL32(00000000,NtClose), ref: 003911BF
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 003911DF
GetProcAddress.KERNEL32(00000000,NtDuplicateToken), ref: 003911FE
GetProcAddress.KERNEL32(00000000,RtlAllocateAndInitializeSid), ref: 0039121A

Strings

NtFilterToken, xrefs: 0039122B
RtlLengthSid, xrefs: 00391246
NtSetInformationThread, xrefs: 00391155
ntdll.dll, xrefs: 0039100D
NtOpenProcessToken, xrefs: 003911D4
RtlFreeSid, xrefs: 00391116
NtSetInformationToken, xrefs: 00391175
NtTerminateProcess, xrefs: 003910F6
NtClose, xrefs: 003911B4
RtlAllocateAndInitializeSid, xrefs: 0039120F
NtQueryInformationToken, xrefs: 00391262
NtDuplicateToken, xrefs: 003911F3
RtlExpandEnvironmentStrings_U, xrefs: 003910BC
RtlSetLastWin32Error, xrefs: 003910D6
RtlInitUnicodeString, xrefs: 00391135
RtlNtStatusToDosError, xrefs: 00391194

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 89f4a95ab83c99175b6e52d2753399864504ccb960f2d745df883de420367a86
Instruction ID: a913f291cb2e508b034bc39aadfc319de521b775e8f699cffa3e63c54363e89a
Opcode Fuzzy Hash: 89f4a95ab83c99175b6e52d2753399864504ccb960f2d745df883de420367a86
Instruction Fuzzy Hash: B5511D72646603AADB579B6CAC4479376BCA74A364F15031EF520E22E0D7F0DAC2CB52

Function 0039B211 Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0039B2B3
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0039B2C2
FileTimeToSystemTime.KERNEL32(?,?), ref: 0039B2D0
SystemTimeToFileTime.KERNEL32(?,?), ref: 0039B2E1
FileTimeToSystemTime.KERNEL32(?,?), ref: 0039B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0039B329
wsprintfA.USER32 ref: 0039B3B7

Strings

Wed, xrefs: 0039B23A
Fri, xrefs: 0039B248
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0039B3AF
Sun, xrefs: 0039B225
Tue, xrefs: 0039B233
Sat, xrefs: 0039B24F
Nov, xrefs: 0039B29C
Apr, xrefs: 0039B26B
Sep, xrefs: 0039B28E
Mon, xrefs: 0039B22C
Dec, xrefs: 0039B2A3
May, xrefs: 0039B272
Mar, xrefs: 0039B264
Jul, xrefs: 0039B280
Feb, xrefs: 0039B25D
Aug, xrefs: 0039B287
Thu, xrefs: 0039B241
Jan, xrefs: 0039B256
Jun, xrefs: 0039B279
Oct, xrefs: 0039B295

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: ef26b06fe1df74a57b9cda360add4481d18043b9d7e098ac30d5083fa96b403a
Instruction ID: ccd1c1e4b2b2dc003b87c2b712414c14596daddaac246302871c07895c780fcb
Opcode Fuzzy Hash: ef26b06fe1df74a57b9cda360add4481d18043b9d7e098ac30d5083fa96b403a
Instruction Fuzzy Hash: E8514CB9D0021CAACF1ADFD5D9858EEFBB9FF4A314F104129E601BA150D3745A89CB90

Function 00396511 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0039654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0039655C
htonl.WS2_32(?), ref: 00396578
htonl.WS2_32(?), ref: 00396587
wsprintfA.USER32 ref: 0039659B
wsprintfA.USER32 ref: 003965DC
wsprintfA.USER32 ref: 00396671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0039668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00396696
wsprintfA.USER32 ref: 003966B0
wsprintfA.USER32 ref: 003966E7
wsprintfA.USER32 ref: 003966FF
wsprintfA.USER32 ref: 0039671F
ExitProcess.KERNEL32 ref: 00396755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00396547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0039666B
plgs:, xrefs: 003966AA
except_info, xrefs: 00396728
localcfg, xrefs: 0039672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 003965D6
12:08:32, xrefs: 00396535
%d=%p, xrefs: 003966F9
Jan 13 2018, xrefs: 0039653A
va=%08X%08X uef=%p, xrefs: 00396595

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: 52f2ccd804e68e8425e08412a5c673e143dd1942874b7e28671cfe25eee6def9
Instruction ID: 317afc773ae786f42a77b0f23415bb57d670692dcd58d69b5768755d77e3a1ac
Opcode Fuzzy Hash: 52f2ccd804e68e8425e08412a5c673e143dd1942874b7e28671cfe25eee6def9
Instruction Fuzzy Hash: 33615C72A40208AFDF669FB4DC45FEA77E9FF09300F148069F969D2161EA71A950CF50

Function 0039A7C1 Relevance: 40.5, APIs: 8, Strings: 15, Instructions: 299networkstringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0039A7FB
lstrlenA.KERNEL32(?), ref: 0039A87E
send.WS2_32(?,?,00000000,00000000), ref: 0039A893
wsprintfA.USER32 ref: 0039A8AF
send.WS2_32(?,.,00000005,00000000), ref: 0039A8D2
wsprintfA.USER32 ref: 0039A8E2
recv.WS2_32(?,?,000003F6,00000000), ref: 0039A97C
wsprintfA.USER32 ref: 0039A9B9

Strings

ehlo %s, xrefs: 0039A7F5
, xrefs: 0039A94C
quit, xrefs: 0039A86C
Too small respons, xrefs: 0039A9C9
mail from:<%s>, xrefs: 0039A848
Too big smtp respons (%d bytes), xrefs: 0039A9B1
helo %s, xrefs: 0039A803
data, xrefs: 0039A85E
AUTH LOGIN, xrefs: 0039A80C
localcfg, xrefs: 0039AB0B
Error sending command (sent = %d/%d), xrefs: 0039A8A7, 0039A8DA
rcpt to:<%s>, xrefs: 0039A855
Incorrect respons, xrefs: 0039AB39
ESMTP, xrefs: 0039AA38
., xrefs: 0039A8CA

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$ $AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-4264063882
Opcode ID: b704bfc47909c1c7276f258a8a9eec5d80cfbbf8e7c01d6b69b487d5e45c9983
Instruction ID: e75733263c511b3c017712ad077d452d59a0acc479e7d6520ce8b817aea20d45
Opcode Fuzzy Hash: b704bfc47909c1c7276f258a8a9eec5d80cfbbf8e7c01d6b69b487d5e45c9983
Instruction Fuzzy Hash: F8A13772A48719BBDF278B58DC86FAE7B6DEB01304F250226F901A6090DB719D4887D3

Function 00391280 Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0039139A
lstrlenW.KERNEL32(-00000003), ref: 00391571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00391316
<, xrefs: 00391378
@, xrefs: 00391380
wusa.exe, xrefs: 00391388
uac, xrefs: 00391628
D, xrefs: 003915C6
, xrefs: 00391462
useless, xrefs: 0039161E

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 295c44f51fb873c190d744424e8b1855948bc78846fa20155d44cb3fe7aeba07
Instruction ID: f35671905ec6a6244660015537c8bd67096fbb3519b82db1ae5c3dae232fc240
Opcode Fuzzy Hash: 295c44f51fb873c190d744424e8b1855948bc78846fa20155d44cb3fe7aeba07
Instruction Fuzzy Hash: 53F1BFB55083429FDB22DF64C888BABB7E8FB8A300F01491DF596E7290D7B4D944CB52

Function 00392A62 Relevance: 27.2, APIs: 18, Instructions: 194networkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,7622F380), ref: 00392A83
HeapAlloc.KERNEL32(00000000,?,7622F380), ref: 00392A86
socket.WS2_32(00000002,00000002,00000011), ref: 00392AA0
htons.WS2_32(00000000), ref: 00392ADB
select.WS2_32 ref: 00392B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00392B4A
htons.WS2_32(?), ref: 00392B71
htons.WS2_32(?), ref: 00392B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00392BFB

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID:
API String ID: 1639031587-0
Opcode ID: d2900d95a1665fd50756176988675d4a805423431ac50d2b161a033eccd8a81d
Instruction ID: 45c52e471c2b62316a538b51f68494e0dbb6525416635a7d6d89c41137266015
Opcode Fuzzy Hash: d2900d95a1665fd50756176988675d4a805423431ac50d2b161a033eccd8a81d
Instruction Fuzzy Hash: E461B0B5904B05ABCB269F65DC48B6FBBECFB89751F010809F94997250D7B0EC448FA2

Function 0039704C Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 332registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000101,76230F10,?,76230F10,00000000), ref: 003970C2
RegEnumValueA.ADVAPI32(76230F10,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,76230F10,00000000), ref: 0039719E
RegCloseKey.ADVAPI32(76230F10,?,76230F10,00000000), ref: 003971B2
RegCloseKey.ADVAPI32(76230F10), ref: 00397208
RegCloseKey.ADVAPI32(76230F10), ref: 00397291
___ascii_stricmp.LIBCMT ref: 003972C2
RegCloseKey.ADVAPI32(76230F10), ref: 003972D0
RegCloseKey.ADVAPI32(76230F10), ref: 00397314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0039738D
RegCloseKey.ADVAPI32(76230F10), ref: 003973D8

Part of subcall function 0039F1A5: lstrlenA.KERNEL32(000000C8,000000E4,003A22F8,000000C8,00397150,?), ref: 0039F1AD

Strings

, xrefs: 00397194
", xrefs: 00397227

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"
API String ID: 4293430545-3817095088
Opcode ID: e32fa03e2775b2750429490655e3e7ca83234ccdbc824c43553b17b16d02bd7e
Instruction ID: 718b09839fd506cc28efe25a3de0974cb12f5245e51998efd575d6238f9f8da3
Opcode Fuzzy Hash: e32fa03e2775b2750429490655e3e7ca83234ccdbc824c43553b17b16d02bd7e
Instruction Fuzzy Hash: 71B18D7291820AAEEF16EFA4DC45AEF77B8EF05301F110466F501E61D0EB719A84CBA4

Function 0039AD89 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0039AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0039ADA6

Part of subcall function 0039AD08: gethostname.WS2_32(?,00000080), ref: 0039AD1C
Part of subcall function 0039AD08: lstrlenA.KERNEL32(?), ref: 0039AD60
Part of subcall function 0039AD08: lstrlenA.KERNEL32(?), ref: 0039AD69
Part of subcall function 0039AD08: lstrcpyA.KERNEL32(?,LocalHost), ref: 0039AD7F

Part of subcall function 003930B5: gethostname.WS2_32(?,00000080), ref: 003930D8
Part of subcall function 003930B5: gethostbyname.WS2_32(?), ref: 003930E2

wsprintfA.USER32 ref: 0039AEA5

Part of subcall function 0039A7A3: inet_ntoa.WS2_32(00000000), ref: 0039A7A9

wsprintfA.USER32 ref: 0039AE4F
wsprintfA.USER32 ref: 0039AE5E

Part of subcall function 0039EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 0039EF92
Part of subcall function 0039EF7C: lstrlenA.KERNEL32(?), ref: 0039EF99
Part of subcall function 0039EF7C: lstrlenA.KERNEL32(00000000), ref: 0039EFA0

Strings

127.0.0.1, xrefs: 0039ADEB
%OUTLOOK_HST, xrefs: 0039AEC5
%OUTLOOK_BND_, xrefs: 0039AE0F, 0039AE14, 0039AE57, 0039AE76
%s%d, xrefs: 0039AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0039AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0039AE9F
%OUTLOOK_MID, xrefs: 0039AEAE

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: bd0fdf7eaadc37053b38a2f8d37419b57c356745fd362a278bc2fc2869a74753
Instruction ID: e81e066b41d2734da51544ba02bbf19cd5e77cae22588b985f7cec262e395ae4
Opcode Fuzzy Hash: bd0fdf7eaadc37053b38a2f8d37419b57c356745fd362a278bc2fc2869a74753
Instruction Fuzzy Hash: 984123B290020CAFDF26EFA4DC46EEF3BADFF09300F144516F91596151E671D9548B61

Function 00392DF2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,762323A0,?,000DBBA0,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00392E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392E4F
htons.WS2_32(00000035), ref: 00392E88
inet_addr.WS2_32(?), ref: 00392E93
gethostbyname.WS2_32(?), ref: 00392EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392EE3
HeapFree.KERNEL32(00000000,?,00000000,00392F0F,?,003920FF,003A2000), ref: 00392EE6

Strings

GetNetworkParams, xrefs: 00392E28
iphlpapi.dll, xrefs: 00392DFB, 00392E00, 00392E10

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll
API String ID: 929413710-2099955842
Opcode ID: ba73817dfbd8b2607956866361e3aeb1af2bd4d93c97058437b4cf448a83c2c2
Instruction ID: 9c0afbb56198ed0911d7f07bf5b9975a129e148f6a9c0dade49a821616eacc81
Opcode Fuzzy Hash: ba73817dfbd8b2607956866361e3aeb1af2bd4d93c97058437b4cf448a83c2c2
Instruction Fuzzy Hash: 9031A436E00A0ABBDF179BB89C88AAF777CAF05361F154115F914E7290D730DD418B90

Function 00399326 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00399DD7,?,00000022,?,?,00000000,00000001), ref: 00399340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00399DD7,?,00000022,?,?,00000000,00000001), ref: 0039936E
GetModuleFileNameA.KERNEL32(00000000,?,00399DD7,?,00000022,?,?,00000000,00000001), ref: 00399375
wsprintfA.USER32 ref: 003993CE
wsprintfA.USER32 ref: 0039940C
wsprintfA.USER32 ref: 0039948D
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 003994F1
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00399526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00399571

Strings

runas, xrefs: 00399674

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: runas
API String ID: 3696105349-4000483414
Opcode ID: 809ba888ecf506f134154b44566e6ddb805033e94061deb27c7b7a21f7bb1de7
Instruction ID: 73959fdd84489d9183b3f0a85ccac66c451061c6bb58c1cbf737184ffb1fae55
Opcode Fuzzy Hash: 809ba888ecf506f134154b44566e6ddb805033e94061deb27c7b7a21f7bb1de7
Instruction Fuzzy Hash: 8CA16CB2940208AFEF27DFA5CC85FDF3BACEB46741F10002AFA0596152E77599448FA1

Function 0039B3C5 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0039B467

Part of subcall function 0039EF7C: lstrlenA.KERNEL32(?,?,00000000,?,?), ref: 0039EF92
Part of subcall function 0039EF7C: lstrlenA.KERNEL32(?), ref: 0039EF99
Part of subcall function 0039EF7C: lstrlenA.KERNEL32(00000000), ref: 0039EFA0

Strings

%TO_DOMAIN, xrefs: 0039B44B
%s@%s, xrefs: 0039B461
%P5DATE, xrefs: 0039B4F2
%FROM_EMAIL, xrefs: 0039B3E9
%TO_USER, xrefs: 0039B488
%TO_HASH, xrefs: 0039B4B0
%M5DATE, xrefs: 0039B50F
%FROM_DOMAIN, xrefs: 0039B41E
%DATE, xrefs: 0039B4D2
%FROM_USER, xrefs: 0039B431
%TO_EMAIL, xrefs: 0039B473

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: 6405d151afba87304ccb0b3dd5b18393a2e345c4779a8043e856d953264019ab
Instruction ID: 1119ad2429db1d3afc29b65f0d02e7ed8704e0722b09634a15dd2765b6aec668
Opcode Fuzzy Hash: 6405d151afba87304ccb0b3dd5b18393a2e345c4779a8043e856d953264019ab
Instruction Fuzzy Hash: 2D416FB25401197EDF02ABA4DCC2CFF7B6CEF4A758B140515F905AA042DB71AE1497A1

Function 00392011 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00392078
GetTickCount.KERNEL32 ref: 003920D4
GetTickCount.KERNEL32 ref: 003920DB
GetTickCount.KERNEL32 ref: 0039212B
GetTickCount.KERNEL32 ref: 00392132
GetTickCount.KERNEL32 ref: 00392142

Part of subcall function 0039F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0039E342,00000000,75B4EA50,80000001,00000000,0039E513,?,00000000,00000000,?,000000E4), ref: 0039F089
Part of subcall function 0039F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0039E342,00000000,75B4EA50,80000001,00000000,0039E513,?,00000000,00000000,?,000000E4,000000C8), ref: 0039F093

Part of subcall function 0039E854: lstrcpyA.KERNEL32(00000001,?,?,0039D8DF,00000001,localcfg,except_info,00100000,003A0264), ref: 0039E88B
Part of subcall function 0039E854: lstrlenA.KERNEL32(00000001,?,0039D8DF,00000001,localcfg,except_info,00100000,003A0264), ref: 0039E899

Part of subcall function 00391C5F: wsprintfA.USER32 ref: 00391CE1

Strings

rbl_ip, xrefs: 0039218F
net_type, xrefs: 003921DF
rbl_bl, xrefs: 00392181
localcfg, xrefs: 00392070, 00392160, 00392186, 00392194, 003921E4

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: 224cd47c64f0d53906bec4af5c7266510c33089b9c755b95e05ef90b484081bf
Instruction ID: 94256cdbf469250d92d17558e986483e8dc1bf64a3687810d4b5469d3b11b7cc
Opcode Fuzzy Hash: 224cd47c64f0d53906bec4af5c7266510c33089b9c755b95e05ef90b484081bf
Instruction Fuzzy Hash: A451D471A04B466EEF2BEF38ED46B573BDCEB06314F110829E601CA6A1DBB49854CB51

Function 0039C2DC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0039A4C7: GetTickCount.KERNEL32 ref: 0039A4D1
Part of subcall function 0039A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0039A4FA

GetTickCount.KERNEL32 ref: 0039C31F
GetTickCount.KERNEL32 ref: 0039C32B
GetTickCount.KERNEL32 ref: 0039C363
GetTickCount.KERNEL32 ref: 0039C378
GetTickCount.KERNEL32 ref: 0039C44D
InterlockedIncrement.KERNEL32(0039C4E4), ref: 0039C4AE
CreateThread.KERNEL32(00000000,00000000,0039B535,00000000,?,0039C4E0), ref: 0039C4C1
CloseHandle.KERNEL32(00000000,?,0039C4E0,003A3588,00398810), ref: 0039C4CC

Strings

localcfg, xrefs: 0039C2DD

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: fdfbfa6021e5f3a8e517bfef598ab7c5c72150713fd1e5bcdf40ade8ad8c746a
Instruction ID: a56844ee0311b380e92e4f2b31cfc68909e425111f8008178aed463b535d79da
Opcode Fuzzy Hash: fdfbfa6021e5f3a8e517bfef598ab7c5c72150713fd1e5bcdf40ade8ad8c746a
Instruction Fuzzy Hash: F9516FB5610B418FDB269F6AC5D452AFBE9FB48300B51A93ED18BC7A90D774F844CB10

Function 0039BE31 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 152stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0039BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0039BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0039BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0039BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0039BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0039BF94

Strings

smtp_herr, xrefs: 0039BE46, 0039BF62
smtp_retr, xrefs: 0039BE61, 0039BF8C
smtp_ban, xrefs: 0039BE55, 0039BF77

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-1625972887
Opcode ID: d4d8fbafd7ae39ae57d174e7d934b6ee5e59e27ddfd1086e307381c975120c3b
Instruction ID: 0706a4573c90ac4eec27d282cad04df6471346d0068a56ead9afeaa06d563ee6
Opcode Fuzzy Hash: d4d8fbafd7ae39ae57d174e7d934b6ee5e59e27ddfd1086e307381c975120c3b
Instruction Fuzzy Hash: 32519071A0021AEFDF17DB68EE80BAAFBA9EF05344F054055E846AB251E730ED41CF90

Function 00396A60 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,76228A60,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396A7D
GetDiskFreeSpaceA.KERNEL32(00399E9D,00399A60,?,?,?,003A22F8,?,?,?,00399A60,?,?,00399E9D), ref: 00396ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B4E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00399A60,?,?,00399E9D), ref: 00396B80
GetLastError.KERNEL32(?,?,?,00399A60,?,?,00399E9D,?,?,?,?,?,00399E9D,?,00000022,?), ref: 00396B96

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$File$CreateDeleteDiskFreeSpace
String ID:
API String ID: 3188212458-0
Opcode ID: b5a3649dd234c29a3f6d2fc8762c3f887760bb953ca435678cd6a3fd53b44bce
Instruction ID: 4e871a008cdc5bb3036daf68abebb6c7790f7e80ab5fd248ed11e20e8d13b666
Opcode Fuzzy Hash: b5a3649dd234c29a3f6d2fc8762c3f887760bb953ca435678cd6a3fd53b44bce
Instruction Fuzzy Hash: 5831DEB290124DAFDF03DFA48C46ADFBBBDEB4A300F154066E652E7211E73099458F61

Function 00396F5F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,0039D7C3), ref: 00396F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0039D7C3), ref: 00396FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00396FE8
LocalFree.KERNEL32(00000120), ref: 0039701F
wsprintfA.USER32 ref: 00397036

Strings

|, xrefs: 00396FB3
/%d, xrefs: 00397030

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: 0e0d0eaacc0cb7f3ee9abbdad0d99a5054f61d33e9332f71e917a9d3c81ee448
Instruction ID: 34a459eedbe4d4c5d78bd2558dbbab95bfa859a462d0e0296d852b8d7082c2d0
Opcode Fuzzy Hash: 0e0d0eaacc0cb7f3ee9abbdad0d99a5054f61d33e9332f71e917a9d3c81ee448
Instruction Fuzzy Hash: FC312B72A04108BFDF02DFA8DC49ADA7BBCEF05354F048166F859DB241EA35DA088B94

Function 00396CC9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,003A22F8,000000E4,00396DDC,000000C8), ref: 00396CE7
GetProcAddress.KERNEL32(00000000), ref: 00396CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00396D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00396D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00396CC9, 00396CD1, 00396CFE, 00396D05, 00396D13, 00396D1E, 00396D2A, 00396D42, 00396D5F, 00396D85
kernel32, xrefs: 00396CE2
GetSystemWow64DirectoryA, xrefs: 00396CDD

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$kernel32
API String ID: 1082366364-3395550214
Opcode ID: f13bbd8f7213ea0f6eeaf7d03b62a94ad121cb4a2b84de08477664035c7a01f6
Instruction ID: c47a2ceb90171264724a6db75c643e15a58f5770796165b3494b987fa2c1599c
Opcode Fuzzy Hash: f13bbd8f7213ea0f6eeaf7d03b62a94ad121cb4a2b84de08477664035c7a01f6
Instruction Fuzzy Hash: 4821E4557863847AFF2B97395C8AFBB2E4CCB53744F0E0054F414AA1D2CB959C8A82B5

Function 0039977C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00399947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,003A22F8), ref: 003997B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,003A22F8), ref: 003997EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,003A22F8), ref: 003997F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,003A22F8), ref: 00399831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,003A22F8), ref: 0039984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,003A22F8), ref: 0039985B

Strings

D, xrefs: 003997A9

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: 4ce85ec5715d4ba9c8d9af66ccf622b9d0cae7ed0222f4de79673f97b0d03bf7
Instruction ID: 53a6ceb4417107bace8503530b20e41f20a15ab9dad25e3482583575890ee9e9
Opcode Fuzzy Hash: 4ce85ec5715d4ba9c8d9af66ccf622b9d0cae7ed0222f4de79673f97b0d03bf7
Instruction Fuzzy Hash: CB21EAB1D01219ABDF129FA5DC49FEF7BBCEF09750F400065BA19E5150EB719A44CAA0

Function 0039E8A1 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039DD05: GetTickCount.KERNEL32 ref: 0039DD0F
Part of subcall function 0039DD05: InterlockedExchange.KERNEL32(003A36B4,00000001), ref: 0039DD44
Part of subcall function 0039DD05: GetCurrentThreadId.KERNEL32 ref: 0039DD53

Part of subcall function 0039DD84: lstrcmpiA.KERNEL32(80000011,00000000), ref: 0039DDB5

lstrcpynA.KERNEL32(?,00391E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0039EAAA,?,?), ref: 0039E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0039EAAA,?,?,00000001,?,00391E84,?), ref: 0039E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0039EAAA,?,?,00000001,?,00391E84,?,0000000A), ref: 0039E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0039EAAA,?,?,00000001,?,00391E84,?), ref: 0039E94F

Strings

flags_upd, xrefs: 0039E8A7
localcfg, xrefs: 0039E8AB

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 35a05f7ff728d0d4496516a52ecb55a530f736be5a4648c64aeab8e72ec59a0d
Instruction ID: d4ce84b82aea80c2ff81c8f2183dd11e08cb4a3c3c2c3bb739f9e8b5f40ff305
Opcode Fuzzy Hash: 35a05f7ff728d0d4496516a52ecb55a530f736be5a4648c64aeab8e72ec59a0d
Instruction Fuzzy Hash: 33511D72D0020AAFCF12EFA8C985DAEBBF9FF48304F14456AF405A7211E775EA159B50

Function 00396BA7 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00396BB2

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: d8e64d954c924a24b534899a685448e497d640e0e3dd402ed70e9ab1811bdc05
Instruction ID: d487caabe077a85d390da00d98f474fbcba5a810509dd2b25cec5c2fb8f966df
Opcode Fuzzy Hash: d8e64d954c924a24b534899a685448e497d640e0e3dd402ed70e9ab1811bdc05
Instruction Fuzzy Hash: 44218E72105115FFDF17ABA1ED8AE9F3B6CDB45360F214515F542E10A1EA31DA009A74

Function 00399064 Relevance: 9.1, APIs: 6, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,003A22F8), ref: 0039907B
wsprintfA.USER32 ref: 003990E9
CreateFileA.KERNEL32(003A22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0039910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00399122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0039912D
CloseHandle.KERNEL32(00000000), ref: 00399134

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID:
API String ID: 2439722600-0
Opcode ID: ee8ea87442285d7d4fed794f3b413b787b9c361b105b535dfdeae082e6f03292
Instruction ID: 5662e4e11b20117611d4342a1620d002a8bc51abc5a7db5c2615c642475cb63b
Opcode Fuzzy Hash: ee8ea87442285d7d4fed794f3b413b787b9c361b105b535dfdeae082e6f03292
Instruction Fuzzy Hash: 80119AB66401147FFB2AA736DC0EFEF367DDBC5700F008065F70AA5051E9709E018660

Function 0039DD05 Relevance: 9.0, APIs: 6, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0039DD0F
GetCurrentThreadId.KERNEL32 ref: 0039DD20
GetTickCount.KERNEL32 ref: 0039DD2E
Sleep.KERNEL32(00000000,?,76230F10,?,00000000,0039E538,?,76230F10,?,00000000,?,0039A445), ref: 0039DD3B
InterlockedExchange.KERNEL32(003A36B4,00000001), ref: 0039DD44
GetCurrentThreadId.KERNEL32 ref: 0039DD53

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: fb6c080201ba7e30fbb081dbfb31daeed76a7dd3b4c8bb73c4f33b126fbfe6eb
Instruction ID: 31b37b647996f9be6647a44200209ee9b8cc8abb2b5f1eb4f12a27fa544e0009
Opcode Fuzzy Hash: fb6c080201ba7e30fbb081dbfb31daeed76a7dd3b4c8bb73c4f33b126fbfe6eb
Instruction Fuzzy Hash: E7F08272144204AFDB879FA5ADC5B297BADEF47352F110015F609C2271C73055498F62

Function 0039AD08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55stringnetworkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000080), ref: 0039AD1C
lstrlenA.KERNEL32(?), ref: 0039AD60
lstrlenA.KERNEL32(?), ref: 0039AD69
lstrcpyA.KERNEL32(?,LocalHost), ref: 0039AD7F

Strings

LocalHost, xrefs: 0039AD79

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: f646c1a942dc303ac3a75b7cbd81aa3d8f39bbb78900c8a1b6835f20843719a2
Instruction ID: cd5266b553a47a3b3601d70f3f54a7fab0ea82a0e2dd10a28ad003d02b0eb339
Opcode Fuzzy Hash: f646c1a942dc303ac3a75b7cbd81aa3d8f39bbb78900c8a1b6835f20843719a2
Instruction Fuzzy Hash: B0019C608449895DDF37462CC864BF97FB9AF9770AF120255E4C0DB966EB24C88783E3

Function 00394280 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,003998FD,00000001,00000100,003A22F8,0039A3C7), ref: 00394290
CloseHandle.KERNEL32(0039A3C7), ref: 003943AB
CloseHandle.KERNEL32(00000001), ref: 003943AE

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: 3e18e7ab06aaeb56e91792a23a0b89c3597bbeadf54feba4dc8929dad04e8cc7
Instruction ID: b52285bba915182a8e7309f9e9069d8c797945905cc69e1563093b98c60f5159
Opcode Fuzzy Hash: 3e18e7ab06aaeb56e91792a23a0b89c3597bbeadf54feba4dc8929dad04e8cc7
Instruction Fuzzy Hash: 8041BBB1D00209BADF12ABB1CD86FAFBFBCEF00324F104155F605AA181D7348A51DBA0

Function 00396069 Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0039609C
LoadLibraryA.KERNEL32(?,?,003964CF,00000000), ref: 003960C3
GetProcAddress.KERNEL32(?,00000014), ref: 0039614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0039619E

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: 549134cd719bd6a268423c564162ff883b64d6b7b1437cd8084c1b05658454a5
Instruction ID: 6716fe8880e64b1e1bdad3d305d99a4f70b883409cc882e86a5f0933cef6c48a
Opcode Fuzzy Hash: 549134cd719bd6a268423c564162ff883b64d6b7b1437cd8084c1b05658454a5
Instruction Fuzzy Hash: 1C416C71A05206AFDF16CF68C886BA9B7B9EF14354F258069E815D7391E730ED40DB90

Function 00392923 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f510e33387724b9878d32ee97eddf3328e4394bb923840ede0950c22bfe8bcb
Instruction ID: 908b11880ec04bc333b8c894b3ed108aca80590d1631fd6730e4236f886a3b3d
Opcode Fuzzy Hash: 3f510e33387724b9878d32ee97eddf3328e4394bb923840ede0950c22bfe8bcb
Instruction Fuzzy Hash: 9B318F72A00718BBCF129FA9CC81ABFB7F8EF48701F104456E545EA241E774DA518B54

Function 003926FF Relevance: 7.6, APIs: 5, Instructions: 96networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0039272E
htons.WS2_32(00000001), ref: 00392752
htons.WS2_32(0000000F), ref: 003927D5
htons.WS2_32(00000001), ref: 003927E3
sendto.WS2_32(?,003A2BF8,00000009,00000000,00000010,00000010), ref: 00392802

Part of subcall function 0039EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0039EBFE,7FFF0001,?,0039DB55,7FFF0001), ref: 0039EBD3
Part of subcall function 0039EBCC: RtlAllocateHeap.NTDLL(00000000,?,0039DB55,7FFF0001), ref: 0039EBDA

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 1ef73df1065b840fd994131a5068c897a042ef286392bb8d2628509aa0148d78
Instruction ID: fb908996807d23fc8fffc8cfc5c999ba99c1806c9094f4fe32a1944696d39d7c
Opcode Fuzzy Hash: 1ef73df1065b840fd994131a5068c897a042ef286392bb8d2628509aa0148d78
Instruction Fuzzy Hash: 6C31F934245386AFDB16CFF8DC90A677768EF1A314F1A405DE8559B363D632D842D720

Function 00399145 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,003A22F8), ref: 0039915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00399166
CharToOemA.USER32(?,?), ref: 00399174
wsprintfA.USER32 ref: 003991A9

Part of subcall function 00399064: GetTempPathA.KERNEL32(00000400,?,00000000,003A22F8), ref: 0039907B
Part of subcall function 00399064: wsprintfA.USER32 ref: 003990E9
Part of subcall function 00399064: CreateFileA.KERNEL32(003A22F8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0039910E
Part of subcall function 00399064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00399122
Part of subcall function 00399064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0039912D
Part of subcall function 00399064: CloseHandle.KERNEL32(00000000), ref: 00399134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 003991E1

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID:
API String ID: 3857584221-0
Opcode ID: 06579b974323c3303a817b4ef20087ecacd58cb40735b98993d8aca7ea6f1944
Instruction ID: e5a6828b878702986372b3496defbc90cdded61f0fff806853a7e91b22ed910a
Opcode Fuzzy Hash: 06579b974323c3303a817b4ef20087ecacd58cb40735b98993d8aca7ea6f1944
Instruction Fuzzy Hash: 8B0175FA9001187BDB26A7619D4DFEF777CDB86701F000095B749E6040D67097858F70

Function 00392419 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00392491,?,?,?,0039E844,-00000030,?,?,?,00000001), ref: 00392429
lstrlenA.KERNEL32(?,?,00392491,?,?,?,0039E844,-00000030,?,?,?,00000001,00391E3D,00000001,localcfg,lid_file_upd), ref: 0039243E
lstrcmpiA.KERNEL32(?,?), ref: 00392452
lstrlenA.KERNEL32(?,?,00392491,?,?,?,0039E844,-00000030,?,?,?,00000001,00391E3D,00000001,localcfg,lid_file_upd), ref: 00392467

Strings

localcfg, xrefs: 0039241F

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: 10f88b6512e7b727ffdf74649141adc0614ce2a69f21a8def2df5e75c7787796
Instruction ID: a5a88ca6757fe1c2670d830290bc492c07e93bdd57f1ce654133fce6fbed30de
Opcode Fuzzy Hash: 10f88b6512e7b727ffdf74649141adc0614ce2a69f21a8def2df5e75c7787796
Instruction Fuzzy Hash: 8201D632600618BF8F16EF6ADC849DE7BA9EF44394B11C426E959E7211E330EA448A90

Function 00396EDD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00396F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p9), ref: 00396F24
FreeSid.ADVAPI32(?), ref: 00396F3E

Strings

*p9, xrefs: 00396F1C, 00396F1F

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p9
API String ID: 3429775523-3131173850
Opcode ID: 2005f8fbebeef48de34c21d4372ba2a9a411e61c4b2f75922eac6cfb632c0762
Instruction ID: e4b4c15a5e609524603fbead370d5c704c70fb5de1658adaafe26369efa0ac35
Opcode Fuzzy Hash: 2005f8fbebeef48de34c21d4372ba2a9a411e61c4b2f75922eac6cfb632c0762
Instruction Fuzzy Hash: 12012171905208AFDB11DFE4EDC5AAE77BCFB04300F104869E116E2151E7709948CB10

Function 00391C5F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00391CE1
wsprintfA.USER32 ref: 00391D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00391CDB, 00391D65
localcfg, xrefs: 00391C70

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 38eb1d6e9a4cf3c680564b2cb5ef36cb2e9ce8d2373447dc22e14c6c2c143d54
Instruction ID: 00463934e0f4504b26daa6db4af254898bea5ebd786c5fd23025e91c30d7c738
Opcode Fuzzy Hash: 38eb1d6e9a4cf3c680564b2cb5ef36cb2e9ce8d2373447dc22e14c6c2c143d54
Instruction Fuzzy Hash: 9641AC729042999FDF22CFB88D44AEE3BE89F49310F240056FDA4E7152D634DA05CBA0

Function 0039E654 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0039DD05: GetTickCount.KERNEL32 ref: 0039DD0F
Part of subcall function 0039DD05: InterlockedExchange.KERNEL32(003A36B4,00000001), ref: 0039DD44
Part of subcall function 0039DD05: GetCurrentThreadId.KERNEL32 ref: 0039DD53

lstrcmpA.KERNEL32(76230F18,00000000,?,76230F10,00000000,?,00395EC1), ref: 0039E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,76230F10,00000000,?,00395EC1), ref: 0039E6E9
lstrcmpA.KERNEL32(89ABCDEF,00000008,?,76230F10,00000000,?,00395EC1), ref: 0039E722

Strings

89ABCDEF, xrefs: 0039E721

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: 89ABCDEF
API String ID: 3343386518-71641322
Opcode ID: 2e15ca869d5e4a16246a9680e3877bdbe1365b01ec6f0a3d957bfd6a1ce6537d
Instruction ID: dd00aa70aca895d2f3ad7d46eaeae5f7e7ee89a62b36c9188b204fcdd958db2f
Opcode Fuzzy Hash: 2e15ca869d5e4a16246a9680e3877bdbe1365b01ec6f0a3d957bfd6a1ce6537d
Instruction Fuzzy Hash: AB31AB316047129FDF33CF64D884B6777E8EB22720F11882AE5568B550E770EC80CB81

Function 0039E095 Relevance: 6.1, APIs: 4, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0039E2A3,00000000,00000000,00000000,00020106,00000000,0039E2A3,00000000,000000E4), ref: 0039E0B2
RegSetValueExA.ADVAPI32(0039E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,003A22F8), ref: 0039E127
RegDeleteValueA.ADVAPI32(0039E2A3,?,?,?,?,?,000000C8,003A22F8), ref: 0039E158
RegCloseKey.ADVAPI32(0039E2A3,?,?,?,?,000000C8,003A22F8,?,?,?,?,?,?,?,?,0039E2A3), ref: 0039E161

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID:
API String ID: 2667537340-0
Opcode ID: e5d82b3db2e960d7f465dacf6e5caaf4399ec938587274b649888780900213bd
Instruction ID: 78e65f3659e01ec2ac7783406f3a1e0eecf371bc1ed27294c8ca9d969a8980e0
Opcode Fuzzy Hash: e5d82b3db2e960d7f465dacf6e5caaf4399ec938587274b649888780900213bd
Instruction Fuzzy Hash: B7215972A00219BBDF22DFA5DC89EDF7FB9EF09750F008061F904E6151E6718A54DBA0

Function 00393F18 Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,0039A3C7,00000000,00000000,000007D0,00000001), ref: 00393F44
GetLastError.KERNEL32 ref: 00393F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00393F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00393F72

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9daf6423e66f7404ca4d063ab12e34d3f1afc6492b3485f5f254058ec5f58b32
Instruction ID: a3947eec4037bb286a51c28d784cff79b328bb2a7ee6f575c400bc4564ac8d26
Opcode Fuzzy Hash: 9daf6423e66f7404ca4d063ab12e34d3f1afc6492b3485f5f254058ec5f58b32
Instruction Fuzzy Hash: 580104B2911109ABDF02DF90ED88BEF7BBCEB04356F114025FA02E2050D730DA248BB2

Function 00393F8C Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,0039A3C7,00000000,00000000,000007D0,00000001), ref: 00393FB8
GetLastError.KERNEL32 ref: 00393FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00393FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00393FE6

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 235a92050cf2488d8284b2528242be3e9f0aa036cc2b23e86840a40c037bb848
Instruction ID: a11d828d9e654e8d952238d08c485b687dc6927fd34a2afae29b048baf2f5619
Opcode Fuzzy Hash: 235a92050cf2488d8284b2528242be3e9f0aa036cc2b23e86840a40c037bb848
Instruction Fuzzy Hash: A701A2B291020AABDF12DF94DD89BEF7BBCEB14356F114061F902E2050D770DA548BB2

Function 00394E92 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00394E9E
GetTickCount.KERNEL32 ref: 00394EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00394EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00394EC3

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: a0c423f972ecd5bc555e88af0fdd9bfebeae84f19a6c676efc55e2f935920200
Instruction ID: 0ef35469f9c36b39a2e63b604d173eff9d71bc4c135a4923e1d72a128fbb92e3
Opcode Fuzzy Hash: a0c423f972ecd5bc555e88af0fdd9bfebeae84f19a6c676efc55e2f935920200
Instruction Fuzzy Hash: 5EE0CD3370121457DA1167F9AC84F56774DBB57375F020531F709D2140D556DC4345F1

Function 0039A4C7 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0039A4D1
GetTickCount.KERNEL32 ref: 0039A4E4
Sleep.KERNEL32(00000000,?,0039C2E9,0039C4E0,00000000,localcfg,?,0039C4E0,003A3588,00398810), ref: 0039A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0039A4FA

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: d5aec8b245ac1197149e0dd1bf92365a69405c700f3ae76ad521be45fcf7a0b3
Instruction ID: 145ec15ce188bd69cd74ab7cfbb6a5b45340005a9df91ccdbfae3dc113da89ba
Opcode Fuzzy Hash: d5aec8b245ac1197149e0dd1bf92365a69405c700f3ae76ad521be45fcf7a0b3
Instruction Fuzzy Hash: ADE07D3330021457CF0297E6AC84F7A338CEB4B7A1F130121FB08E3240C656A84141F3

Function 00394BD1 Relevance: 6.0, APIs: 4, Instructions: 27sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00394BDD
GetTickCount.KERNEL32 ref: 00394BEC
Sleep.KERNEL32(00000000,?,?,?,02A1E054,003950F2), ref: 00394BF9
InterlockedExchange.KERNEL32(02A1E048,00000001), ref: 00394C02

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 9cfbe06c1a9825cd5e69dea8162b97429f971f031a31ee4c4d1b2566dfa362c1
Instruction ID: 6b1cece65b5e36d0fabaaffadbbc3e097fd911e114528b559da8df567180bd01
Opcode Fuzzy Hash: 9cfbe06c1a9825cd5e69dea8162b97429f971f031a31ee4c4d1b2566dfa362c1
Instruction Fuzzy Hash: 14E0CD3324131467CF1567F59C80F56775CDB57361F070072F748D2150C556D84245B1

Function 003930FA Relevance: 6.0, APIs: 4, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00393103
GetTickCount.KERNEL32 ref: 0039310F
Sleep.KERNEL32(00000000), ref: 0039311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00393128

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 2d4e50e99211247843cac812ee6761ba59ffbbe6436e627c0e4d21ee52e2feec
Instruction ID: 718be59231d7904c8f70b287fcf57fc06d8e5e4db10c08be23b8000c4066b89c
Opcode Fuzzy Hash: 2d4e50e99211247843cac812ee6761ba59ffbbe6436e627c0e4d21ee52e2feec
Instruction Fuzzy Hash: 8EE02B71304215AFDF02BBB6AD44B896B5EDF857A1F020031F201E20B0C5504D008971

Function 00396987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00399A60,?,?,00000000,00000000,00399A60,?,00000000), ref: 003969F9
WriteFile.KERNEL32(00399A60,?,00399A60,00000000,00000000), ref: 00396A27

Strings

,k9, xrefs: 003969A7, 003969D5

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k9
API String ID: 3934441357-387603698
Opcode ID: dca0288c2da4eacf504b9fb35490a1e02b412a3b37303354bc8a5bb32bdcdc41
Instruction ID: a78dcea3448ef79392cf12119d3adfaba9a3b519d28f7be5a6ba5ff6ce28add8
Opcode Fuzzy Hash: dca0288c2da4eacf504b9fb35490a1e02b412a3b37303354bc8a5bb32bdcdc41
Instruction Fuzzy Hash: 58313AB2A01209EFDF25CF58D985BAE77F8EB04355F11846AE805E7200D370EE54CB61

Function 00398CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00398D02
GetTickCount.KERNEL32 ref: 00398DA1

Strings

localcfg, xrefs: 00398D19

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: 8c077dadb21caad3564ec0e1fe83cdf3e8ba7b2e79b8847e8e3a432ecbc0be8a
Instruction ID: cd7836843e717b7294d25061304180c40d237148640f4b397378ec96c8cc3051
Opcode Fuzzy Hash: 8c077dadb21caad3564ec0e1fe83cdf3e8ba7b2e79b8847e8e3a432ecbc0be8a
Instruction Fuzzy Hash: 4321AF32614615AFDF12DFA8DC956AABBBDEBA3351F2A015AE401DB191CF30EA40C750

Function 0039BFCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0039BFD0
wsprintfA.USER32 ref: 0039C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0039C057

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 8c61e6b4ea18599f5ee9f163dce2d899a6d3cfc47d8ba70e919d87da783e60f8
Instruction ID: 8cac51ecc17370b9faf3d4152a4a4beb0c5361382c2326aeafaef34b9334325e
Opcode Fuzzy Hash: 8c61e6b4ea18599f5ee9f163dce2d899a6d3cfc47d8ba70e919d87da783e60f8
Instruction Fuzzy Hash: F6119772200100FFDB429BA9CD44E567FA6FF89318B34819CF6188E166D633D863EB50

Function 003926B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 003926C3
inet_ntoa.WS2_32(?), ref: 003926E4

Strings

localcfg, xrefs: 003926CD, 003926D2, 003926DE

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: c4d14fd4b44ea51b3b5823a7a6fd16c52d184db521871c7ebaabef7e7cda484b
Instruction ID: 03cf0c680c63c2e26c2ffaf0536828b668a96903b3ee2c192b4c32b51dfc7098
Opcode Fuzzy Hash: c4d14fd4b44ea51b3b5823a7a6fd16c52d184db521871c7ebaabef7e7cda484b
Instruction Fuzzy Hash: 7CF0A7321483087FEF06AFA0EC09B9A379CDF05351F104422F908DE490DBB1D9509798

Function 0039EAE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0039EB54,_alldiv,0039F0B7,80000001,00000000,00989680,00000000,?,?,?,0039E342,00000000,75B4EA50,80000001,00000000), ref: 0039EAF2
GetProcAddress.KERNEL32(77310000,00000000), ref: 0039EB07

Strings

ntdll.dll, xrefs: 0039EAED

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: f0a214c8507ed7eb85928fe1596c28e6e2c82517919a1c1dbed296e4f4a4d786
Instruction ID: 9bef05808d1fa17d80c560f3b45a45cb55d404b09174f1da9ae99c3f87ce7b88
Opcode Fuzzy Hash: f0a214c8507ed7eb85928fe1596c28e6e2c82517919a1c1dbed296e4f4a4d786
Instruction Fuzzy Hash: 81D0C934608302AB8F17CF649D4B94A76ACAB56702F408015F406C1120E730D844DB01

Function 00392F22 Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00392D21: GetModuleHandleA.KERNEL32(00000000,762323A0,?,00000000,00392F01,?,003920FF,003A2000), ref: 00392D3A
Part of subcall function 00392D21: LoadLibraryA.KERNEL32(?), ref: 00392D4A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00392F73
HeapFree.KERNEL32(00000000), ref: 00392F7A

Memory Dump Source

Source File: 00000012.00000002.4594828499.0000000000390000.00000040.00000400.00020000.00000000.sdmp, Offset: 00390000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_390000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: ca76a2612cc75b9222fc448bd8cf66b7337ec7123c69c714f9ece0f6db3b0e4e
Instruction ID: 9db5a5b8d1a654153f2cc3357db54355262383a64e49b6ad0d914af88396b967
Opcode Fuzzy Hash: ca76a2612cc75b9222fc448bd8cf66b7337ec7123c69c714f9ece0f6db3b0e4e
Instruction Fuzzy Hash: 1D51CD7590020AAFDF06DF64D8889FABBB9FF16305F114169EC96C7210E7329A19CB80

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uMlLpvdLRU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Tofsee

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\bndqedvz.exe

C:\Windows\SysWOW64\yuzqifwu\bndqedvz.exe (copy)

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
uMlLpvdLRU.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre