Edit tour

Windows Analysis Report
regscs.exe

Overview

General Information

Sample name:	regscs.exe
Analysis ID:	1535915
MD5:	fe4001f3584462a292bff67b021a7337
SHA1:	5543207ebed4d7b50a350ece848c103dc7805f03
SHA256:	9fbe0f24d1f2b9145043e85fe3b7dcfe3f5c76a2d4910487992d90ada0c7c520
Tags:	exeuser-scx
Infos:

Detection

WebMonitor RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected WebMonitor RAT

AI detected suspicious sample

Drops VBS files to the startup folder

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

regscs.exe (PID: 7068 cmdline: "C:\Users\user\Desktop\regscs.exe" MD5: FE4001F3584462A292BFF67B021A7337)

regscs.exe (PID: 6404 cmdline: "C:\Users\user\Desktop\regscs.exe" MD5: FE4001F3584462A292BFF67B021A7337)

wscript.exe (PID: 1188 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

regscs.exe (PID: 2056 cmdline: "C:\Users\user\Desktop\regscs.exe" MD5: FE4001F3584462A292BFF67B021A7337)

regscs.exe (PID: 1696 cmdline: "C:\Users\user\Desktop\regscs.exe" MD5: FE4001F3584462A292BFF67B021A7337)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Revcoderat_8e6d4182	unknown	unknown	0x26810:$a1: PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download! 0x14678:$a2: TARGET_HOST_UPDATE(): Sync successful! 0x13968:$a3: WEBCAM_ACTIVATE: Plugin already exists, skipping download! 0x264e4:$a4: send_keylog_get
00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp	MALWARE_Win_RevCodeRAT	Detects RevCode/WebMonitor RAT	ditekSHen	0x11568:$x1: rev-novm.dat 0x13cdc:$x2: WebMonitor- 0x14784:$x3: WebMonitor Client 0x12864:$x4: Launch WebMonitor 0x27148:$s1: KEYLOG_DEL 0x27160:$s2: KEYLOG_STREAM_START 0x264d4:$s3: send_keylog_del 0x111bc:$s4: send_keylog_stream_ 0x264f4:$s4: send_keylog_stream_ 0x26510:$s4: send_keylog_stream_ 0x128e8:$s5: send_shell_exec 0x264bc:$s6: send_file_download_exec 0x26544:$s7: send_pdg_exec 0x26334:$s8: send_app_cmd_upd 0x13a14:$s9: send_webcamstream_start 0x14a10:$s10: send_screenstream_start 0x263d8:$s11: send_clipboard_get 0x26554:$s12: send_pdg_rev_proxy_stop 0x26758:$s13: send_shell_stop 0x267b0:$s14: send_wnd_cmd 0x149c0:$s15: SCREEN_STREAM_LEGACY(): Started...
Process Memory Space: regscs.exe PID: 7068	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
Process Memory Space: regscs.exe PID: 7068	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: regscs.exe PID: 7068	Windows_Trojan_Revcoderat_8e6d4182	unknown	unknown	0x3338d:$a1: PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download! 0x236b0:$a2: TARGET_HOST_UPDATE(): Sync successful! 0x22cc4:$a3: WEBCAM_ACTIVATE: Plugin already exists, skipping download! 0x330a5:$a4: send_keylog_get
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.regscs.exe.29e0000.0.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.regscs.exe.29e0000.0.unpack	Windows_Trojan_Revcoderat_8e6d4182	unknown	unknown	0x86810:$a1: PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download! 0x74678:$a2: TARGET_HOST_UPDATE(): Sync successful! 0x73968:$a3: WEBCAM_ACTIVATE: Plugin already exists, skipping download! 0x864e4:$a4: send_keylog_get
0.2.regscs.exe.29e0000.0.unpack	MALWARE_Win_RevCodeRAT	Detects RevCode/WebMonitor RAT	ditekSHen	0x71568:$x1: rev-novm.dat 0x73cdc:$x2: WebMonitor- 0x74784:$x3: WebMonitor Client 0x72864:$x4: Launch WebMonitor 0x87148:$s1: KEYLOG_DEL 0x87160:$s2: KEYLOG_STREAM_START 0x864d4:$s3: send_keylog_del 0x711bc:$s4: send_keylog_stream_ 0x864f4:$s4: send_keylog_stream_ 0x86510:$s4: send_keylog_stream_ 0x728e8:$s5: send_shell_exec 0x864bc:$s6: send_file_download_exec 0x86544:$s7: send_pdg_exec 0x86334:$s8: send_app_cmd_upd 0x73a14:$s9: send_webcamstream_start 0x74a10:$s10: send_screenstream_start 0x863d8:$s11: send_clipboard_get 0x86554:$s12: send_pdg_rev_proxy_stop 0x86758:$s13: send_shell_stop 0x867b0:$s14: send_wnd_cmd 0x749c0:$s15: SCREEN_STREAM_LEGACY(): Started...
0.2.regscs.exe.2a40000.1.raw.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.regscs.exe.2a40000.1.raw.unpack	Windows_Trojan_Revcoderat_8e6d4182	unknown	unknown	0x26810:$a1: PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download! 0x14678:$a2: TARGET_HOST_UPDATE(): Sync successful! 0x13968:$a3: WEBCAM_ACTIVATE: Plugin already exists, skipping download! 0x264e4:$a4: send_keylog_get
0.2.regscs.exe.2a40000.1.raw.unpack	MALWARE_Win_RevCodeRAT	Detects RevCode/WebMonitor RAT	ditekSHen	0x11568:$x1: rev-novm.dat 0x13cdc:$x2: WebMonitor- 0x14784:$x3: WebMonitor Client 0x12864:$x4: Launch WebMonitor 0x27148:$s1: KEYLOG_DEL 0x27160:$s2: KEYLOG_STREAM_START 0x264d4:$s3: send_keylog_del 0x111bc:$s4: send_keylog_stream_ 0x264f4:$s4: send_keylog_stream_ 0x26510:$s4: send_keylog_stream_ 0x128e8:$s5: send_shell_exec 0x264bc:$s6: send_file_download_exec 0x26544:$s7: send_pdg_exec 0x26334:$s8: send_app_cmd_upd 0x13a14:$s9: send_webcamstream_start 0x14a10:$s10: send_screenstream_start 0x263d8:$s11: send_clipboard_get 0x26554:$s12: send_pdg_rev_proxy_stop 0x26758:$s13: send_shell_stop 0x267b0:$s14: send_wnd_cmd 0x149c0:$s15: SCREEN_STREAM_LEGACY(): Started...
0.2.regscs.exe.2a40000.1.unpack	JoeSecurity_WebMonitor	Yara detected WebMonitor RAT	Joe Security
0.2.regscs.exe.2a40000.1.unpack	Windows_Trojan_Revcoderat_8e6d4182	unknown	unknown	0x26810:$a1: PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download! 0x14678:$a2: TARGET_HOST_UPDATE(): Sync successful! 0x13968:$a3: WEBCAM_ACTIVATE: Plugin already exists, skipping download! 0x264e4:$a4: send_keylog_get
0.2.regscs.exe.2a40000.1.unpack	MALWARE_Win_RevCodeRAT	Detects RevCode/WebMonitor RAT	ditekSHen	0x11568:$x1: rev-novm.dat 0x13cdc:$x2: WebMonitor- 0x14784:$x3: WebMonitor Client 0x12864:$x4: Launch WebMonitor 0x27148:$s1: KEYLOG_DEL 0x27160:$s2: KEYLOG_STREAM_START 0x264d4:$s3: send_keylog_del 0x111bc:$s4: send_keylog_stream_ 0x264f4:$s4: send_keylog_stream_ 0x26510:$s4: send_keylog_stream_ 0x128e8:$s5: send_shell_exec 0x264bc:$s6: send_file_download_exec 0x26544:$s7: send_pdg_exec 0x26334:$s8: send_app_cmd_upd 0x13a14:$s9: send_webcamstream_start 0x14a10:$s10: send_screenstream_start 0x263d8:$s11: send_clipboard_get 0x26554:$s12: send_pdg_rev_proxy_stop 0x26758:$s13: send_shell_stop 0x267b0:$s14: send_wnd_cmd 0x149c0:$s15: SCREEN_STREAM_LEGACY(): Started...
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , ProcessId: 1188, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs" , ProcessId: 1188, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\regscs.exe, ProcessId: 7068, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T12:36:18.061159+0200	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49730	TCP
2024-10-17T12:36:57.442571+0200	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	49738	TCP

ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T12:37:06.336578+0200	2032361	1	Domain Observed Used for C2 Detected	192.168.2.4	49519	1.1.1.1	53	UDP
2024-10-17T12:37:48.818793+0200	2032361	1	Domain Observed Used for C2 Detected	192.168.2.4	49826	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: regscs.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: regscs.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: regscs.exe

Joe Sandbox ML: detected

Source: regscs.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032361 - Severity 1 - ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup : 192.168.2.4:49519 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2032361 - Severity 1 - ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup : 192.168.2.4:49826 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 194.58.200.20 194.58.200.20

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:49738

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.2.4.8
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: sdns.se
Source: global traffic	DNS traffic detected: DNS query: ntp.se
Source: global traffic	DNS traffic detected: DNS query: 2aa4ccb27ab65b064eae52e993d5dbff.se
Source: global traffic	DNS traffic detected: DNS query: ee01439035b99fed4b57e5bd255d5faa.se
Source: global traffic	DNS traffic detected: DNS query: oryadshow.wm01.to

Source: regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://0.0.0.0/recv5.php
Source: regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.00000000005F2000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://0/recv5.php
Source: regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://0/recv5.php3
Source: regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://0/recv5.phpic
Source: regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://0/recv5.phpo
Source: regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oryadshow.wm01.to/
Source: regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oryadshow.wm01.to/X
Source: regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000620000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oryadshow.wm01.to/recv5.php
Source: regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oryadshow.wm01.to/recv5.phppp

Source: Yara match

File source: Process Memory Space: regscs.exe PID: 7068, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 Author: unknown
Source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RevCode/WebMonitor RAT Author: ditekSHen
Source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 Author: unknown
Source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RevCode/WebMonitor RAT Author: ditekSHen
Source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 Author: unknown
Source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RevCode/WebMonitor RAT Author: ditekSHen
Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 Author: unknown
Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RevCode/WebMonitor RAT Author: ditekSHen
Source: Process Memory Space: regscs.exe PID: 7068, type: MEMORYSTR	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BB83D NtMapViewOfSection,	0_2_004BB83D
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BA4A9 NtQueryInformationProcess,	0_2_004BA4A9
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004B84BF NtResumeThread,	0_2_004B84BF
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004B9925 NtUnmapViewOfSection,	0_2_004B9925
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004B9670 NtCreateSection,	0_2_004B9670
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004B8A17 NtQueryInformationProcess,	0_2_004B8A17
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004B884E NtMapViewOfSection,	0_2_004B884E
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDA78 NtUnmapViewOfSection,	0_2_004BDA78

Source: regscs.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 reference_sample = 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revcoderat, fingerprint = bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78, id = 8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4, last_modified = 2022-01-13
Source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevCodeRAT snort2_sid = 920070, author = ditekSHen, description = Detects RevCode/WebMonitor RAT, clamav_sig = MALWARE.Win.Trojan.RevCodeRAT, snort3_sid = 920070
Source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 reference_sample = 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revcoderat, fingerprint = bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78, id = 8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4, last_modified = 2022-01-13
Source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevCodeRAT snort2_sid = 920070, author = ditekSHen, description = Detects RevCode/WebMonitor RAT, clamav_sig = MALWARE.Win.Trojan.RevCodeRAT, snort3_sid = 920070
Source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 reference_sample = 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revcoderat, fingerprint = bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78, id = 8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4, last_modified = 2022-01-13
Source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevCodeRAT snort2_sid = 920070, author = ditekSHen, description = Detects RevCode/WebMonitor RAT, clamav_sig = MALWARE.Win.Trojan.RevCodeRAT, snort3_sid = 920070
Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 reference_sample = 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revcoderat, fingerprint = bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78, id = 8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4, last_modified = 2022-01-13
Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RevCodeRAT snort2_sid = 920070, author = ditekSHen, description = Detects RevCode/WebMonitor RAT, clamav_sig = MALWARE.Win.Trojan.RevCodeRAT, snort3_sid = 920070
Source: Process Memory Space: regscs.exe PID: 7068, type: MEMORYSTR	Matched rule: Windows_Trojan_Revcoderat_8e6d4182 reference_sample = 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revcoderat, fingerprint = bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78, id = 8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@8/1@55/1

Source: C:\Users\user\Desktop\regscs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Mutant created: \Sessions\1\BaseNamedObjects\NtCFd7TtbdjUY0F4kEjj8hTOZp75XYEy2.00

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs"

Source: C:\Users\user\Desktop\regscs.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: regscs.exe

ReversingLabs: Detection: 78%

Source: unknown	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"
Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"
Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"
Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: regscs.exe

Static file information: File size 1294848 > 1048576

Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDD18 push 004BDF04h; ret	0_2_004BDEFC
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDD16 push 004BDF04h; ret	0_2_004BDEFC
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDD8A push 004BDF04h; ret	0_2_004BDEFC
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDF4C push 004BDF72h; ret	0_2_004BDF6A
Source: C:\Users\user\Desktop\regscs.exe	Code function: 0_2_004BDF0C push 004BDF38h; ret	0_2_004BDF30

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\regscs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\regscs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs			Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs			Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: regscs.exe, 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp

Binary or memory string: WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\regscs.exe	RDTSC instruction interceptor: First address: 438426 second address: 438430 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 call dword ptr [004F0034h] 0x0000000a jmp dword ptr [74E51150h] 0x00000010 mov eax, dword ptr fs:[00000030h] 0x00000016 mov eax, dword ptr [eax+18h] 0x00000019 ret 0x0000001a rdtsc
Source: C:\Users\user\Desktop\regscs.exe	RDTSC instruction interceptor: First address: 43843C second address: 438426 instructions: 0x00000000 rdtsc 0x00000002 sub eax, esi 0x00000004 xor edx, edx 0x00000006 sub esi, edi 0x00000008 div esi 0x0000000a cmp eax, 0Ah 0x0000000d jnc 00007F3478DE1DEDh 0x0000000f inc ebx 0x00000010 cmp ebx, 0Ah 0x00000013 jc 00007F3478DE1DB7h 0x00000015 rdtsc

Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Memory allocated: 2CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Window / User API: threadDelayed 6659			Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Window / User API: threadDelayed 1177			Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe TID: 1260

Thread sleep count: 1177 > 30

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\regscs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\regscs.exe

Last function: Thread delayed

Source: wscript.exe, 00000005.00000002.1925771889.0000028C2AB44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\7
Source: regscs.exe, 00000001.00000003.1827801488.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000003.1828124626.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000003.1828496559.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000003.1828246185.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LocalSystem..Hyper-V Remote Desktop Virtualization Service>
Source: regscs.exe, 00000001.00000003.1827801488.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NT AUTHORITY\LocalService%%Hyper-V Time Synchronization Servicez
Source: regscs.exe, 00000001.00000002.2935689636.0000000000646000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(dh%SystemRoot%\system32\mswsock.dll
Source: regscs.exe, 00000007.00000003.2049000117.000000000058A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange ServiceD
Source: regscs.exe, 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: Cx</block><block><block></block></block><block></data></data><block>.bin\</date>%Y-%m-%d %I:%M:%S<date><data><title></title>{F1}{F2}{F3}{F4}{F5}{F6}{F7}{F8}{F9}{F10}{F11}{F12}{F13}{F14}{F15}{F16}{NUMPAD_0}{NUMPAD_1}{NUMPAD_2}{NUMPAD_3}{NUMPAD_4}{NUMPAD_5}{NUMPAD_6}{NUMPAD_7}{NUMPAD_8}{NUMPAD_9}{NUMPAD_MULTIPLY}{NUMPAD_ADD}{NUMPAD_SEPARATOR}{NUMPAD_SUBTRACT}{NUMPAD_DECIMAL}{NUMPAD_DIVIDE}{ENTER}{CTRL} {SHIFT}{CAPSLOCK}{ESC}{MENU}{HELP}{CLEAR}{TAB}{BACKSPACE}{PRTSCR}{SELECT}{EXECUTE}{SCROLL}{PAUSE}{INS}{HOME}{PAGEUP}{PAGEDOWN}{DEL}{END}{UP}{DOWN}{LEFT}{RIGHT}{NUMLOCK}KEYLOG: KEYLOG STEAM SENT: send_keylog_stream_data</block><block></block><block>kernel32.dllKernel32.dllNtQueryInformationProcessNTDLL.DLLSYSTEM\CurrentControlSet\Control\Terminal Server\GlassSessionIdKVMKVMKVMMicrosoft HvVMwareVMwareXenVMMXenVMMprl hyperv VBoxVBoxVBoxROOT\CIMV2SELECT * FROM Win32_VideoControllerCaptionHyper-VMicrosoft Basic Display AdapterVMWare%ThisIsAnInvalidEnvironmentVariableName?[]<>@\;!-{}#:/~%%ThisIsAnInvalidFileName?[]<>@\;!-{}#:/~%VirtualAlloc failed. Last error: %u
Source: regscs.exe, 00000001.00000002.2935689636.000000000067F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regscs.exe, 00000007.00000003.2049000117.0000000000591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (YC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -pteerLocalSystemHyper-V PowerShell Direct Servicey:May:Jun:June:J
Source: regscs.exe, 00000007.00000002.2246380126.00000000005D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\regscs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Memory protected: page execute and read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\regscs.exe	Section loaded: NULL target: C:\Users\user\Desktop\regscs.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: NULL target: C:\Users\user\Desktop\regscs.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: NULL target: C:\Users\user\Desktop\regscs.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Section loaded: NULL target: C:\Users\user\Desktop\regscs.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\regscs.exe	Process created: C:\Users\user\Desktop\regscs.exe "C:\Users\user\Desktop\regscs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\regscs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected WebMonitor RAT

Source: Yara match	File source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regscs.exe PID: 7068, type: MEMORYSTR

Remote Access Functionality

Yara detected WebMonitor RAT

Source: Yara match	File source: 0.2.regscs.exe.29e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.regscs.exe.2a40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.regscs.exe.2a40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regscs.exe PID: 7068, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	11 Windows Management Instrumentation	111 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	311 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	13 Virtualization/Sandbox Evasion	LSASS Memory	13 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	112 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
regscs.exe	79%	ReversingLabs	Win32.Infostealer.Pony
regscs.exe	100%	Avira	HEUR/AGEN.1331242
regscs.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
ntp.se	194.58.200.20	true	false	unknown
sdns.se	185.141.152.26	true	false	unknown
ee01439035b99fed4b57e5bd255d5faa.se	unknown	unknown	true	unknown
oryadshow.wm01.to	unknown	unknown	true	unknown
2aa4ccb27ab65b064eae52e993d5dbff.se	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://0/recv5.php	regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.00000000005F2000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://0/recv5.phpic	regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://oryadshow.wm01.to/	regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://oryadshow.wm01.to/X	regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://oryadshow.wm01.to/recv5.php	regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.0000000000620000.00000004.00000020.00020000.00000000.sdmp, regscs.exe, 00000001.00000002.2935689636.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://oryadshow.wm01.to/recv5.phppp	regscs.exe, 00000001.00000002.2935689636.0000000000656000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://0/recv5.phpo	regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://0/recv5.php3	regscs.exe, 00000001.00000002.2935689636.0000000000671000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://0.0.0.0/recv5.php	regscs.exe, 00000001.00000002.2935689636.0000000000667000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.58.200.20	ntp.se	Sweden		57021	NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535915
Start date and time:	2024-10-17 12:35:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	regscs.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@8/1@55/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 44 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target regscs.exe, PID 1696 because there are no executed function
Execution Graph export aborted for target regscs.exe, PID 6404 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: regscs.exe

Simulations

Behavior and APIs

Time	Type	Description
06:36:19	API Interceptor	2x Sleep call for process: regscs.exe modified
11:36:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.58.200.20	PREVIOUS CONVERSATION.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse
	OUTSTANDING_DEBTS.exe	Get hash	malicious	WebMonitor RAT	Browse
	NEW PURCHASE ORDER.exe	Get hash	malicious	WebMonitor RAT	Browse
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	WebMonitor RAT	Browse
	Banking_cordinates_928273.exe	Get hash	malicious	WebMonitor RAT	Browse
	REQUEST FOR QUOTATION.exe	Get hash	malicious	WebMonitor RAT	Browse
	allcrhfJER.exe	Get hash	malicious	WebMonitor RAT	Browse
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse
	FILE_2932NH_9923.exe	Get hash	malicious	WebMonitor RAT	Browse
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ntp.se	PREVIOUS CONVERSATION.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	OUTSTANDING_DEBTS.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	NEW PURCHASE ORDER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
sdns.se	CameraCaptureUI.exe	Get hash	malicious	Remcos, WebMonitor RAT	Browse	185.141.152.26
	PREVIOUS CONVERSATION.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	2r7YWg9WKr.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	OUTSTANDING_DEBTS.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	NEW PURCHASE ORDER.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	Banking_cordinates_928273.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	REQUEST FOR QUOTATION.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	allcrhfJER.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	185.243.215.214

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTP-SEAnycastedNTPservicesfromNetnodIXPsSE	PREVIOUS CONVERSATION.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	OUTSTANDING_DEBTS.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	NEW PURCHASE ORDER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	STATEMENT OF ACCOUNT.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	Banking_cordinates_928273.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	REQUEST FOR QUOTATION.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	allcrhfJER.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	HSBC_PAYMENT_COPY.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	FILE_2932NH_9923.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20
	DHL_PACKAGE_HD98232.pdf.exe	Get hash	malicious	WebMonitor RAT	Browse	194.58.200.20

Process:	C:\Users\user\Desktop\regscs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	5.021988615115362
Encrypted:	false
SSDEEP:	3:RUR8FgAExv22WtgpCdnydoNt+WfWXsHH2:RL3YviSs8doNwv82
MD5:	BC91062FC686E3A1D3627889ADB6915F
SHA1:	3AABCFF3250E2BEF0063B6F9D35FB9E8FEB36C96
SHA-256:	A2F37E5484E38EE589569C917DC28197E2C0CA46D6B3A616FEEB62CC78685F47
SHA-512:	0545011EF11DCA71BC058527C8EF40E706EF015B190F956B9CC2E80AE53650212B4C941498C85E91088A9BCF9FFB41505F484796409F389AB76CC47D8FE253BE
Malicious:	true
Reputation:	low
Preview:	sEt KYdaDJ = CreaTeobjeCt("wSCrIpT.sHELl")..kydaDj.RUN """C:\Users\user\Desktop\regscs.exe"""...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.215312083908525
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	regscs.exe
File size:	1'294'848 bytes
MD5:	fe4001f3584462a292bff67b021a7337
SHA1:	5543207ebed4d7b50a350ece848c103dc7805f03
SHA256:	9fbe0f24d1f2b9145043e85fe3b7dcfe3f5c76a2d4910487992d90ada0c7c520
SHA512:	a0cbabb0abba6fc8f3c1d1195cf0f6ccefb939713a338880dbcd86bebc4b346bcae0cc723952be57e672288e02c48c427ec677b70b1f8d324ce5d93e425f10ee
SSDEEP:	24576:o65HsW9xMob+T2vJN3kKnVbKep4X7gTY6bW8JNQcgNUJLB:95sSxzZVVKWQc/v
TLSH:	D755AF22F6F14437C5731A3C8C2BA769982ABE107E28684A7BE41D4C5F39E417D352E7
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	93296531faccf517

Static PE Info

General

Entrypoint:	0x4be23c
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x29C6B649 [Wed Mar 18 03:17:29 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e0e0f68fc5483a21553d028d1fe27596

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004BDF74h
call 00007F3478FF8049h
mov eax, dword ptr [004C0B68h]
mov eax, dword ptr [eax]
call 00007F347905B369h
mov ecx, dword ptr [004C0CFCh]
mov eax, dword ptr [004C0B68h]
mov eax, dword ptr [eax]
mov edx, dword ptr [004B7E84h]
call 00007F347905B369h
mov eax, dword ptr [004C0B68h]
mov eax, dword ptr [eax]
call 00007F347905B3DDh
call 00007F3478FF5B04h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0x261a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd5000	0x6cf88	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc7000	0xd1c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xbd284	0xbd400	fbe4fd8b3404bc7961b5388b030b7e19	False	0.5090728719451784	data	6.588736337174684	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xbf000	0x1dc8	0x1e00	a705053cfd50f3a693489a4efadd01fb	False	0.47369791666666666	data	4.49803816205231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc1000	0xcd1	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0x261a	0x2800	48d32ba38610c4bc588530be6cb78860	False	0.3490234375	data	4.880248846785967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xc5000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x18	0x200	27f1af8b3b369969975946ea1d3ec7f2	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xc7000	0xd1c8	0xd200	e7138711b9ed2db87426042358a95b3e	False	0.5318452380952381	data	6.63396083890795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xd5000	0x6cf88	0x6d000	fb321da6f4e2ff1dd1c731c10f5a6a64	False	0.8770897541571101	DIY-Thermocam raw data (Lepton 2.x), scale 10240-0, spot sensor temperature 0.000000, unit celsius, color scheme 18, minimum point enabled, calibration: offset 0.000000, slope 2417851639229258349412352.000000	7.648035112047126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xd63f0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xd6524	0x134	data			0.4642857142857143
RT_CURSOR	0xd6658	0x134	data			0.4805194805194805
RT_CURSOR	0xd678c	0x134	data			0.38311688311688313
RT_CURSOR	0xd68c0	0x134	data			0.36038961038961037
RT_CURSOR	0xd69f4	0x134	data			0.4090909090909091
RT_CURSOR	0xd6b28	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xd6c5c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xd6e2c	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xd7010	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xd71e0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xd73b0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xd7580	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xd7750	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xd7920	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xd7af0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xd7cc0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xd7e90	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xd7f78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6436170212765957
RT_MENU	0xd83e0	0x2c47	data	English	United States	0.8880458756065285
RT_MENU	0xdb028	0x2c47	data	English	United States	0.9384208204675782
RT_MENU	0xddc70	0x2c47	data	English	United States	0.9393030436700486
RT_MENU	0xe08b8	0x2c47	data	English	United States	0.937097485663873
RT_MENU	0xe3500	0x2c47	data	English	United States	0.941067490074989
RT_MENU	0xe6148	0x2c47	data	English	United States	0.9390383767093075
RT_MENU	0xe8d90	0x2c47	data	English	United States	0.9405381561535069
RT_MENU	0xeb9d8	0x2c47	data	English	United States	0.941067490074989
RT_MENU	0xee620	0x2c47	data	English	United States	0.9417732686369652
RT_MENU	0xf1268	0x2c47	data	English	United States	0.9415968239964712
RT_MENU	0xf3eb0	0x2c47	data	English	United States	0.9415968239964712
RT_MENU	0xf6af8	0x2c47	data	English	United States	0.9414203793559771
RT_MENU	0xf9740	0x2c47	data	English	United States	0.9412439347154831
RT_MENU	0xfc388	0x2c47	data	English	United States	0.9422143802382003
RT_MENU	0xfefd0	0x2c47	data	English	United States	0.9417732686369652
RT_MENU	0x101c18	0x2c47	data	English	United States	0.9392148213498015
RT_MENU	0x104860	0x2c47	data	English	United States	0.8683722981914425
RT_MENU	0x1074a8	0x2c47	data	English	United States	0.9126599029554477
RT_MENU	0x10a0f0	0x2c47	data	English	United States	0.941067490074989
RT_MENU	0x10cd38	0x2c47	data	English	United States	0.9402734891927658
RT_MENU	0x10f980	0x2c47	data	English	United States	0.9423026025584473
RT_MENU	0x1125c8	0x2c47	zlib compressed data	English	United States	0.9420379355977062
RT_MENU	0x115210	0x2c47	data	English	United States	0.9414203793559771
RT_MENU	0x117e58	0x2c47	data	English	United States	0.9416850463167181
RT_MENU	0x11aaa0	0x2c47	data	English	United States	0.9416850463167181
RT_MENU	0x11d6e8	0x2c47	data	English	United States	0.9419497132774592
RT_MENU	0x120330	0x2c47	data	English	United States	0.9419497132774592
RT_MENU	0x122f78	0x2c47	data	English	United States	0.9419497132774592
RT_MENU	0x125bc0	0x2c47	data	English	United States	0.9414203793559771
RT_MENU	0x128808	0x2c47	data	English	United States	0.941155712395236
RT_MENU	0x12b450	0x2c47	data	English	United States	0.9415086016762241
RT_MENU	0x12e098	0x2c47	data	English	United States	0.9414203793559771
RT_MENU	0x130ce0	0x2c47	data	English	United States	0.8887516541685047
RT_MENU	0x133928	0x2c47	data	English	United States	0.9369210410233789
RT_MENU	0x136570	0x2c47	data	English	United States	0.8592853992059991
RT_MENU	0x1391b8	0x2c47	data	English	United States	0.8872518747243052
RT_DIALOG	0x13be00	0x52	data			0.7682926829268293
RT_STRING	0x13be54	0x1e8	data			0.42827868852459017
RT_STRING	0x13c03c	0x584	data			0.35127478753541075
RT_STRING	0x13c5c0	0x57c	data			0.3482905982905983
RT_STRING	0x13cb3c	0x40c	data			0.4092664092664093
RT_STRING	0x13cf48	0x488	data			0.3905172413793103
RT_STRING	0x13d3d0	0x464	data			0.3371886120996441
RT_STRING	0x13d834	0x4d4	data			0.3333333333333333
RT_STRING	0x13dd08	0x5a4	data			0.25069252077562326
RT_STRING	0x13e2ac	0x3f4	data			0.3893280632411067
RT_STRING	0x13e6a0	0x1d8	data			0.3983050847457627
RT_STRING	0x13e878	0x198	data			0.4877450980392157
RT_STRING	0x13ea10	0x174	data			0.5161290322580645
RT_STRING	0x13eb84	0x2ac	data			0.47953216374269003
RT_STRING	0x13ee30	0xe0	data			0.5892857142857143
RT_STRING	0x13ef10	0x12c	data			0.5533333333333333
RT_STRING	0x13f03c	0x290	data			0.4649390243902439
RT_STRING	0x13f2cc	0x41c	data			0.37927756653992395
RT_STRING	0x13f6e8	0x394	data			0.3777292576419214
RT_STRING	0x13fa7c	0x40c	data			0.3416988416988417
RT_STRING	0x13fe88	0x1b0	data			0.4675925925925926
RT_STRING	0x140038	0xec	data			0.5508474576271186
RT_STRING	0x140124	0x20c	data			0.5
RT_STRING	0x140330	0x454	data			0.3231046931407942
RT_STRING	0x140784	0x3d0	data			0.36168032786885246
RT_STRING	0x140b54	0x2fc	data			0.36649214659685864
RT_STRING	0x140e50	0x354	data			0.318075117370892
RT_RCDATA	0x1411a4	0x10	data			1.5
RT_RCDATA	0x1411b4	0x388	data			0.6957964601769911
RT_RCDATA	0x14153c	0x527	Delphi compiled form 'TForm1'			0.5238817285822593
RT_GROUP_CURSOR	0x141a64	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x141a78	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x141a8c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x141aa0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x141ab4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x141ac8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x141adc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x141af0	0x14	data	English	United States	1.1
RT_DLGINCLUDE	0x141b04	0x239	data	English	United States	0.3321616871704745
RT_MANIFEST	0x141d40	0x245	XML 1.0 document, ASCII text, with CRLF line terminators			0.5249569707401033

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegQueryValueA, RegOpenKeyExA, RegOpenKeyA, RegEnumKeyA, RegCloseKey
kernel32.dll	lstrcpyA, lstrcmpA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualFree, VirtualAlloc, SleepEx, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPolyFillMode, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePen, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CoTaskMemFree, StringFromCLSID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoTaskMemFree, CoTaskMemAlloc, CLSIDFromProgID, ProgIDFromCLSID, CLSIDFromString, StringFromCLSID, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, GetActiveObject, SafeArrayCopy, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayDestroy, SafeArrayCreate, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-17T12:36:18.061159+0200	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49730	TCP
2024-10-17T12:36:57.442571+0200	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	49738	TCP
2024-10-17T12:37:06.336578+0200	2032361	ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup	1	192.168.2.4	49519	1.1.1.1	53	UDP
2024-10-17T12:37:48.818793+0200	2032361	ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup	1	192.168.2.4	49826	1.1.1.1	53	UDP

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 12:36:20.587080002 CEST	52591	53	192.168.2.4	1.1.1.1
Oct 17, 2024 12:36:20.713251114 CEST	53	52591	1.1.1.1	192.168.2.4
Oct 17, 2024 12:36:20.725343943 CEST	60772	53	192.168.2.4	1.1.1.1
Oct 17, 2024 12:36:20.763101101 CEST	53	60772	1.1.1.1	192.168.2.4
Oct 17, 2024 12:36:20.763926029 CEST	60773	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:36:21.506346941 CEST	123	60773	194.58.200.20	192.168.2.4
Oct 17, 2024 12:36:21.509265900 CEST	54423	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:22.533879995 CEST	54423	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:23.547190905 CEST	54423	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:25.551852942 CEST	54423	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:29.551846027 CEST	54423	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:33.600018978 CEST	61390	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:36:34.337924004 CEST	123	61390	194.58.200.20	192.168.2.4
Oct 17, 2024 12:36:34.339534998 CEST	60547	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:35.351449966 CEST	60547	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:36.348685980 CEST	60547	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:38.348716974 CEST	60547	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:42.211116076 CEST	60548	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:36:42.364634991 CEST	60547	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:42.947078943 CEST	123	60548	194.58.200.20	192.168.2.4
Oct 17, 2024 12:36:42.949495077 CEST	52370	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:43.958719969 CEST	52370	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:45.026626110 CEST	52370	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:46.381371975 CEST	52807	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:47.020767927 CEST	52370	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:47.402045012 CEST	52807	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:48.411377907 CEST	52807	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:50.411134958 CEST	52807	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:51.036380053 CEST	52370	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:54.411277056 CEST	52807	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:36:59.449229956 CEST	54641	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:00.191337109 CEST	123	54641	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:00.192275047 CEST	58464	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:00.588907003 CEST	53	58464	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:00.590186119 CEST	63828	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:01.598738909 CEST	63828	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:01.808985949 CEST	53	63828	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:02.824888945 CEST	63829	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:03.538239002 CEST	123	63829	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:03.541316986 CEST	65264	53	192.168.2.4	114.114.114.114
Oct 17, 2024 12:37:04.064342976 CEST	53	65264	114.114.114.114	192.168.2.4
Oct 17, 2024 12:37:04.065403938 CEST	59244	53	192.168.2.4	114.114.114.114
Oct 17, 2024 12:37:04.308197975 CEST	53	59244	114.114.114.114	192.168.2.4
Oct 17, 2024 12:37:06.336577892 CEST	49519	53	192.168.2.4	1.1.1.1
Oct 17, 2024 12:37:06.431488991 CEST	53	49519	1.1.1.1	192.168.2.4
Oct 17, 2024 12:37:06.438659906 CEST	49520	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:07.153660059 CEST	123	49520	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:07.154660940 CEST	57220	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:08.145558119 CEST	57220	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:09.161195040 CEST	57220	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:11.162712097 CEST	57220	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:15.176798105 CEST	57220	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:19.177800894 CEST	64019	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:20.192552090 CEST	64019	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:21.208143950 CEST	64019	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:23.223731995 CEST	64019	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:27.239564896 CEST	64019	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:32.266598940 CEST	64020	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:32.992904902 CEST	123	64020	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:32.994116068 CEST	64694	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:33.989332914 CEST	64694	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:35.330679893 CEST	64694	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:37.344841003 CEST	64694	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:41.348963976 CEST	64694	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:44.213418961 CEST	53	64694	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:44.213443041 CEST	53	64694	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:44.214549065 CEST	62289	53	192.168.2.4	1.2.4.8
Oct 17, 2024 12:37:44.416883945 CEST	53	62289	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:45.438944101 CEST	62290	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:46.161945105 CEST	123	62290	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:46.163115025 CEST	54338	53	192.168.2.4	114.114.114.114
Oct 17, 2024 12:37:46.481390953 CEST	53	54338	114.114.114.114	192.168.2.4
Oct 17, 2024 12:37:46.482877016 CEST	57120	53	192.168.2.4	114.114.114.114
Oct 17, 2024 12:37:46.791703939 CEST	53	57120	114.114.114.114	192.168.2.4
Oct 17, 2024 12:37:48.609683990 CEST	53	64694	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:48.609761000 CEST	53	64694	1.2.4.8	192.168.2.4
Oct 17, 2024 12:37:48.818793058 CEST	49826	53	192.168.2.4	1.1.1.1
Oct 17, 2024 12:37:48.836244106 CEST	53	49826	1.1.1.1	192.168.2.4
Oct 17, 2024 12:37:48.845738888 CEST	49827	123	192.168.2.4	194.58.200.20
Oct 17, 2024 12:37:49.562891006 CEST	123	49827	194.58.200.20	192.168.2.4
Oct 17, 2024 12:37:49.564217091 CEST	55140	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:50.567548037 CEST	55140	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:51.567507982 CEST	55140	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:53.586507082 CEST	55140	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:37:57.583372116 CEST	55140	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:38:01.599688053 CEST	63184	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:38:02.616705894 CEST	63184	53	192.168.2.4	185.141.152.26
Oct 17, 2024 12:38:03.614784956 CEST	63184	53	192.168.2.4	185.141.152.26

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 17, 2024 12:37:48.609857082 CEST	192.168.2.4	1.2.4.8	c54d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 12:36:20.587080002 CEST	192.168.2.4	1.1.1.1	0xe279	Standard query (0)	sdns.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:20.725343943 CEST	192.168.2.4	1.1.1.1	0xcf70	Standard query (0)	ntp.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:21.509265900 CEST	192.168.2.4	185.141.152.26	0x74e1	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:22.533879995 CEST	192.168.2.4	185.141.152.26	0x74e1	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:23.547190905 CEST	192.168.2.4	185.141.152.26	0x74e1	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:25.551852942 CEST	192.168.2.4	185.141.152.26	0x74e1	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:29.551846027 CEST	192.168.2.4	185.141.152.26	0x74e1	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:34.339534998 CEST	192.168.2.4	185.141.152.26	0x2fd9	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:35.351449966 CEST	192.168.2.4	185.141.152.26	0x2fd9	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:36.348685980 CEST	192.168.2.4	185.141.152.26	0x2fd9	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:38.348716974 CEST	192.168.2.4	185.141.152.26	0x2fd9	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:42.364634991 CEST	192.168.2.4	185.141.152.26	0x2fd9	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:42.949495077 CEST	192.168.2.4	185.141.152.26	0x5181	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:43.958719969 CEST	192.168.2.4	185.141.152.26	0x5181	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:45.026626110 CEST	192.168.2.4	185.141.152.26	0x5181	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:46.381371975 CEST	192.168.2.4	185.141.152.26	0x896b	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:47.020767927 CEST	192.168.2.4	185.141.152.26	0x5181	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:47.402045012 CEST	192.168.2.4	185.141.152.26	0x896b	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:48.411377907 CEST	192.168.2.4	185.141.152.26	0x896b	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:50.411134958 CEST	192.168.2.4	185.141.152.26	0x896b	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:51.036380053 CEST	192.168.2.4	185.141.152.26	0x5181	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:54.411277056 CEST	192.168.2.4	185.141.152.26	0x896b	Standard query (0)	2aa4ccb27ab65b064eae52e993d5dbff.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:00.192275047 CEST	192.168.2.4	1.2.4.8	0xea98	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:00.590186119 CEST	192.168.2.4	1.2.4.8	0xf637	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:01.598738909 CEST	192.168.2.4	1.2.4.8	0xf637	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:03.541316986 CEST	192.168.2.4	114.114.114.114	0xe499	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:04.065403938 CEST	192.168.2.4	114.114.114.114	0x83d4	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:06.336577892 CEST	192.168.2.4	1.1.1.1	0x710c	Standard query (0)	oryadshow.wm01.to	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:07.154660940 CEST	192.168.2.4	185.141.152.26	0x952f	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:08.145558119 CEST	192.168.2.4	185.141.152.26	0x952f	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:09.161195040 CEST	192.168.2.4	185.141.152.26	0x952f	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:11.162712097 CEST	192.168.2.4	185.141.152.26	0x952f	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:15.176798105 CEST	192.168.2.4	185.141.152.26	0x952f	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:19.177800894 CEST	192.168.2.4	185.141.152.26	0x16c2	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:20.192552090 CEST	192.168.2.4	185.141.152.26	0x16c2	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:21.208143950 CEST	192.168.2.4	185.141.152.26	0x16c2	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:23.223731995 CEST	192.168.2.4	185.141.152.26	0x16c2	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:27.239564896 CEST	192.168.2.4	185.141.152.26	0x16c2	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:32.994116068 CEST	192.168.2.4	1.2.4.8	0xa94c	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:33.989332914 CEST	192.168.2.4	1.2.4.8	0xa94c	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:35.330679893 CEST	192.168.2.4	1.2.4.8	0xa94c	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:37.344841003 CEST	192.168.2.4	1.2.4.8	0xa94c	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:41.348963976 CEST	192.168.2.4	1.2.4.8	0xa94c	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:44.214549065 CEST	192.168.2.4	1.2.4.8	0x2b37	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:46.163115025 CEST	192.168.2.4	114.114.114.114	0xc577	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:46.482877016 CEST	192.168.2.4	114.114.114.114	0x8e45	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:48.818793058 CEST	192.168.2.4	1.1.1.1	0x5597	Standard query (0)	oryadshow.wm01.to	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:49.564217091 CEST	192.168.2.4	185.141.152.26	0x36a0	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:50.567548037 CEST	192.168.2.4	185.141.152.26	0x36a0	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:51.567507982 CEST	192.168.2.4	185.141.152.26	0x36a0	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:53.586507082 CEST	192.168.2.4	185.141.152.26	0x36a0	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:57.583372116 CEST	192.168.2.4	185.141.152.26	0x36a0	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:38:01.599688053 CEST	192.168.2.4	185.141.152.26	0xad8	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:38:02.616705894 CEST	192.168.2.4	185.141.152.26	0xad8	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:38:03.614784956 CEST	192.168.2.4	185.141.152.26	0xad8	Standard query (0)	ee01439035b99fed4b57e5bd255d5faa.se	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 12:36:20.713251114 CEST	1.1.1.1	192.168.2.4	0xe279	No error (0)	sdns.se		185.141.152.26	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:36:20.763101101 CEST	1.1.1.1	192.168.2.4	0xcf70	No error (0)	ntp.se		194.58.200.20	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:00.588907003 CEST	1.2.4.8	192.168.2.4	0xea98	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:01.808985949 CEST	1.2.4.8	192.168.2.4	0xf637	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:04.064342976 CEST	114.114.114.114	192.168.2.4	0xe499	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:04.308197975 CEST	114.114.114.114	192.168.2.4	0x83d4	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:06.431488991 CEST	1.1.1.1	192.168.2.4	0x710c	Name error (3)	oryadshow.wm01.to	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:44.213418961 CEST	1.2.4.8	192.168.2.4	0xa94c	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:44.213443041 CEST	1.2.4.8	192.168.2.4	0xa94c	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:44.416883945 CEST	1.2.4.8	192.168.2.4	0x2b37	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:46.481390953 CEST	114.114.114.114	192.168.2.4	0xc577	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:46.791703939 CEST	114.114.114.114	192.168.2.4	0x8e45	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:48.609683990 CEST	1.2.4.8	192.168.2.4	0xa94c	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:48.609761000 CEST	1.2.4.8	192.168.2.4	0xa94c	Name error (3)	ee01439035b99fed4b57e5bd255d5faa.se	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 12:37:48.836244106 CEST	1.1.1.1	192.168.2.4	0x5597	Name error (3)	oryadshow.wm01.to	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:35:58
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\regscs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\regscs.exe"
Imagebase:	0x400000
File size:	1'294'848 bytes
MD5 hash:	FE4001F3584462A292BFF67B021A7337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_WebMonitor, Description: Yara detected WebMonitor RAT, Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Revcoderat_8e6d4182, Description: unknown, Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RevCodeRAT, Description: Detects RevCode/WebMonitor RAT, Source: 00000000.00000002.1826479164.0000000002A40000.00000040.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:36:12
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\regscs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\regscs.exe"
Imagebase:	0x400000
File size:	1'294'848 bytes
MD5 hash:	FE4001F3584462A292BFF67B021A7337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	06:36:22
Start date:	17/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs"
Imagebase:	0x7ff6c6af0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:36:22
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\regscs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\regscs.exe"
Imagebase:	0x400000
File size:	1'294'848 bytes
MD5 hash:	FE4001F3584462A292BFF67B021A7337
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:36:34
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\regscs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\regscs.exe"
Imagebase:	0x400000
File size:	1'294'848 bytes
MD5 hash:	FE4001F3584462A292BFF67B021A7337
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.6%
Total number of Nodes:	162
Total number of Limit Nodes:	13

Executed Functions

Function 004B9925 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 004BDA84

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 5737cda7caa6160263ce0f34cf477380f99015675d280388a74db60fb22eb9bd
Instruction ID: ec5bb0ca97f6b343b426973eb3bb5d060ce9aa77bdb553a8de1bf2d6d7cb8fb9
Opcode Fuzzy Hash: 5737cda7caa6160263ce0f34cf477380f99015675d280388a74db60fb22eb9bd
Instruction Fuzzy Hash: 9BD0123080CA45FFC7155B90C9458EABBB4FF193147114CC2E54294450C729BD11EB35

Function 004B884E Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?), ref: 004BB845

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 057339c4d6731164af3514b262df0940dc9cf6616e37506aa80643c6a0f05fa8
Instruction ID: 2849a24b6a7d72f7ab787584e48b3dca02c3674f44555c09283ca927d2ece0f5
Opcode Fuzzy Hash: 057339c4d6731164af3514b262df0940dc9cf6616e37506aa80643c6a0f05fa8
Instruction Fuzzy Hash: EAC00231108244EFCF06AF14C8549E83B75BF05300B1695A2F5199B526C379AA65EBA6

Function 004B9670 Relevance: 1.5, APIs: 1, Instructions: 8nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 004B9670

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 5669ccf2e1b7a8374bc76f2b2e898166adfdfcc2203c29c201caf0a3bd8b1bae
Instruction ID: dccf6b28bb19772e2937099296e85013d80e9835d6aaa4401e36b418e5d61c30
Opcode Fuzzy Hash: 5669ccf2e1b7a8374bc76f2b2e898166adfdfcc2203c29c201caf0a3bd8b1bae
Instruction Fuzzy Hash: 9AB01231340102CBC74D0234549B7A520941702209F0400BB7023D14E0CE00C8008502

Function 004BDA78 Relevance: 1.5, APIs: 1, Instructions: 7nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 004BDA84

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 44ee1da29a652fd04cb5752c90f7d82a27d382dc6a9d1d9551aa16aa3d8c1411
Instruction ID: 6f23298420f3bc0e38b9bb3211310361d32e75d268302616b9ccda995d476567
Opcode Fuzzy Hash: 44ee1da29a652fd04cb5752c90f7d82a27d382dc6a9d1d9551aa16aa3d8c1411
Instruction Fuzzy Hash: 2FC09232508A09EFDF128B90C8488FEBB7AFF48304B100891F64265460C77ABD21AB75

Function 004B84BF Relevance: 1.5, APIs: 1, Instructions: 7nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?), ref: 004BCF72

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bf3e07c49c6b17d9d38d816fcbb7b518b53d4b2ee79006393b686a426149cfe1
Instruction ID: d261481e8ba8f875883dd8ff52e6cd3191d545f009d43dcc63e100fe1204f119
Opcode Fuzzy Hash: bf3e07c49c6b17d9d38d816fcbb7b518b53d4b2ee79006393b686a426149cfe1
Instruction Fuzzy Hash: 30C0923150841AEFCF804F64C8D46ECB77BBF09305F10817AE11AA9924CB386451EF66

Function 004BB83D Relevance: 1.5, APIs: 1, Instructions: 5nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?), ref: 004BB845

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: e7492d92574e26c8732fac88902880ce7d0fe9e6801a68fe6aec94ede1a2988b
Instruction ID: cc0846909bfa5a68313b7a38928b1fd6318c3f281d7342dbb6c2deceaf9634df
Opcode Fuzzy Hash: e7492d92574e26c8732fac88902880ce7d0fe9e6801a68fe6aec94ede1a2988b
Instruction Fuzzy Hash: 9AB09231000004EFCF055F50C848EEC3B32BF08300F1581A0F4298A02183329420EB22

Function 004BA4A9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebe36bbcbb0e47d8823376c7dc840094feeb4dda5d4581a202c08c961ecfdd4
Instruction ID: f6646da48d4ad65943a6f0c14e815708a39e8fa8ca33924092480f0535b9315d
Opcode Fuzzy Hash: 1ebe36bbcbb0e47d8823376c7dc840094feeb4dda5d4581a202c08c961ecfdd4
Instruction Fuzzy Hash: E1E0123171C215DE8B12852588801FD66A5F99534077118E7D403D7415F7BC6A43A6BB

Function 004B8A17 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dacf9e67b7a018796e5efc32e29be52e9d7f80a66ef19be9e78b0eb35faa6dc
Instruction ID: 2eed79c8a8455af7e2e3f5b3cc296cea2b552d00e13625dd74a5a70903ee3494
Opcode Fuzzy Hash: 3dacf9e67b7a018796e5efc32e29be52e9d7f80a66ef19be9e78b0eb35faa6dc
Instruction Fuzzy Hash: 12D0A77181D380DFCB134B0084920993BB8AE5630032308C3C0408B063D56D0906C3B7

Function 004BDD18 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 151
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,20FEF5D5,00003000,00000004), ref: 004BDDAB
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004BDDCE

Strings

E, xrefs: 004BDD50
., xrefs: 004BDD59
S, xrefs: 004BDD47

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: .$E$S
API String ID: 2087232378-3797479634
Opcode ID: 0d425222cef3699fa6bd29a3fac4caea1a75664e95120dea10f1b3659d61a61f
Instruction ID: 4d3cb1f2153dfd55af97550fa0f0daa3680cef1e3acd87d8742de971e504d28b
Opcode Fuzzy Hash: 0d425222cef3699fa6bd29a3fac4caea1a75664e95120dea10f1b3659d61a61f
Instruction Fuzzy Hash: 18410771F8471526EB607BE64C83BAE25589B11B09F5244BFF64A7D2C2F8FC9810463E

Function 004BD275 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 004BD2FB

Strings

ware, xrefs: 004BD297
reVM, xrefs: 004BD290
MMXe, xrefs: 004BD2A5
t , xrefs: 004BD281
XenV, xrefs: 004BD29E
nVMM, xrefs: 004BD2AC

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID: MMXe$XenV$nVMM$reVM$t $ware
API String ID: 4275171209-3804153228
Opcode ID: 265c012178d428d959e7021aae73e46d6d088262144111a79db5f071427c8099
Instruction ID: 1e8549a3621baa252dcfb9761708c3ec0470a234f38af023d6f4953a6de884e7
Opcode Fuzzy Hash: 265c012178d428d959e7021aae73e46d6d088262144111a79db5f071427c8099
Instruction Fuzzy Hash: C5F0F674C05388DECB0A8F9481557DD7F30BF11704F1900CAD5252E252E7348902CB2A

Function 004B9660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 37
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 004BA264

Strings

l32, xrefs: 004BA25D
32, xrefs: 004BB2FA
shel, xrefs: 004BA256
user, xrefs: 004BB2F3

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: LibraryLoad
String ID: 32$l32$shel$user
API String ID: 1029625771-2982339341
Opcode ID: 716f046d01602da26caa20e38415b16a8bda18287d36d585571717c2ff4a971d
Instruction ID: 65197823f1afc64a6ea6b93ff7ed8f911e24c03c1dda243d965ff4b71b1c8480
Opcode Fuzzy Hash: 716f046d01602da26caa20e38415b16a8bda18287d36d585571717c2ff4a971d
Instruction Fuzzy Hash: A7F04470D08745EEC701DFE589847DEBBF8AF05300F10489E9506A6211EBB856019B7B

Function 004BDD16 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,20FEF5D5,00003000,00000004), ref: 004BDDAB
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004BDDCE

Strings

E, xrefs: 004BDD50
., xrefs: 004BDD59
S, xrefs: 004BDD47

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: .$E$S
API String ID: 2087232378-3797479634
Opcode ID: 28a1c0a15c49bf8aab80ac2b2df4a8dfb66131a545a43bdec3a9550df2d0ec0e
Instruction ID: 58820b5c1730fea57c5d8b310e6d3f3a6fc7a046677abb983dfc81c831c5564c
Opcode Fuzzy Hash: 28a1c0a15c49bf8aab80ac2b2df4a8dfb66131a545a43bdec3a9550df2d0ec0e
Instruction Fuzzy Hash: FA212470B887412AF7316AA64C13BA7364CC756B14F1248FBF649A95C2F8BC9860857E

Function 004BA226 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 004BA264

Strings

l32, xrefs: 004BA25D
shel, xrefs: 004BA256

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: LibraryLoad
String ID: l32$shel
API String ID: 1029625771-1709104459
Opcode ID: a9c99128074d110405ab9455dbfc1f90ba92e2aa7327b0024ee5a19c90d6076e
Instruction ID: c2451f108d0db1dd54c96dbf49832ada2150c53d4bf27e5effc7bb864737a278
Opcode Fuzzy Hash: a9c99128074d110405ab9455dbfc1f90ba92e2aa7327b0024ee5a19c90d6076e
Instruction Fuzzy Hash: A6E06DB0D04345DFCB10EFF189D879ABBF4AF15304B10086E9206A7210EBB89600CB7B

Function 004BA51E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?), ref: 004BA52C
CloseHandle.KERNELBASE(?,?,?,?,?), ref: 004BA530

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CloseFileHandleWrite
String ID:
API String ID: 1769507746-0
Opcode ID: ed51198e4d30cc6016a2df2a2ff5884019adecffbeb254a4651f08340fbd18dc
Instruction ID: 98a3aa036e33ab6b4d3670d0e9b0af87e21e262ec13c7df760319d57b32c9f6a
Opcode Fuzzy Hash: ed51198e4d30cc6016a2df2a2ff5884019adecffbeb254a4651f08340fbd18dc
Instruction Fuzzy Hash: ADD0C972401608FECB109BB4CE4C89FBBBCBF48751B50A86AB10385400DA34E601DF20

Function 004BDD8A Relevance: 2.5, APIs: 2, Instructions: 42
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,20FEF5D5,00003000,00000004), ref: 004BDDAB
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004BDDCE

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8a153fdb3ab2a3ed38fb03f6c039a7da89a6c9f1d5bc52652e6e19446fbdbed9
Instruction ID: eb797a2cd8a99094ae1139de58f9a05fefc4ae6c0a4a54498e9b720d83cb5715
Opcode Fuzzy Hash: 8a153fdb3ab2a3ed38fb03f6c039a7da89a6c9f1d5bc52652e6e19446fbdbed9
Instruction Fuzzy Hash: EDF05471B8970225F5643BF60C83B5A00448B61B19F6248BFB34B7D5C3ECED9810417E

Function 004B83EA Relevance: 2.5, APIs: 2, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 004B83F8
VirtualFree.KERNELBASE(?,?,00008000), ref: 004B9F8A

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f45c8208e06d20bdeb35c546c086240e379ada067c714ff9d5dcdd34d3f1269f
Instruction ID: 54b08245f474314eb30484963162123c8c2b73f58246847ddc56dc6955a6e7f4
Opcode Fuzzy Hash: f45c8208e06d20bdeb35c546c086240e379ada067c714ff9d5dcdd34d3f1269f
Instruction Fuzzy Hash: 78F01771208711AFD7106B34CCC8BAF7BB9EF86300F41481AF59296016DB78A8499AB7

Function 004B8130 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(000000FF,?,00005B7E,00000040,?), ref: 004B814C

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c5ee3ee21270aa948f47f23ee469559e080ed7c064997ff9cfcb8968da312b7c
Instruction ID: 8b7212dee4f003ef41d3a70e22c8f916b557a3ef3bb14d9c888f7f4b1fbfa0c3
Opcode Fuzzy Hash: c5ee3ee21270aa948f47f23ee469559e080ed7c064997ff9cfcb8968da312b7c
Instruction Fuzzy Hash: 7D01F270545249AECB009FB8CCC1BDB776CAB06311F1401BEE660662C1DF386602D67A

Function 004B9FC7 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546b83f6e1d79d5cf9e4ec12ab4be084112f0912e1fd08811d549a71cdcf8164
Instruction ID: 1c1087e74314eb97161acc17df755ebf0e7cc1d1a249a3980ad50e52522901ad
Opcode Fuzzy Hash: 546b83f6e1d79d5cf9e4ec12ab4be084112f0912e1fd08811d549a71cdcf8164
Instruction Fuzzy Hash: 71016D70109300CBDA29AB2084D1FEA77B5AF50305F25045FE6968A181EB38EC46DB3B

Function 004B8A59 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 004BC011

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0f74ad2e50ca0263e8cff12489b293beb0fc35f120e34e6ae27ac75db11ff614
Instruction ID: 603f8d1bfca8ee72f5b3fc276f060009a942856d4a1d037b69cf5b3343668c2c
Opcode Fuzzy Hash: 0f74ad2e50ca0263e8cff12489b293beb0fc35f120e34e6ae27ac75db11ff614
Instruction Fuzzy Hash: 7BE0922000C280DEC717466080A8BFA3FB48F42302F2948CBE1828908AC728C801E677

Function 004BCA98 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?), ref: 004BCAB8

Part of subcall function 004BA183: CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 004BD5DC

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: File$CreateDelete
String ID:
API String ID: 1264090339-0
Opcode ID: 5efae7b9a7c693be10914b1e4f9b85d0ec24bb5fdafe206af23cb818f9d4ad1b
Instruction ID: 009a975a7b582e5dbedef3498d099a47e2f5775fce8837d6f9a9c213f19c6330
Opcode Fuzzy Hash: 5efae7b9a7c693be10914b1e4f9b85d0ec24bb5fdafe206af23cb818f9d4ad1b
Instruction Fuzzy Hash: FAE0ED7280011EABDB62EFA0CC48EDA777CAF08304F0405D2A519D2001EA349B9A9BB6

Function 004BA183 Relevance: 1.5, APIs: 1, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 004BD5DC

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dffa19b66f2676e0b23e020fa21fd3a361c1c06f788c718d720e6f81f454f383
Instruction ID: d4ffe608a41554c5c0d9beb3e216c0ec60dec2e012ac398fb58c24a9f887777b
Opcode Fuzzy Hash: dffa19b66f2676e0b23e020fa21fd3a361c1c06f788c718d720e6f81f454f383
Instruction Fuzzy Hash: 5ED012A0008284BAE33009138C0EF673D3CE7C2F54E90441AB5035449157645C42A4B7

Function 004BB55C Relevance: 1.5, APIs: 1, Instructions: 15
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32 ref: 004BB568

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c940c4fbdb8a227fd90e1820844fd7bec71248cfc593cf40ad807790fa859928
Instruction ID: fc8283e1a3e2263270b5a3a47ccad2627626b6e01e017e6216b5ec63075ca827
Opcode Fuzzy Hash: c940c4fbdb8a227fd90e1820844fd7bec71248cfc593cf40ad807790fa859928
Instruction Fuzzy Hash: 4DD01732B04605AFCB119F74C8C82DD7BB6BF5A3017420492D006AA014C738AD10CB6B

Function 004BA99F Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE ref: 004BD790

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 33ce7cb4704d78c5ff59e02dce65632046e56471898b183784b9e621423017f9
Instruction ID: 09c6ba8f1fe734211bf3953f43930b8fba23d60e1831913ffecdd6c5e773172e
Opcode Fuzzy Hash: 33ce7cb4704d78c5ff59e02dce65632046e56471898b183784b9e621423017f9
Instruction Fuzzy Hash: 6FD0C972904140FB8B208E1A8CC8CAFBBB9FFD671076148DEF04693104C7346A11DA36

Function 004BAD28 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 004BC011

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 294473a1f4cbd78927da93ad72eaa01797a8ff8e1db2564b22f9685fcdbe76e8
Instruction ID: ac28975eed5a9ac6ac919685e25eb48d45fd8a379ecf3b26a28c5b1c58d34618
Opcode Fuzzy Hash: 294473a1f4cbd78927da93ad72eaa01797a8ff8e1db2564b22f9685fcdbe76e8
Instruction Fuzzy Hash: 7FD01226344710CBD7212AA584C57DD72915F06305F520077EB0656259D6ECAC47D6BB

Function 004BBA7A Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 004BD5DC

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f4977b0dedc37f31fd15dbee41b434687c0e700d3f76eb65eb02ffab2570d99a
Instruction ID: bca133907180dbde115131f4f552c2365562662e54319caf8d5679ac82751989
Opcode Fuzzy Hash: f4977b0dedc37f31fd15dbee41b434687c0e700d3f76eb65eb02ffab2570d99a
Instruction Fuzzy Hash: 63C04C70144180B6E7340E13CC4EF5B3E75EBC5B05F91445AB5075C8A18B745D52EA76

Function 004BC01D Relevance: 1.5, APIs: 1, Instructions: 12threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?), ref: 004BCC5A

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1ec3c545c7a7529761042c7f9ae70106cf369331c497b79a9f4c7aafe3130ec3
Instruction ID: 7e749597201a9e24aafffd0880965a7b73299c1280e49dda019a5b02570e50aa
Opcode Fuzzy Hash: 1ec3c545c7a7529761042c7f9ae70106cf369331c497b79a9f4c7aafe3130ec3
Instruction Fuzzy Hash: CAD0A730004295DFDB088F21C4CCB987F75FF01300F1441ADC84A4A411D7382440DF71

Function 004BD77A Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 004BD790

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7d6af43bfeff61d590bf5c1244807191be7a95953a7be3e9dd49305a3701093b
Instruction ID: 23376cdbf53c31c696391ab2b9559df16f67f696041d64c033b3d6ce79609098
Opcode Fuzzy Hash: 7d6af43bfeff61d590bf5c1244807191be7a95953a7be3e9dd49305a3701093b
Instruction Fuzzy Hash: 24D0C933700510DB8F11CF09C4C41AEB777FEC13107E24486E0426710497B87D419AA7

Function 004B825D Relevance: 1.5, APIs: 1, Instructions: 10processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 004B826E

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 892761419855abeb9055df8f466bc5d222715ff4f5b4fcc44ca891e8cd09363b
Instruction ID: 10549db53c3924baf15e49882e38ce90a3564ce134518200e25aeae0b19b2aff
Opcode Fuzzy Hash: 892761419855abeb9055df8f466bc5d222715ff4f5b4fcc44ca891e8cd09363b
Instruction Fuzzy Hash: 98D0C232704521CFCB589B18C4E855C7772FF413457E254A5D002AB415C7B47995DF96

Function 004BCC43 Relevance: 1.5, APIs: 1, Instructions: 8threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?), ref: 004BCC5A

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8730aa73cac959a0bdf7d526b008f0a88574e8a6984f8daf8334c7eb32f2a866
Instruction ID: a28ef8d62c349e3c34052934b3976c98d48b3398819068f5a23e8e6d0434722c
Opcode Fuzzy Hash: 8730aa73cac959a0bdf7d526b008f0a88574e8a6984f8daf8334c7eb32f2a866
Instruction Fuzzy Hash: 18B09B35410412D7CA04051184452D477757B39314B61021AD16991110DE3548125764

Function 004BD5CF Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 004BD5DC

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 67690bbce89891d4f307aead8b27bec104e65bb9a7029d87560e2646fe13ca1d
Instruction ID: 7831de93fb568663276acfaa4fc5695f597af193dced40775a07775ae8286323
Opcode Fuzzy Hash: 67690bbce89891d4f307aead8b27bec104e65bb9a7029d87560e2646fe13ca1d
Instruction Fuzzy Hash: 2AA01130000800EBCB000F02C88808C3B32BF003003020822E0038E830C330B8A2AA83

Function 004BC7C7 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32 ref: 004BC7CE

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 516714dde3ec5604a5e33bc2de77af9843e2196fd233ae5c141b8a1ff67af194
Instruction ID: 893a1a5f2dac612670decfcbd4773c20bee61da4c8c99e7fbde246bc3725cea9
Opcode Fuzzy Hash: 516714dde3ec5604a5e33bc2de77af9843e2196fd233ae5c141b8a1ff67af194
Instruction Fuzzy Hash: 48B001F1204511FFB6005A688C88E7FB72DEA552613211551BC46DA006C779AC119AB6

Function 004B81EC Relevance: 1.3, APIs: 1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9057338b1f3d92b48a017a035dde2cb39e80d5d75572f7445390586e20107ac4
Instruction ID: fb78749a39b6e15c20d5ca8158357fb03e02e9fc55d82070c532b5e360ef37a8
Opcode Fuzzy Hash: 9057338b1f3d92b48a017a035dde2cb39e80d5d75572f7445390586e20107ac4
Instruction Fuzzy Hash: 89118271248300EAE3148A548C85FFB77A8EB41700F10081BEB969A181E7B8ED27D77B

Function 004BA482 Relevance: 1.3, APIs: 1, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00003000,00000040), ref: 004BB93B

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a3d256574fad5cfbc3e12ea0a3be4619735a0dae0c9fc2b243e4e1203bb41d91
Instruction ID: c3756b0cd52eea0031d26c47708a096afe203b4d0bf5f4ba558a8b7c9c61d0d4
Opcode Fuzzy Hash: a3d256574fad5cfbc3e12ea0a3be4619735a0dae0c9fc2b243e4e1203bb41d91
Instruction Fuzzy Hash: 4BF0A770909380EFD3126BB54855BA5BFF4AF06300F28489FF6D69B182CA3C5881C77A

Function 004B96D4 Relevance: 1.3, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00003000,00000040), ref: 004BB93B

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2646a2a870a6af9ea23edbd5fbd60bbe2d7e8f1a51faa9178376c778b403cfb6
Instruction ID: 80a7358e0c994c06fe47979a250dc5c6e60ba60ab2b1090ba816801889e84445
Opcode Fuzzy Hash: 2646a2a870a6af9ea23edbd5fbd60bbe2d7e8f1a51faa9178376c778b403cfb6
Instruction Fuzzy Hash: 10F09B70A04700FFE7146BB5484DBF675D4EF05300F24042FB29AAA280D97C5841577F

Function 004B855B Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 004BBEF6

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b8b43a38420daa4528b260e0056f6df114d703bddd29722ac9325cd76148c726
Instruction ID: 9e3eae2a703b221275a9b3f04b3ada8d186bb767810a9d7459ea4d891241aa97
Opcode Fuzzy Hash: b8b43a38420daa4528b260e0056f6df114d703bddd29722ac9325cd76148c726
Instruction Fuzzy Hash: EAE0BFB1644740EBE7648A608C4DFAB7BB8EB85B01F10481DF646C9180D7B4E800C776

Function 004BD2EB Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 004BD2FB

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4808ccc2fa0b8186c81a7278e4358c84581085f7dea7c5d03cdb0448686cb6d9
Instruction ID: 5413f2df79023588b9f40ac4a30eccf8274bfe5bc361057254403f5e80e0dfa2
Opcode Fuzzy Hash: 4808ccc2fa0b8186c81a7278e4358c84581085f7dea7c5d03cdb0448686cb6d9
Instruction Fuzzy Hash: 30D02335244304BBDB1515964C1DFA63718DBC4F21F14C03BF70D596D16DB5D013463A

Function 004BA125 Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004BA138

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2f71b2e6813f83c56b15bedbcc333969a60cc3260a643cc000c2e1ad8c03d3d5
Instruction ID: 8315ed5a31abc2ce43fb200fde40a3d839ae49e597cf1d35c04fae0346b4995a
Opcode Fuzzy Hash: 2f71b2e6813f83c56b15bedbcc333969a60cc3260a643cc000c2e1ad8c03d3d5
Instruction Fuzzy Hash: 26E04631A08741DFC701CF14C881B5A7BF1EF81300F21489AE0919A055C330E84ACB8B

Function 004BD2E6 Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 004BD2FB

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 87460f2ea6c543706a71759fc726f9c5a46965a8edca092798f35783bae74650
Instruction ID: 868c68b5d660801c8347678b116364fe853f927f56689ec4c9a3cdf058c8008d
Opcode Fuzzy Hash: 87460f2ea6c543706a71759fc726f9c5a46965a8edca092798f35783bae74650
Instruction Fuzzy Hash: CDD05E32340200AEDB254A69C886FAD3732AFC0B11F658169E6056B2849BB0A441CF55

Function 004BB933 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00003000,00000040), ref: 004BB93B

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0321077620923ce31b5bd3516e5902d735819e08a4763451a019c955c08d816d
Instruction ID: 28ec3c71c2d6f88b9d577a568a1040a37d3805c523d208244956de42b0fd6ee3
Opcode Fuzzy Hash: 0321077620923ce31b5bd3516e5902d735819e08a4763451a019c955c08d816d
Instruction Fuzzy Hash: 75E0EC70D04700DBC750ABB684886A9B6E5AF41300F14086FE19AA7201DA3854419B7A

Function 004BBEDD Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000004), ref: 004BBEF6

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 29b4004a361227823c46964ec4b280060ed4e2a3f91c962480c9ad063a497885
Instruction ID: 9ff541b94316dcdfd13249bfd9ff06e8a94d28552111dd45c47d7a72c169551b
Opcode Fuzzy Hash: 29b4004a361227823c46964ec4b280060ed4e2a3f91c962480c9ad063a497885
Instruction Fuzzy Hash: A4C08CB5104700DFF3440E208C16BB23BB4FF00B0AF080209FD4AD9281EAB08E159A66

Function 004BA094 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 004BA098

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02917724f80f9b33fd6be65a6e71095c523e4f9440932657e1117069af48e971
Instruction ID: fb87f6b946bb0cea586f9bc01705e75a8c588470e9bdcdf052e039cfcb6c8d91
Opcode Fuzzy Hash: 02917724f80f9b33fd6be65a6e71095c523e4f9440932657e1117069af48e971
Instruction Fuzzy Hash: C1D0123260C110CBC7204F28D4843ADB7E1FB95300F21456BC547D3104D37C78469B6B

Function 004BCF56 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 004BCF56

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca9141850d09aa91cef8325a9e082fc8326ff54fd596741c848b9a7b722af795
Instruction ID: 16aa95483dec47f1b387c175dbf37dd5740b62b766d969040abac79289db6d28
Opcode Fuzzy Hash: ca9141850d09aa91cef8325a9e082fc8326ff54fd596741c848b9a7b722af795
Instruction Fuzzy Hash: CBC08C36B0962187C2214D3884402DA6294AB04310B000427E802E2200DA14DC0186E5

Function 004BB85D Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 004BB85E

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98ff7085596f30aa202ab122dcf38ba26ca121219cd86eb4f7d87f8228e7cd6a
Instruction ID: 991e40e51db31b90f6e9ccb3a674f4cc7950094324d82eecfab3266ca0a0fd95
Opcode Fuzzy Hash: 98ff7085596f30aa202ab122dcf38ba26ca121219cd86eb4f7d87f8228e7cd6a
Instruction Fuzzy Hash: AAC09BB1404105EECB494B50CC44BF9757CFF08348F200153F057A5014C7BC14516777

Function 004BB139 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000100,00003000), ref: 004BB145

Memory Dump Source

Source File: 00000000.00000002.1825812592.00000000004B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 004B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b8000_regscs.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5943e2d9133153ef9b4d9841af50974a8051d56dfa09640ce60615a0f746913e
Instruction ID: 104070c8a60a08d9292fbc57d2c7c1d2e7cf6a32bafc3a50a6af59c37a86aded
Opcode Fuzzy Hash: 5943e2d9133153ef9b4d9841af50974a8051d56dfa09640ce60615a0f746913e
Instruction Fuzzy Hash: C0A002303C930164F09652904C63FA404590704F15E30100573453D0C008D8A142902E

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report regscs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svcreg.exe.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

UDP Packets

ICMP Packets

Windows Analysis Report
regscs.exe

Function 004BDD18 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 151
memoryCOMMON

Function 004BD275 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 30
memoryCOMMON

Function 004B9660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 37
libraryCOMMON

Function 004BDD16 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 79
memoryCOMMON

Function 004BA226 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23
libraryCOMMON

Function 004BA51E Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 004BDD8A Relevance: 2.5, APIs: 2, Instructions: 42
memoryCOMMON

Function 004B83EA Relevance: 2.5, APIs: 2, Instructions: 33
memoryCOMMON

Function 004B8130 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 004B9FC7 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Function 004B8A59 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Function 004BCA98 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 004BA183 Relevance: 1.5, APIs: 1, Instructions: 17
fileCOMMON

Function 004BB55C Relevance: 1.5, APIs: 1, Instructions: 15
threadCOMMON

Function 004BA99F Relevance: 1.5, APIs: 1, Instructions: 14
COMMON