Edit tour

Windows Analysis Report
Aviso de transferencia.exe

Overview

General Information

Sample name:	Aviso de transferencia.exe
Analysis ID:	1538536
MD5:	8d664129af173ed945236efb82d4ad67
SHA1:	7e0f8f79786ebbeb561171032ea65fcfcd6db437
SHA256:	ae26ace2f3bcb3c94a3a8af4a6684da129aa08d73c18a5311d7491d006b20042
Tags:	exeuser-lowmal3
Infos:

Detection

AsyncRAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Aviso de transferencia.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\Aviso de transferencia.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

Aviso de transferencia.exe (PID: 7212 cmdline: "C:\Users\user\Desktop\Aviso de transferencia.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

cmd.exe (PID: 7588 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7684 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 7608 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7740 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

windowsBook.exe (PID: 7800 cmdline: "C:\Users\user\AppData\Local\Temp\windowsBook.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

windowsBook.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\windowsBook.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

windowsBook.exe (PID: 7760 cmdline: C:\Users\user\AppData\Local\Temp\windowsBook.exe MD5: 8D664129AF173ED945236EFB82D4AD67)

windowsBook.exe (PID: 7840 cmdline: "C:\Users\user\AppData\Local\Temp\windowsBook.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

windowsBook.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\Temp\windowsBook.exe" MD5: 8D664129AF173ED945236EFB82D4AD67)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "quin.ydns.eu", "Port": "1962", "Version": "0.5.8", "MutexName": "8xLI57IVXCDFxeWa@", "Autorun": "true", "Group": "null"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x76ba1:$x1: AsyncRAT 0x76bdf:$x1: AsyncRAT

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1276809734.0000000009470000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000014.00000002.1444950747.0000000005630000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x15cb:$x1: AsyncRAT 0x1609:$x1: AsyncRAT
00000008.00000002.1321474542.0000000001F88000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xaf53:$x1: AsyncRAT 0xaf91:$x1: AsyncRAT
00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa10b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000016.00000002.2483789589.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x490d3:$x1: AsyncRAT 0x49111:$x1: AsyncRAT
00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x11e3b:$x1: AsyncRAT 0x11e79:$x1: AsyncRAT 0x14803:$x1: AsyncRAT 0x14841:$x1: AsyncRAT 0x1751f:$x1: AsyncRAT 0x1755d:$x1: AsyncRAT
00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x10459:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1c335:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x287dd:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x11818:$a2: Stub.exe 0x118a8:$a2: Stub.exe 0x1d6f4:$a2: Stub.exe 0x1d784:$a2: Stub.exe 0x29bb4:$a2: Stub.exe 0x29c44:$a2: Stub.exe 0xd07d:$a3: get_ActivatePong 0x18f59:$a3: get_ActivatePong 0x25401:$a3: get_ActivatePong 0x10671:$a4: vmware 0x1c54d:$a4: vmware 0x289f5:$a4: vmware 0x104e9:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1c3c5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x2886d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xde77:$a6: get_SslClient 0x19d53:$a6: get_SslClient 0x261fb:$a6: get_SslClient
00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x104eb:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x1c3c7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2886f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xec0a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2b78b:$x1: AsyncRAT 0x2b7c9:$x1: AsyncRAT
00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x1ffbe:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1d9e7:$x1: AsyncRAT 0x1da25:$x1: AsyncRAT
00000000.00000002.1275781875.0000000003909000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x14095:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1ff71:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x87ff5:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x15454:$a2: Stub.exe 0x154e4:$a2: Stub.exe 0x21330:$a2: Stub.exe 0x213c0:$a2: Stub.exe 0x893cc:$a2: Stub.exe 0x8945c:$a2: Stub.exe 0x10cb9:$a3: get_ActivatePong 0x1cb95:$a3: get_ActivatePong 0x84c19:$a3: get_ActivatePong 0x142ad:$a4: vmware 0x20189:$a4: vmware 0x8820d:$a4: vmware 0x14125:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x20001:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x88085:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x11ab3:$a6: get_SslClient 0x1d98f:$a6: get_SslClient 0x85a13:$a6: get_SslClient
00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x14127:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x20003:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x88087:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000014.00000002.1440972671.000000000304C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x129fb:$x1: AsyncRAT 0x12a39:$x1: AsyncRAT
Process Memory Space: Aviso de transferencia.exe PID: 6756	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Aviso de transferencia.exe PID: 6756	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Aviso de transferencia.exe PID: 6756	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x9c240:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: Aviso de transferencia.exe PID: 7212	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Aviso de transferencia.exe PID: 7212	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x12b65:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x19186:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: Aviso de transferencia.exe PID: 7212	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8bce:$x1: AsyncRAT 0x8c00:$x1: AsyncRAT 0x18d75:$x1: AsyncRAT 0x18da7:$x1: AsyncRAT 0x12c2b:$s6: VirtualBox 0x12bde:$s8: Win32_ComputerSystem
Process Memory Space: windowsBook.exe PID: 7760	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: windowsBook.exe PID: 7760	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: windowsBook.exe PID: 7760	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2cf6f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: windowsBook.exe PID: 7800	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: windowsBook.exe PID: 7848	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x3a4:$x1: AsyncRAT 0x3d6:$x1: AsyncRAT 0x997d:$x1: AsyncRAT 0x99af:$x1: AsyncRAT
Process Memory Space: windowsBook.exe PID: 7928	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: windowsBook.exe PID: 7928	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x2c5d5:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: windowsBook.exe PID: 7928	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xad42:$x1: AsyncRAT 0xad74:$x1: AsyncRAT 0x33c34:$x1: AsyncRAT 0x33c66:$x1: AsyncRAT 0x33c7a:$x1: AsyncRAT 0x39edc:$x1: AsyncRAT 0x39f0e:$x1: AsyncRAT
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Aviso de transferencia.exe.294e1e0.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Aviso de transferencia.exe.294e1e0.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8479:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x509d:$a3: get_ActivatePong 0x8691:$a4: vmware 0x8509:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e97:$a6: get_SslClient
0.2.Aviso de transferencia.exe.294e1e0.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x850b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Aviso de transferencia.exe.295a0bc.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Aviso de transferencia.exe.295a0bc.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8479:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x509d:$a3: get_ActivatePong 0x8691:$a4: vmware 0x8509:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e97:$a6: get_SslClient
0.2.Aviso de transferencia.exe.295a0bc.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x850b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
8.2.Aviso de transferencia.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
8.2.Aviso de transferencia.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa279:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6e9d:$a3: get_ActivatePong 0xa491:$a4: vmware 0xa309:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c97:$a6: get_SslClient
0.2.Aviso de transferencia.exe.9470000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.Aviso de transferencia.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa30b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Aviso de transferencia.exe.391e790.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa279:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x16721:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x17af8:$a2: Stub.exe 0x17b88:$a2: Stub.exe 0x6e9d:$a3: get_ActivatePong 0x13345:$a3: get_ActivatePong 0xa491:$a4: vmware 0x16939:$a4: vmware 0xa309:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x167b1:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c97:$a6: get_SslClient 0x1413f:$a6: get_SslClient
0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa30b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x167b3:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
17.2.windowsBook.exe.2edae1c.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
17.2.windowsBook.exe.2edae1c.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8479:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x509d:$a3: get_ActivatePong 0x8691:$a4: vmware 0x8509:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e97:$a6: get_SslClient
17.2.windowsBook.exe.2edae1c.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x850b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa279:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x16155:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x225fd:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x17514:$a2: Stub.exe 0x175a4:$a2: Stub.exe 0x239d4:$a2: Stub.exe 0x23a64:$a2: Stub.exe 0x6e9d:$a3: get_ActivatePong 0x12d79:$a3: get_ActivatePong 0x1f221:$a3: get_ActivatePong 0xa491:$a4: vmware 0x1636d:$a4: vmware 0x22815:$a4: vmware 0xa309:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x161e5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x2268d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c97:$a6: get_SslClient 0x13b73:$a6: get_SslClient 0x2001b:$a6: get_SslClient
0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa30b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x161e7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x2268f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Aviso de transferencia.exe.9470000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.windowsBook.exe.2ee6cf8.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
17.2.windowsBook.exe.2ee6cf8.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8479:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x509d:$a3: get_ActivatePong 0x8691:$a4: vmware 0x8509:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5e97:$a6: get_SslClient
17.2.windowsBook.exe.2ee6cf8.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x850b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.Aviso de transferencia.exe.391e790.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.windowsBook.exe.2edae1c.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
17.2.windowsBook.exe.2edae1c.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.windowsBook.exe.2edae1c.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa279:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x16155:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x7e1d9:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x17514:$a2: Stub.exe 0x175a4:$a2: Stub.exe 0x7f5b0:$a2: Stub.exe 0x7f640:$a2: Stub.exe 0x6e9d:$a3: get_ActivatePong 0x12d79:$a3: get_ActivatePong 0x7adfd:$a3: get_ActivatePong 0xa491:$a4: vmware 0x1636d:$a4: vmware 0x7e3f1:$a4: vmware 0xa309:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x161e5:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7e269:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c97:$a6: get_SslClient 0x13b73:$a6: get_SslClient 0x7bbf7:$a6: get_SslClient
17.2.windowsBook.exe.2edae1c.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa30b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x161e7:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x7e26b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
17.2.windowsBook.exe.2ee6cf8.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
17.2.windowsBook.exe.2ee6cf8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.windowsBook.exe.2ee6cf8.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa279:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x722fd:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x736d4:$a2: Stub.exe 0x73764:$a2: Stub.exe 0x6e9d:$a3: get_ActivatePong 0x6ef21:$a3: get_ActivatePong 0xa491:$a4: vmware 0x72515:$a4: vmware 0xa309:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7238d:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7c97:$a6: get_SslClient 0x6fd1b:$a6: get_SslClient
17.2.windowsBook.exe.2ee6cf8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa30b:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x7238f:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 30 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Aviso de transferencia.exe", ParentImage: C:\Users\user\Desktop\Aviso de transferencia.exe, ParentProcessId: 7212, ParentProcessName: Aviso de transferencia.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' , ProcessId: 7684, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T14:18:28.281688+0200	2035595	1	Domain Observed Used for C2 Detected	185.38.142.240	1962	192.168.2.7	49775	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T14:18:28.281688+0200	2035607	1	Domain Observed Used for C2 Detected	185.38.142.240	1962	192.168.2.7	49775	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T14:18:28.281688+0200	2842478	1	Malware Command and Control Activity Detected	185.38.142.240	1962	192.168.2.7	49775	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "quin.ydns.eu", "Port": "1962", "Version": "0.5.8", "MutexName": "8xLI57IVXCDFxeWa@", "Autorun": "true", "Group": "null"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe

ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: Aviso de transferencia.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Aviso de transferencia.exe

Joe Sandbox ML: detected

Source: Aviso de transferencia.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Aviso de transferencia.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: CYFA.pdb source: Aviso de transferencia.exe, windowsBook.exe.8.dr
Source:	Binary string: CYFA.pdbSHA256~ source: Aviso de transferencia.exe, windowsBook.exe.8.dr

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 4x nop then jmp 0BF60C02h	0_2_0BF60457
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 4x nop then jmp 09C70C02h	17_2_09C70457
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 4x nop then jmp 09850C02h	18_2_09850457

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 185.38.142.240:1962 -> 192.168.2.7:49775
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.38.142.240:1962 -> 192.168.2.7:49775
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 185.38.142.240:1962 -> 192.168.2.7:49775
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 185.38.142.240:1962 -> 192.168.2.7:49775

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: quin.ydns.eu

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49775 -> 185.38.142.240:1962

Source: Joe Sandbox View

ASN Name: NETSOLUTIONSNL NETSOLUTIONSNL

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: quin.ydns.eu

Source: 77EC63BDA74BD0D0E0426DC8F80085060.22.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: windowsBook.exe, 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabo
Source: windowsBook.exe, 00000016.00000002.2483789589.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en2U
Source: Aviso de transferencia.exe, 00000008.00000002.1322217899.00000000036A8000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Aviso de transferencia.exe, windowsBook.exe.8.dr	String found in binary or memory: http://tempuri.org/DatabaseWalletDataSet.xsd

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000014.00000002.1444950747.0000000005630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000002.1321474542.0000000001F88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000016.00000002.2483789589.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000014.00000002.1440972671.000000000304C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: windowsBook.exe PID: 7848, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_0111D324	0_2_0111D324
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094D0040	0_2_094D0040
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094D3980	0_2_094D3980
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DC820	0_2_094DC820
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094D4B58	0_2_094D4B58
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DCC58	0_2_094DCC58
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094D0016	0_2_094D0016
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DD090	0_2_094DD090
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DC3E8	0_2_094DC3E8
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DC3B4	0_2_094DC3B4
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_094DE738	0_2_094DE738
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Code function: 0_2_0BF62A99	0_2_0BF62A99
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_02CED324	17_2_02CED324
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F0040	17_2_073F0040
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FE738	17_2_073FE738
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FC3E8	17_2_073FC3E8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FC3D2	17_2_073FC3D2
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F0006	17_2_073F0006
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FD090	17_2_073FD090
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FCC58	17_2_073FCC58
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F4B58	17_2_073F4B58
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F4B48	17_2_073F4B48
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F396F	17_2_073F396F
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073F3980	17_2_073F3980
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_073FC820	17_2_073FC820
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_09C72BD8	17_2_09C72BD8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_00FCD324	18_2_00FCD324
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE0040	18_2_06FE0040
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FEE738	18_2_06FEE738
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FEC3E8	18_2_06FEC3E8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FEC3D1	18_2_06FEC3D1
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FED090	18_2_06FED090
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE0007	18_2_06FE0007
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FECC58	18_2_06FECC58
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE4B58	18_2_06FE4B58
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE4B48	18_2_06FE4B48
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FEC820	18_2_06FEC820
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE3980	18_2_06FE3980
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_06FE396F	18_2_06FE396F
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_09852A7F	18_2_09852A7F
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CD63D8	22_2_02CD63D8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CD6CA8	22_2_02CD6CA8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CD6090	22_2_02CD6090
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CD75A8	22_2_02CD75A8
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CDAE88	22_2_02CDAE88

Source: Aviso de transferencia.exe, 00000000.00000002.1276938859.00000000096E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Aviso de transferencia.exe
Source: Aviso de transferencia.exe, 00000000.00000002.1275781875.0000000003909000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Aviso de transferencia.exe
Source: Aviso de transferencia.exe, 00000000.00000002.1274459240.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Aviso de transferencia.exe
Source: Aviso de transferencia.exe, 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs Aviso de transferencia.exe
Source: Aviso de transferencia.exe, 00000008.00000002.1320113027.000000000040E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs Aviso de transferencia.exe
Source: Aviso de transferencia.exe	Binary or memory string: OriginalFilenameCYFA.exeF vs Aviso de transferencia.exe

Source: Aviso de transferencia.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000014.00000002.1444950747.0000000005630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000002.1321474542.0000000001F88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000016.00000002.2483789589.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000014.00000002.1440972671.000000000304C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: windowsBook.exe PID: 7848, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Aviso de transferencia.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: windowsBook.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, at4ONG9F0NYCELN5Tj.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, OiHoolIAygQAXBT.cs	Base64 encoded string: 'yKawK3VpaUozVt7nSUZH+FnSyshePzOpFVCnRwX7U4ZB280WpfMTuTYeExR0FWuvbGpl3SI6rcp8bs+ljbVa2lDFNksGpMvQB+F6XFct3J60IeY1leqgjx0W7B1p+kqD/QtuP0XvjgWxZQ6bRM4s9auajVMXd2Y/Hgg/g2fz1ZipgNNWkwZoA0gfIfq8C+K+1i+++6eXPAokDnmrOM+EdaCtg8b5VGEj6UB1qrLieygyNrM6/SLeKezb1PA9AtA8U9IirRGLrYGl6gMwhQMH2ARPD9qVLreMF1ObJjWzeBmp1rLB4uTd/LTYiXbqf6vQ0SDyFPN74YEHEw5+xR5zSVxycirzV/2lIOJHuy1HYcQQVxoGAbLnZhMKMRQLzJEbpb/BoXIMSlHILNCGdkzsajyh/2CB9lgbze0+hcs7lWIUdnw/NG2Lh+NR9mTGqyRD8f6ztxYyBny2t7mnfhtYWyzP1/oxh+pwDbttOmnidk8vgIy4Z86FP2GdusQdiJac8alNHOjVOQGfiXF1PcBfUm0+IMYZU4BlX5S+8VjvPRSmWrd8hHO2nB+OflZE7cZ8+IQabffVZ7nGtNlcs5hpJV1n36PHaPpfOV1mftpl3KQ/IIepioZKvI0zVhG1R/MDkTxlmx+JcLVsaDJq02tWIAWR0dPcX5suErDeDucMUjXits8r7bCJ2GjAjghT1eu5Gu8Zl2ZRza7Iq/EA6DhGs5wcDpKYuHB/TOLrBxZV2S40V+lpzYBpbpzWEs6c6tIMHE3ejTrM0WAZR05tqWOuh+XvN4Ar/1NfvOHGxiSB8QZCoSyrCyJ785MPSL3gf49u/vm6Lkh1zPqAiS8w6VA1PpaEyeGajroYXuiWPP7obfDHTOwblMA6mf6orYIWZpWrFo94fu5vde5No6HKP5Yxo+VyFfKP4BwkSC75N4rviWlv81OiGc2r2X9HA3Jsc4Q6hrZSFiE7SoJhlraD1pP6yLDzfyNBmuuHE5I/e/deR6sSSPiejRj0u+JUrT+/h9acgZHQCTragNKUSpZMseB7Fiw5qpkclFu2scGyuXx+nKoO2KzPSbRjsXOfaApX/1ofb5tCm+hSFwTTih4mq7N0Tkh2mMQ4Z0ubCatWr9VO6bw3/EX5cF4oe3WV5uKBXly7ztB7lplwxOVmAxWZ3rbBOJofvRitOUtUmf/4Lgn1akzk/X8n4brrIUAMz9YS+lYKd0rLTpKme2XK3WRSa5DL/Z5Ar6MyscXBmwcY24C0yatbtGPlxZ1Lfj6Aexhbamrq8W2Ck6bqubyV+HSJvGJUcarOxwSAmQzDVNKmW3RxN452KM2y9VLc5jNxaYZdGdqteQFoDrrZb5fv0ZWR/fdDBAQCMhHQKkgfhVLIdWTr6hOpiDs9NnzmdYo0ER1y7Gj8J2whXqEYXznmo8y372z7j9PUPQhWCnEs/veEaNpHUpG4Yjy0GEvrzdp7tNpOxzDr433hsmkDwTgJHr3sD8uUGNJ0sgBTbOTtIC/hZCKqq1iieLppecA846W0MkBwrFZKesVwH/bmBMZlgbomvWhhIhEs9nGYSEAzLj0x4JkF//exESLXp6840pAL1HFBOLRknjEBXOFecVxcEgIRQZG/8NcfTlNUgJVm9re1UQP39qvdNyoESg/luLQ84lGy0DjQQpo5utjubbf0mggLLHic6Aaimct7g3buEckjUdLvvlK2LReaDwvkENlysrHLxpamLm6RRV139k/R3GBI1F1H6PbTST0J12/oFDv/1btrRvDU22dYPOLgAgRhzBOg4MlI4XrVvQUwcr2wMQbPZk1k5jixKcbjh5uJq8zl5ro3hrR5k7aWO71Qy9uxmbmD1EkZDOtYxLCMYe+eBkuE7FN7A/ioFIr/TVhMbSeP4iF4R8YS1DpJ7+1skdNZ6GeMfw/XBZJJGp/jH9ulBEolRrJ2NvXvgKDwWSw5lSEYKT5qXrX99BqwBqy3VLDQqpVEvVfuaMzqQVwpCPQI1blHF2FwZKXd6DSiO0Npi2XtAQcZjb/9SaEwoORNr8cowR/HkJIdV/pkk//7f/Y9gWsmNtiivR6bi6C0pvtSkYA+nGIVS3IRHiVt2PljPWGwCQcO/nI5qxksSsByYMBvdS5+VYRdzEQUhFPzTZPmiXi4LIMAwGcQ0NKTsb5u7zrIqhVwnBp75hJntAArJAccK1GWqjX4e+CCBwgKc1JuLSCaxzooKaKL7XfAP81lGd/phOldRleApUAXNeOHSqQN8Ru1jj3AhjYtVlIr58wknbZNIEc8atQcpyGUOAWCvCfBgeg5rqVm04R+2HJyheDy7nBnxT+rbnGvPMgGU0gwrhduZlOYsaM=', 'TYJElFG2H7en+iOkEBBBshDsd73cVMDmVb2esMoaqK3ap/chQz9T0P6HrfFDa2qaJroiBJ7K3yAqjpqTIVjRxBGcO//r84OI+XSGVvklW2xU4tMk0xCf8fYRCF3nC1MK1T36SdD+olDlwDwNYBOpJ+quxN1K0yjv0Enplty0LH3CI++7Du1qe4oa7T3GfqtG7Gg2hixaqdvtncI03OnYCHdIMzlpsPKKuImMi1U5VrUDc4G33ZmIIRjPq+RYE4+gzcJi7YXdEPQdBEboEuPTypjBpeK98De7DF3t1Iglhok0NsXWFhcEPpbpIKY8x7N9nd/XtPPMXgsoZF8EDsG8++tdPvZtENZOOKcvZsoNGSoNXZdL7TlzLViZEe8OBa+eHViDh/hq9kMqpUSesUwIh3LzOHz8TnflPbJmN9rW8zYfWH7GRKoqcJTO/TdXKBnSLoNJZzBMylfCRKYnFoZtIzWguBG9nIFBpWU3FkNt90At31OvSPSLEjYoUyl6ahl+7ueEoN04/m+aviBO7uO7GtKaXKxMbhdkSE85iaZNhZbNPfCizOGE89m3FGi/O+YRx7BnPUUsnIRv/+dDFiXzqqRS7hd/xQv0OY8Q1wIUESHkj9QAGFk+kCMnTogSiHIuWR3PUzq
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, OiHoolIAygQAXBT.cs	Base64 encoded string: 'yKawK3VpaUozVt7nSUZH+FnSyshePzOpFVCnRwX7U4ZB280WpfMTuTYeExR0FWuvbGpl3SI6rcp8bs+ljbVa2lDFNksGpMvQB+F6XFct3J60IeY1leqgjx0W7B1p+kqD/QtuP0XvjgWxZQ6bRM4s9auajVMXd2Y/Hgg/g2fz1ZipgNNWkwZoA0gfIfq8C+K+1i+++6eXPAokDnmrOM+EdaCtg8b5VGEj6UB1qrLieygyNrM6/SLeKezb1PA9AtA8U9IirRGLrYGl6gMwhQMH2ARPD9qVLreMF1ObJjWzeBmp1rLB4uTd/LTYiXbqf6vQ0SDyFPN74YEHEw5+xR5zSVxycirzV/2lIOJHuy1HYcQQVxoGAbLnZhMKMRQLzJEbpb/BoXIMSlHILNCGdkzsajyh/2CB9lgbze0+hcs7lWIUdnw/NG2Lh+NR9mTGqyRD8f6ztxYyBny2t7mnfhtYWyzP1/oxh+pwDbttOmnidk8vgIy4Z86FP2GdusQdiJac8alNHOjVOQGfiXF1PcBfUm0+IMYZU4BlX5S+8VjvPRSmWrd8hHO2nB+OflZE7cZ8+IQabffVZ7nGtNlcs5hpJV1n36PHaPpfOV1mftpl3KQ/IIepioZKvI0zVhG1R/MDkTxlmx+JcLVsaDJq02tWIAWR0dPcX5suErDeDucMUjXits8r7bCJ2GjAjghT1eu5Gu8Zl2ZRza7Iq/EA6DhGs5wcDpKYuHB/TOLrBxZV2S40V+lpzYBpbpzWEs6c6tIMHE3ejTrM0WAZR05tqWOuh+XvN4Ar/1NfvOHGxiSB8QZCoSyrCyJ785MPSL3gf49u/vm6Lkh1zPqAiS8w6VA1PpaEyeGajroYXuiWPP7obfDHTOwblMA6mf6orYIWZpWrFo94fu5vde5No6HKP5Yxo+VyFfKP4BwkSC75N4rviWlv81OiGc2r2X9HA3Jsc4Q6hrZSFiE7SoJhlraD1pP6yLDzfyNBmuuHE5I/e/deR6sSSPiejRj0u+JUrT+/h9acgZHQCTragNKUSpZMseB7Fiw5qpkclFu2scGyuXx+nKoO2KzPSbRjsXOfaApX/1ofb5tCm+hSFwTTih4mq7N0Tkh2mMQ4Z0ubCatWr9VO6bw3/EX5cF4oe3WV5uKBXly7ztB7lplwxOVmAxWZ3rbBOJofvRitOUtUmf/4Lgn1akzk/X8n4brrIUAMz9YS+lYKd0rLTpKme2XK3WRSa5DL/Z5Ar6MyscXBmwcY24C0yatbtGPlxZ1Lfj6Aexhbamrq8W2Ck6bqubyV+HSJvGJUcarOxwSAmQzDVNKmW3RxN452KM2y9VLc5jNxaYZdGdqteQFoDrrZb5fv0ZWR/fdDBAQCMhHQKkgfhVLIdWTr6hOpiDs9NnzmdYo0ER1y7Gj8J2whXqEYXznmo8y372z7j9PUPQhWCnEs/veEaNpHUpG4Yjy0GEvrzdp7tNpOxzDr433hsmkDwTgJHr3sD8uUGNJ0sgBTbOTtIC/hZCKqq1iieLppecA846W0MkBwrFZKesVwH/bmBMZlgbomvWhhIhEs9nGYSEAzLj0x4JkF//exESLXp6840pAL1HFBOLRknjEBXOFecVxcEgIRQZG/8NcfTlNUgJVm9re1UQP39qvdNyoESg/luLQ84lGy0DjQQpo5utjubbf0mggLLHic6Aaimct7g3buEckjUdLvvlK2LReaDwvkENlysrHLxpamLm6RRV139k/R3GBI1F1H6PbTST0J12/oFDv/1btrRvDU22dYPOLgAgRhzBOg4MlI4XrVvQUwcr2wMQbPZk1k5jixKcbjh5uJq8zl5ro3hrR5k7aWO71Qy9uxmbmD1EkZDOtYxLCMYe+eBkuE7FN7A/ioFIr/TVhMbSeP4iF4R8YS1DpJ7+1skdNZ6GeMfw/XBZJJGp/jH9ulBEolRrJ2NvXvgKDwWSw5lSEYKT5qXrX99BqwBqy3VLDQqpVEvVfuaMzqQVwpCPQI1blHF2FwZKXd6DSiO0Npi2XtAQcZjb/9SaEwoORNr8cowR/HkJIdV/pkk//7f/Y9gWsmNtiivR6bi6C0pvtSkYA+nGIVS3IRHiVt2PljPWGwCQcO/nI5qxksSsByYMBvdS5+VYRdzEQUhFPzTZPmiXi4LIMAwGcQ0NKTsb5u7zrIqhVwnBp75hJntAArJAccK1GWqjX4e+CCBwgKc1JuLSCaxzooKaKL7XfAP81lGd/phOldRleApUAXNeOHSqQN8Ru1jj3AhjYtVlIr58wknbZNIEc8atQcpyGUOAWCvCfBgeg5rqVm04R+2HJyheDy7nBnxT+rbnGvPMgGU0gwrhduZlOYsaM=', 'TYJElFG2H7en+iOkEBBBshDsd73cVMDmVb2esMoaqK3ap/chQz9T0P6HrfFDa2qaJroiBJ7K3yAqjpqTIVjRxBGcO//r84OI+XSGVvklW2xU4tMk0xCf8fYRCF3nC1MK1T36SdD+olDlwDwNYBOpJ+quxN1K0yjv0Enplty0LH3CI++7Du1qe4oa7T3GfqtG7Gg2hixaqdvtncI03OnYCHdIMzlpsPKKuImMi1U5VrUDc4G33ZmIIRjPq+RYE4+gzcJi7YXdEPQdBEboEuPTypjBpeK98De7DF3t1Iglhok0NsXWFhcEPpbpIKY8x7N9nd/XtPPMXgsoZF8EDsG8++tdPvZtENZOOKcvZsoNGSoNXZdL7TlzLViZEe8OBa+eHViDh/hq9kMqpUSesUwIh3LzOHz8TnflPbJmN9rW8zYfWH7GRKoqcJTO/TdXKBnSLoNJZzBMylfCRKYnFoZtIzWguBG9nIFBpWU3FkNt90At31OvSPSLEjYoUyl6ahl+7ueEoN04/m+aviBO7uO7GtKaXKxMbhdkSE85iaZNhZbNPfCizOGE89m3FGi/O+YRx7BnPUUsnIRv/+dDFiXzqqRS7hd/xQv0OY8Q1wIUESHkj9QAGFk+kCMnTogSiHIuWR3PUzq

Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, QlQTgMLzdOeM.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, QlQTgMLzdOeM.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, hfqTgZkGrRl1qdRosh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, hfqTgZkGrRl1qdRosh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, hfqTgZkGrRl1qdRosh.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QovWQ95hEMVPSioj6l.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, QlQTgMLzdOeM.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, QlQTgMLzdOeM.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@23/7@1/1

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aviso de transferencia.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Mutant created: \Sessions\1\BaseNamedObjects\8xLI57IVXCDFxeWa@
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File created: C:\Users\user\AppData\Local\Temp\windowsBook.exe

Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat""

Source: Aviso de transferencia.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Aviso de transferencia.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: windowsBook.exe.8.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 0, 1, 0);tiesaUPDATE Games SET ties = {0} WHERE user_id = {1};
Source: windowsBook.exe.8.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 1, 0, 0);winsaUPDATE Games SET wins = {0} WHERE user_id = {1};
Source: windowsBook.exe.8.dr	Binary or memory string: INSERT INTO Games (user_id, wins, ties, losses) VALUES ((SELECT id FROM Users WHERE id = {0}), 0, 0, 1);

Source: Aviso de transferencia.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File read: C:\Users\user\Desktop\Aviso de transferencia.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Aviso de transferencia.exe "C:\Users\user\Desktop\Aviso de transferencia.exe"
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Users\user\Desktop\Aviso de transferencia.exe "C:\Users\user\Desktop\Aviso de transferencia.exe"
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe C:\Users\user\AppData\Local\Temp\windowsBook.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Users\user\Desktop\Aviso de transferencia.exe "C:\Users\user\Desktop\Aviso de transferencia.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Aviso de transferencia.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Aviso de transferencia.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Aviso de transferencia.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: CYFA.pdb source: Aviso de transferencia.exe, windowsBook.exe.8.dr
Source:	Binary string: CYFA.pdbSHA256~ source: Aviso de transferencia.exe, windowsBook.exe.8.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{cPRyvIfYviaTKciquO(typeof(IntPtr).TypeHandle),cPRyvIfYviaTKciquO(typeof(Type).TypeHandle)})
Source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, at4ONG9F0NYCELN5Tj.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{cPRyvIfYviaTKciquO(typeof(IntPtr).TypeHandle),cPRyvIfYviaTKciquO(typeof(Type).TypeHandle)})

.NET source code contains potential unpacker

Source: Aviso de transferencia.exe, FormLogin.cs	.Net Code: InitializeComponent
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QovWQ95hEMVPSioj6l.cs	.Net Code: ySjEDkqN7o System.Reflection.Assembly.Load(byte[])
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QovWQ95hEMVPSioj6l.cs	.Net Code: ySjEDkqN7o System.Reflection.Assembly.Load(byte[])
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QovWQ95hEMVPSioj6l.cs	.Net Code: ySjEDkqN7o System.Reflection.Assembly.Load(byte[])
Source: windowsBook.exe.8.dr, FormLogin.cs	.Net Code: InitializeComponent
Source: 8.2.Aviso de transferencia.exe.45e8408.1.raw.unpack, FormLogin.cs	.Net Code: InitializeComponent

Source: Aviso de transferencia.exe

Static PE information: 0xC5CCFDE4 [Thu Feb 28 02:18:12 2075 UTC]

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_02CEE9A2 pushfd ; retf	17_2_02CEE9A9
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 17_2_02CEF4BA push eax; iretd	17_2_02CEF4C1
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_00FCE9A3 pushfd ; retf	18_2_00FCE9A9
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_00FCF4BB push eax; iretd	18_2_00FCF4C1
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 18_2_09850D41 push es; iretd	18_2_09850D67
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Code function: 22_2_02CD3AE0 push ebx; retf 7064h	22_2_02CD3BDA

Source: Aviso de transferencia.exe	Static PE information: section name: .text entropy: 7.9062155732125765
Source: windowsBook.exe.8.dr	Static PE information: section name: .text entropy: 7.9062155732125765

Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, FWPZvPGG2NGeDrUUHY.cs	High entropy of concatenated method names: 'm28b1BvpWT', 'PkdbClNA1u', 'MxCbSVfhTl', 'TlXbigjs3R', 'J2kblqUKTq', 'XkjbMRBPH5', 'aA9hCeLsMUP0pfIPyX', 'sBAofHbUJntJD6js4E', 'VfdbbvK3rs', 'cvcbPeSaMZ'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, WA6GRlsXjrrb6h4V29.cs	High entropy of concatenated method names: 'k0RrScAQM5', 'rR3riCRHVK', 'ToString', 'j9Yra0sFdG', 'NI6r5fHQDA', 'CJQrx2BYUx', 'yaFrqU3QvM', 'W6rr7LuyqE', 'IMBr1fQd5J', 'EhSrC8fMF5'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, ToMYSNwPJjwfUjKiDX.cs	High entropy of concatenated method names: 'onYxGrDCoh', 'Hfjx6Roi9c', 'Ku1xTIoIib', 'Q3uxfLC9Ee', 'jPExlpDb2Y', 'V4IxM7v6Jq', 'su8xrjkWvk', 'lNgxelG0MM', 'tsCxg4CEYj', 'q7Oxp20r1k'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, rbKcFf1hn3nuDKVnef.cs	High entropy of concatenated method names: 'eMp8TvZM26', 'JA58fi4pbd', 'qbN8Oqp5KY', 'Awx8UeZtub', 'zrU8kc5L4m', 'A3c8W8qRqt', 'f6x8N37mlL', 'rZh8uinnh5', 'AXH8Ass1tZ', 'sZM8c4LPBY'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, IVMLjFLnhdQ1HlELP2.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'VInnZeGVGj', 'GoqnsmG2d3', 'MT4nzap8Xq', 'kiYP4l5e2T', 'kVjPbr23g0', 'Lp8Pn7ogif', 'H5tPPfG8Ws', 'R6srAt2RtMAlS7vMLJ2'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, Y5OXvHoCJOO5s0nEDnc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i0bp9yXiWb', 'WmCpBmQ666', 'iAJpQgqp9m', 'xSgpmM2l3I', 'tKLpFOtwb5', 'qG4pwX0vO7', 'D6uphhFc3e'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, gqJfJAx8xBdgZ9jvfn.cs	High entropy of concatenated method names: 'UBplApSBG0', 'CSylV26SfF', 'PPXl99RIst', 'DCHlBpUpJ1', 'x4RlU9hkZ1', 'nFal3npcEO', 'MtxlkWJeWv', 'KBZlWlFFl8', 'Qf7l2pnuJo', 'YS9lNQRdvj'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, kbHWljzWNZfp9m7kBG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pmRg8udPNO', 'hRagl4U3f3', 'bDSgMbvsO6', 'DPxgrA4G68', 'P3BgetaRGA', 'zvdggm3qqi', 'FAxgpeeRgZ'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, ugghWu4CxStT66wXqh.cs	High entropy of concatenated method names: 'oy5DBNSUB', 'FGFGipMaw', 'NpI6NSSBs', 'KHvd32E5I', 'l5pfQN5wn', 'CD3tHNiOK', 'R4Qwi5VchBnkqXqx0k', 'Brkb7a6Re3Y2LIGnqQ', 'uY2e6ToS0', 'tlDpOx4Jl'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, Eu76Pinjur1WC8R1bI.cs	High entropy of concatenated method names: 'Dispose', 'XXlbZKWtps', 'rcVnUDyCKH', 'UNJvv2nZY6', 'oFlbs6nrh1', 'HTWbzT2ik8', 'ProcessDialogKey', 'rHxn4IfIVc', 'm6mnbUClj6', 'IGSnn2IDgo'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, PghQQxhulwqEmG4nhN.cs	High entropy of concatenated method names: 'SCr1a9OA82', 'bMS1xGUGrS', 'Qh3179NGO0', 'gKB7slngI4', 'SIg7zjLt29', 'VS814RNfnH', 'qjn1bipyvD', 'UVB1nYnQtR', 'Jy61PMj7Ai', 'Rmt1ESlngJ'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QovWQ95hEMVPSioj6l.cs	High entropy of concatenated method names: 'mVjPJpTBaf', 'yBgPahd80b', 'SrlP5xemuc', 'OTsPxZLh2m', 'EQgPq902QU', 'sFnP7j2EoW', 'AndP1SF0hq', 'xX8PCd9YZT', 'NPVPjyZ5eg', 'yahPSPoE6Z'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, UorxSMiASt35xqJabR.cs	High entropy of concatenated method names: 'F92eavAvut', 'RDke5HsUXA', 'qvHexZ7Ryu', 'HGteq7LvPp', 'zCRe7XE3kQ', 'J9Ue1PMApv', 'FVheCVorxq', 'uC5ejcUd0U', 'QygeSHS9ko', 'RG3eiyueKu'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, hfqTgZkGrRl1qdRosh.cs	High entropy of concatenated method names: 'DLH59i3syv', 'qp45Bi55eO', 'kqH5QfaYjQ', 'gth5m5JPoK', 'DgW5FCMtgE', 'Jug5wJGx0M', 'suS5hgIk3M', 'uUJ5Kjhe7M', 'QwK5ZcXGO7', 'lBM5sfq6Iy'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, LBxSyvu289TtN9ADpD.cs	High entropy of concatenated method names: 'xM11YHknnY', 'vwo1LIrit8', 'gyv1DDMjry', 'A0B1GC1MAY', 'kUj1XYuFDu', 'xos16TtISL', 'IVw1dR3m76', 'bs41TroFMX', 'ASp1fB9gLm', 'mmm1tvNFnw'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, KXg8lGUCjkZ60m9tpN.cs	High entropy of concatenated method names: 'EA5rKlDqU4', 'HOErsfeoEr', 'D07e4gVjQU', 'pWHebWct9Z', 'DBcrcUX82O', 'lJKrVNhY6K', 'vJ3rRxqXvp', 'sGir9gQbpN', 'a4GrBGBuV1', 'R95rQ6LPo6'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, aACaaqoo25a3Cr8Gy0a.cs	High entropy of concatenated method names: 'ToString', 'Oh2pPJJC19', 'JoFpEpi6up', 'KXqpJ7Qo1O', 'oHXpaOOCvm', 'lb7p58Oc0k', 'd19pxFfWAY', 'UB1pqLnBYf', 'KTw3IaRTu20IjZQQoeG', 'yg27sHRUj5LtwlJPalP'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, BgDWOvXaAOTDj6q3GW.cs	High entropy of concatenated method names: 'HZvgbgIImc', 'xUQgPAN7eB', 'NZAgEVKTDj', 'uJkgaK0axf', 'OBig5oNmJX', 'dRIgqkpY2C', 'IIQg7u4mUL', 'pQFeh2Fy4N', 'Xk4eKtvsUT', 'FJVeZc68mn'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, OZlkGMeTjLUBpXpOD9.cs	High entropy of concatenated method names: 'wZ77Jv6Iuq', 'IFx75n7Ip2', 'F6g7qorkPh', 'DXT718eleb', 'HHj7CVXHMl', 'bKqqFoutdP', 'v8VqwnP71j', 'h82qhvlqK7', 'i78qK9xx31', 'hJgqZdsHQx'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, QLh9wcFTubJ9cQf2No.cs	High entropy of concatenated method names: 'viUqXRFK3v', 'Wawqd6db67', 'qnGx39xHt3', 'tSuxk8REXG', 'lHcxWoTqwr', 'roQx2yGmwK', 'wAvxNiYDTM', 'pQTxuwdy6M', 'La2x0belxC', 'ymcxADg50r'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, YLXyXgPv3TfBp95E08.cs	High entropy of concatenated method names: 'MdWeOojQeb', 'kLUeU0bRne', 'KIOe3o0f2T', 'HYjekZcpqs', 'CJSe9krxNO', 'tL2eWxu3Jo', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Aviso de transferencia.exe.3ac6c10.3.raw.unpack, zYKgdvolWu7dOybkTTi.cs	High entropy of concatenated method names: 'UWugYQUGug', 'mCjgLIdtlV', 'WQugDCEq3L', 'h7lgGyxNkd', 'rWMgX7D4J2', 'TjUg6u7XcN', 'T0tgd6vUnh', 'Fs7gTFivJU', 'E3rgfpQ4bZ', 'fQ2gtuXeAO'
Source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, WTlNonEqlrS.cs	High entropy of concatenated method names: 'RWIUTDDJGmvVUeD', 'DHwRZvzGtdyaOf', 'NVxhYPkjFbHe', 'QkrTDbktNZMNeeJWG', 'ullDtQBniM', 'uYnSlYOLGcD', 'hTHxBxeTyyhQFG', 'GPwCvvvaQvBVarLM', 'YirdoSqTbqrnwm', 'SPWfuVwfHoJf'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, FWPZvPGG2NGeDrUUHY.cs	High entropy of concatenated method names: 'm28b1BvpWT', 'PkdbClNA1u', 'MxCbSVfhTl', 'TlXbigjs3R', 'J2kblqUKTq', 'XkjbMRBPH5', 'aA9hCeLsMUP0pfIPyX', 'sBAofHbUJntJD6js4E', 'VfdbbvK3rs', 'cvcbPeSaMZ'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, WA6GRlsXjrrb6h4V29.cs	High entropy of concatenated method names: 'k0RrScAQM5', 'rR3riCRHVK', 'ToString', 'j9Yra0sFdG', 'NI6r5fHQDA', 'CJQrx2BYUx', 'yaFrqU3QvM', 'W6rr7LuyqE', 'IMBr1fQd5J', 'EhSrC8fMF5'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, ToMYSNwPJjwfUjKiDX.cs	High entropy of concatenated method names: 'onYxGrDCoh', 'Hfjx6Roi9c', 'Ku1xTIoIib', 'Q3uxfLC9Ee', 'jPExlpDb2Y', 'V4IxM7v6Jq', 'su8xrjkWvk', 'lNgxelG0MM', 'tsCxg4CEYj', 'q7Oxp20r1k'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, rbKcFf1hn3nuDKVnef.cs	High entropy of concatenated method names: 'eMp8TvZM26', 'JA58fi4pbd', 'qbN8Oqp5KY', 'Awx8UeZtub', 'zrU8kc5L4m', 'A3c8W8qRqt', 'f6x8N37mlL', 'rZh8uinnh5', 'AXH8Ass1tZ', 'sZM8c4LPBY'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, IVMLjFLnhdQ1HlELP2.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'VInnZeGVGj', 'GoqnsmG2d3', 'MT4nzap8Xq', 'kiYP4l5e2T', 'kVjPbr23g0', 'Lp8Pn7ogif', 'H5tPPfG8Ws', 'R6srAt2RtMAlS7vMLJ2'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, Y5OXvHoCJOO5s0nEDnc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i0bp9yXiWb', 'WmCpBmQ666', 'iAJpQgqp9m', 'xSgpmM2l3I', 'tKLpFOtwb5', 'qG4pwX0vO7', 'D6uphhFc3e'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, gqJfJAx8xBdgZ9jvfn.cs	High entropy of concatenated method names: 'UBplApSBG0', 'CSylV26SfF', 'PPXl99RIst', 'DCHlBpUpJ1', 'x4RlU9hkZ1', 'nFal3npcEO', 'MtxlkWJeWv', 'KBZlWlFFl8', 'Qf7l2pnuJo', 'YS9lNQRdvj'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, kbHWljzWNZfp9m7kBG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pmRg8udPNO', 'hRagl4U3f3', 'bDSgMbvsO6', 'DPxgrA4G68', 'P3BgetaRGA', 'zvdggm3qqi', 'FAxgpeeRgZ'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, ugghWu4CxStT66wXqh.cs	High entropy of concatenated method names: 'oy5DBNSUB', 'FGFGipMaw', 'NpI6NSSBs', 'KHvd32E5I', 'l5pfQN5wn', 'CD3tHNiOK', 'R4Qwi5VchBnkqXqx0k', 'Brkb7a6Re3Y2LIGnqQ', 'uY2e6ToS0', 'tlDpOx4Jl'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, Eu76Pinjur1WC8R1bI.cs	High entropy of concatenated method names: 'Dispose', 'XXlbZKWtps', 'rcVnUDyCKH', 'UNJvv2nZY6', 'oFlbs6nrh1', 'HTWbzT2ik8', 'ProcessDialogKey', 'rHxn4IfIVc', 'm6mnbUClj6', 'IGSnn2IDgo'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, PghQQxhulwqEmG4nhN.cs	High entropy of concatenated method names: 'SCr1a9OA82', 'bMS1xGUGrS', 'Qh3179NGO0', 'gKB7slngI4', 'SIg7zjLt29', 'VS814RNfnH', 'qjn1bipyvD', 'UVB1nYnQtR', 'Jy61PMj7Ai', 'Rmt1ESlngJ'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QovWQ95hEMVPSioj6l.cs	High entropy of concatenated method names: 'mVjPJpTBaf', 'yBgPahd80b', 'SrlP5xemuc', 'OTsPxZLh2m', 'EQgPq902QU', 'sFnP7j2EoW', 'AndP1SF0hq', 'xX8PCd9YZT', 'NPVPjyZ5eg', 'yahPSPoE6Z'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, UorxSMiASt35xqJabR.cs	High entropy of concatenated method names: 'F92eavAvut', 'RDke5HsUXA', 'qvHexZ7Ryu', 'HGteq7LvPp', 'zCRe7XE3kQ', 'J9Ue1PMApv', 'FVheCVorxq', 'uC5ejcUd0U', 'QygeSHS9ko', 'RG3eiyueKu'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, hfqTgZkGrRl1qdRosh.cs	High entropy of concatenated method names: 'DLH59i3syv', 'qp45Bi55eO', 'kqH5QfaYjQ', 'gth5m5JPoK', 'DgW5FCMtgE', 'Jug5wJGx0M', 'suS5hgIk3M', 'uUJ5Kjhe7M', 'QwK5ZcXGO7', 'lBM5sfq6Iy'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, LBxSyvu289TtN9ADpD.cs	High entropy of concatenated method names: 'xM11YHknnY', 'vwo1LIrit8', 'gyv1DDMjry', 'A0B1GC1MAY', 'kUj1XYuFDu', 'xos16TtISL', 'IVw1dR3m76', 'bs41TroFMX', 'ASp1fB9gLm', 'mmm1tvNFnw'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, KXg8lGUCjkZ60m9tpN.cs	High entropy of concatenated method names: 'EA5rKlDqU4', 'HOErsfeoEr', 'D07e4gVjQU', 'pWHebWct9Z', 'DBcrcUX82O', 'lJKrVNhY6K', 'vJ3rRxqXvp', 'sGir9gQbpN', 'a4GrBGBuV1', 'R95rQ6LPo6'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, aACaaqoo25a3Cr8Gy0a.cs	High entropy of concatenated method names: 'ToString', 'Oh2pPJJC19', 'JoFpEpi6up', 'KXqpJ7Qo1O', 'oHXpaOOCvm', 'lb7p58Oc0k', 'd19pxFfWAY', 'UB1pqLnBYf', 'KTw3IaRTu20IjZQQoeG', 'yg27sHRUj5LtwlJPalP'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, BgDWOvXaAOTDj6q3GW.cs	High entropy of concatenated method names: 'HZvgbgIImc', 'xUQgPAN7eB', 'NZAgEVKTDj', 'uJkgaK0axf', 'OBig5oNmJX', 'dRIgqkpY2C', 'IIQg7u4mUL', 'pQFeh2Fy4N', 'Xk4eKtvsUT', 'FJVeZc68mn'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, OZlkGMeTjLUBpXpOD9.cs	High entropy of concatenated method names: 'wZ77Jv6Iuq', 'IFx75n7Ip2', 'F6g7qorkPh', 'DXT718eleb', 'HHj7CVXHMl', 'bKqqFoutdP', 'v8VqwnP71j', 'h82qhvlqK7', 'i78qK9xx31', 'hJgqZdsHQx'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, QLh9wcFTubJ9cQf2No.cs	High entropy of concatenated method names: 'viUqXRFK3v', 'Wawqd6db67', 'qnGx39xHt3', 'tSuxk8REXG', 'lHcxWoTqwr', 'roQx2yGmwK', 'wAvxNiYDTM', 'pQTxuwdy6M', 'La2x0belxC', 'ymcxADg50r'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, YLXyXgPv3TfBp95E08.cs	High entropy of concatenated method names: 'MdWeOojQeb', 'kLUeU0bRne', 'KIOe3o0f2T', 'HYjekZcpqs', 'CJSe9krxNO', 'tL2eWxu3Jo', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Aviso de transferencia.exe.96e0000.6.raw.unpack, zYKgdvolWu7dOybkTTi.cs	High entropy of concatenated method names: 'UWugYQUGug', 'mCjgLIdtlV', 'WQugDCEq3L', 'h7lgGyxNkd', 'rWMgX7D4J2', 'TjUg6u7XcN', 'T0tgd6vUnh', 'Fs7gTFivJU', 'E3rgfpQ4bZ', 'fQ2gtuXeAO'
Source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, MainForm.cs	High entropy of concatenated method names: 'YgSHuitkd', 'aiP2N9Y7C', 'gHQx79i6W', 'AGv9PUWi3', 'QMsbTCblb', 'beIGikGSa', 'clTPOt4ON', 'fF0vNYCEL', 'C5TCjFvvv', 'ln3BTm5Rw'
Source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, at4ONG9F0NYCELN5Tj.cs	High entropy of concatenated method names: 'nVoxarmF975Urj2p8sJ', 'tIta6WmWAkGE6iVCWgt', 'Y8N2DklRel', 'hpreq0m6Xcu1pidWj9b', 'KFC0XvmT5N8D2LR210h', 'a5foommXYpDAHBV6LjL', 'd3wYgimbV84NAc2fo7p', 'ItvPp5mqvV1adE08UOg', 'KA7rbWmJ0EMRNxYE2Vd', 'PPtPBAmQMyT7QpfjJpI'
Source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, WTlNonEqlrS.cs	High entropy of concatenated method names: 'RWIUTDDJGmvVUeD', 'DHwRZvzGtdyaOf', 'NVxhYPkjFbHe', 'QkrTDbktNZMNeeJWG', 'ullDtQBniM', 'uYnSlYOLGcD', 'hTHxBxeTyyhQFG', 'GPwCvvvaQvBVarLM', 'YirdoSqTbqrnwm', 'SPWfuVwfHoJf'
Source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, MainForm.cs	High entropy of concatenated method names: 'YgSHuitkd', 'aiP2N9Y7C', 'gHQx79i6W', 'AGv9PUWi3', 'QMsbTCblb', 'beIGikGSa', 'clTPOt4ON', 'fF0vNYCEL', 'C5TCjFvvv', 'ln3BTm5Rw'
Source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, at4ONG9F0NYCELN5Tj.cs	High entropy of concatenated method names: 'nVoxarmF975Urj2p8sJ', 'tIta6WmWAkGE6iVCWgt', 'Y8N2DklRel', 'hpreq0m6Xcu1pidWj9b', 'KFC0XvmT5N8D2LR210h', 'a5foommXYpDAHBV6LjL', 'd3wYgimbV84NAc2fo7p', 'ItvPp5mqvV1adE08UOg', 'KA7rbWmJ0EMRNxYE2Vd', 'PPtPBAmQMyT7QpfjJpI'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, FWPZvPGG2NGeDrUUHY.cs	High entropy of concatenated method names: 'm28b1BvpWT', 'PkdbClNA1u', 'MxCbSVfhTl', 'TlXbigjs3R', 'J2kblqUKTq', 'XkjbMRBPH5', 'aA9hCeLsMUP0pfIPyX', 'sBAofHbUJntJD6js4E', 'VfdbbvK3rs', 'cvcbPeSaMZ'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, WA6GRlsXjrrb6h4V29.cs	High entropy of concatenated method names: 'k0RrScAQM5', 'rR3riCRHVK', 'ToString', 'j9Yra0sFdG', 'NI6r5fHQDA', 'CJQrx2BYUx', 'yaFrqU3QvM', 'W6rr7LuyqE', 'IMBr1fQd5J', 'EhSrC8fMF5'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, ToMYSNwPJjwfUjKiDX.cs	High entropy of concatenated method names: 'onYxGrDCoh', 'Hfjx6Roi9c', 'Ku1xTIoIib', 'Q3uxfLC9Ee', 'jPExlpDb2Y', 'V4IxM7v6Jq', 'su8xrjkWvk', 'lNgxelG0MM', 'tsCxg4CEYj', 'q7Oxp20r1k'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, rbKcFf1hn3nuDKVnef.cs	High entropy of concatenated method names: 'eMp8TvZM26', 'JA58fi4pbd', 'qbN8Oqp5KY', 'Awx8UeZtub', 'zrU8kc5L4m', 'A3c8W8qRqt', 'f6x8N37mlL', 'rZh8uinnh5', 'AXH8Ass1tZ', 'sZM8c4LPBY'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, IVMLjFLnhdQ1HlELP2.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'VInnZeGVGj', 'GoqnsmG2d3', 'MT4nzap8Xq', 'kiYP4l5e2T', 'kVjPbr23g0', 'Lp8Pn7ogif', 'H5tPPfG8Ws', 'R6srAt2RtMAlS7vMLJ2'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, Y5OXvHoCJOO5s0nEDnc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i0bp9yXiWb', 'WmCpBmQ666', 'iAJpQgqp9m', 'xSgpmM2l3I', 'tKLpFOtwb5', 'qG4pwX0vO7', 'D6uphhFc3e'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, gqJfJAx8xBdgZ9jvfn.cs	High entropy of concatenated method names: 'UBplApSBG0', 'CSylV26SfF', 'PPXl99RIst', 'DCHlBpUpJ1', 'x4RlU9hkZ1', 'nFal3npcEO', 'MtxlkWJeWv', 'KBZlWlFFl8', 'Qf7l2pnuJo', 'YS9lNQRdvj'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, kbHWljzWNZfp9m7kBG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'pmRg8udPNO', 'hRagl4U3f3', 'bDSgMbvsO6', 'DPxgrA4G68', 'P3BgetaRGA', 'zvdggm3qqi', 'FAxgpeeRgZ'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, ugghWu4CxStT66wXqh.cs	High entropy of concatenated method names: 'oy5DBNSUB', 'FGFGipMaw', 'NpI6NSSBs', 'KHvd32E5I', 'l5pfQN5wn', 'CD3tHNiOK', 'R4Qwi5VchBnkqXqx0k', 'Brkb7a6Re3Y2LIGnqQ', 'uY2e6ToS0', 'tlDpOx4Jl'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, Eu76Pinjur1WC8R1bI.cs	High entropy of concatenated method names: 'Dispose', 'XXlbZKWtps', 'rcVnUDyCKH', 'UNJvv2nZY6', 'oFlbs6nrh1', 'HTWbzT2ik8', 'ProcessDialogKey', 'rHxn4IfIVc', 'm6mnbUClj6', 'IGSnn2IDgo'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, PghQQxhulwqEmG4nhN.cs	High entropy of concatenated method names: 'SCr1a9OA82', 'bMS1xGUGrS', 'Qh3179NGO0', 'gKB7slngI4', 'SIg7zjLt29', 'VS814RNfnH', 'qjn1bipyvD', 'UVB1nYnQtR', 'Jy61PMj7Ai', 'Rmt1ESlngJ'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QovWQ95hEMVPSioj6l.cs	High entropy of concatenated method names: 'mVjPJpTBaf', 'yBgPahd80b', 'SrlP5xemuc', 'OTsPxZLh2m', 'EQgPq902QU', 'sFnP7j2EoW', 'AndP1SF0hq', 'xX8PCd9YZT', 'NPVPjyZ5eg', 'yahPSPoE6Z'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, UorxSMiASt35xqJabR.cs	High entropy of concatenated method names: 'F92eavAvut', 'RDke5HsUXA', 'qvHexZ7Ryu', 'HGteq7LvPp', 'zCRe7XE3kQ', 'J9Ue1PMApv', 'FVheCVorxq', 'uC5ejcUd0U', 'QygeSHS9ko', 'RG3eiyueKu'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, hfqTgZkGrRl1qdRosh.cs	High entropy of concatenated method names: 'DLH59i3syv', 'qp45Bi55eO', 'kqH5QfaYjQ', 'gth5m5JPoK', 'DgW5FCMtgE', 'Jug5wJGx0M', 'suS5hgIk3M', 'uUJ5Kjhe7M', 'QwK5ZcXGO7', 'lBM5sfq6Iy'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, LBxSyvu289TtN9ADpD.cs	High entropy of concatenated method names: 'xM11YHknnY', 'vwo1LIrit8', 'gyv1DDMjry', 'A0B1GC1MAY', 'kUj1XYuFDu', 'xos16TtISL', 'IVw1dR3m76', 'bs41TroFMX', 'ASp1fB9gLm', 'mmm1tvNFnw'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, KXg8lGUCjkZ60m9tpN.cs	High entropy of concatenated method names: 'EA5rKlDqU4', 'HOErsfeoEr', 'D07e4gVjQU', 'pWHebWct9Z', 'DBcrcUX82O', 'lJKrVNhY6K', 'vJ3rRxqXvp', 'sGir9gQbpN', 'a4GrBGBuV1', 'R95rQ6LPo6'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, aACaaqoo25a3Cr8Gy0a.cs	High entropy of concatenated method names: 'ToString', 'Oh2pPJJC19', 'JoFpEpi6up', 'KXqpJ7Qo1O', 'oHXpaOOCvm', 'lb7p58Oc0k', 'd19pxFfWAY', 'UB1pqLnBYf', 'KTw3IaRTu20IjZQQoeG', 'yg27sHRUj5LtwlJPalP'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, BgDWOvXaAOTDj6q3GW.cs	High entropy of concatenated method names: 'HZvgbgIImc', 'xUQgPAN7eB', 'NZAgEVKTDj', 'uJkgaK0axf', 'OBig5oNmJX', 'dRIgqkpY2C', 'IIQg7u4mUL', 'pQFeh2Fy4N', 'Xk4eKtvsUT', 'FJVeZc68mn'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, OZlkGMeTjLUBpXpOD9.cs	High entropy of concatenated method names: 'wZ77Jv6Iuq', 'IFx75n7Ip2', 'F6g7qorkPh', 'DXT718eleb', 'HHj7CVXHMl', 'bKqqFoutdP', 'v8VqwnP71j', 'h82qhvlqK7', 'i78qK9xx31', 'hJgqZdsHQx'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, QLh9wcFTubJ9cQf2No.cs	High entropy of concatenated method names: 'viUqXRFK3v', 'Wawqd6db67', 'qnGx39xHt3', 'tSuxk8REXG', 'lHcxWoTqwr', 'roQx2yGmwK', 'wAvxNiYDTM', 'pQTxuwdy6M', 'La2x0belxC', 'ymcxADg50r'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, YLXyXgPv3TfBp95E08.cs	High entropy of concatenated method names: 'MdWeOojQeb', 'kLUeU0bRne', 'KIOe3o0f2T', 'HYjekZcpqs', 'CJSe9krxNO', 'tL2eWxu3Jo', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Aviso de transferencia.exe.3a793f0.4.raw.unpack, zYKgdvolWu7dOybkTTi.cs	High entropy of concatenated method names: 'UWugYQUGug', 'mCjgLIdtlV', 'WQugDCEq3L', 'h7lgGyxNkd', 'rWMgX7D4J2', 'TjUg6u7XcN', 'T0tgd6vUnh', 'Fs7gTFivJU', 'E3rgfpQ4bZ', 'fQ2gtuXeAO'

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

File created: C:\Users\user\AppData\Local\Temp\windowsBook.exe

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"'

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7800, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Aviso de transferencia.exe, 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, Aviso de transferencia.exe, 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, windowsBook.exe, 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 10D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 4900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 9870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: AAB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: BAB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 3580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory allocated: 1CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 7790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 8790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 8920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 9920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 7370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 8370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 8500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 9500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 5040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory allocated: 4ED0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Window / User API: threadDelayed 1688			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Window / User API: threadDelayed 8172			Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe TID: 3960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe TID: 7256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 7820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 7884	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 8096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 8116	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 8124	Thread sleep count: 1688 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe TID: 8124	Thread sleep count: 8172 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: windowsBook.exe, 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: windowsBook.exe, 00000016.00000002.2492243462.000000000540D000.00000004.00000020.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2492185882.0000000005403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: windowsBook.exe, 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhd@

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Memory written: C:\Users\user\Desktop\Aviso de transferencia.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory written: C:\Users\user\AppData\Local\Temp\windowsBook.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Memory written: C:\Users\user\AppData\Local\Temp\windowsBook.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Users\user\Desktop\Aviso de transferencia.exe "C:\Users\user\Desktop\Aviso de transferencia.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Process created: C:\Users\user\AppData\Local\Temp\windowsBook.exe "C:\Users\user\AppData\Local\Temp\windowsBook.exe"	Jump to behavior

Source: windowsBook.exe, 00000016.00000002.2486571211.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: windowsBook.exe, 00000016.00000002.2486571211.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: windowsBook.exe, 00000016.00000002.2486571211.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe
Source: windowsBook.exe, 00000016.00000002.2486571211.0000000002F3F000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Users\user\Desktop\Aviso de transferencia.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Users\user\Desktop\Aviso de transferencia.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Aviso de transferencia.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\windowsBook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\windowsBook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\windowsBook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\windowsBook.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Aviso de transferencia.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Aviso de transferencia.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.295a0bc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.294e1e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2edae1c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.windowsBook.exe.2ee6cf8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aviso de transferencia.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: windowsBook.exe PID: 7928, type: MEMORYSTR

Source: windowsBook.exe, 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\windowsBook.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.9470000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.391e790.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1276809734.0000000009470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275781875.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Aviso de transferencia.exe.9470000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.391e790.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.9470000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Aviso de transferencia.exe.391e790.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1276809734.0000000009470000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275781875.0000000003909000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scheduled Task/Job	112 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 Scripting	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	112 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Aviso de transferencia.exe	24%	ReversingLabs
Aviso de transferencia.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\windowsBook.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\windowsBook.exe	24%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		unknown
quin.ydns.eu	185.38.142.240	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
quin.ydns.eu	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DatabaseWalletDataSet.xsd	Aviso de transferencia.exe, windowsBook.exe.8.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Aviso de transferencia.exe, 00000008.00000002.1322217899.00000000036A8000.00000004.00000800.00020000.00000000.sdmp, windowsBook.exe, 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.38.142.240	quin.ydns.eu	Portugal		47674	NETSOLUTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538536
Start date and time:	2024-10-21 14:17:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Aviso de transferencia.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@23/7@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 189 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, time.windows.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Aviso de transferencia.exe, PID 7212 because it is empty
Execution Graph export aborted for target windowsBook.exe, PID 7848 because it is empty
Execution Graph export aborted for target windowsBook.exe, PID 7928 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Aviso de transferencia.exe

Simulations

Behavior and APIs

Time	Type	Description
08:18:09	API Interceptor	1x Sleep call for process: Aviso de transferencia.exe modified
08:18:20	API Interceptor	4x Sleep call for process: windowsBook.exe modified
14:18:16	Task Scheduler	Run new task: windowsBook path: "C:\Users\user\AppData\Local\Temp\windowsBook.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.38.142.240	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	258491645830653677.js	Get hash	malicious	Unknown	Browse	199.232.214.172
	ekte.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	199.232.214.172
	Anfrage fur Proforma-Lieferrechnung und Zahlungsbedingungen.vbs	Get hash	malicious	GuLoader	Browse	199.232.214.172
	Message_2530136.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	ekte.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://evriservicescompany.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	d600758023374f78d58acafbcaf94af66ad203b28e22a.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
quin.ydns.eu	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NETSOLUTIONSNL	rUAE_LPO.com.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	185.38.142.240
	A9BripDhRY.lnk	Get hash	malicious	Unknown	Browse	185.38.142.128
	93.123.85.253-bot.armv4l-2024-08-28T17_49_11.elf	Get hash	malicious	Unknown	Browse	188.93.233.79
	a591d3d035cf90395ad1078a415a46b5b44dd813496291b702fe36cfb22dee36_dump.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	b3u71vBG0u.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	2MbHBiqXH2.rtf	Get hash	malicious	RedLine	Browse	185.38.142.10
	YPSvIjQCzd.exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	Invoice LGMSCH0040924 Paid - EFT Remittance Advice and Receipt.docx.doc	Get hash	malicious	RedLine	Browse	185.38.142.10
	MSH INV 2024-0117 Secure Payment Invoice for .exe	Get hash	malicious	RedLine	Browse	185.38.142.10
	sclfmLKwR7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.38.142.103

Process:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kK7zF9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:zzsDImsLNkPlE99SNxAhUe/3
MD5:	8DEF95ECFD86D7B0E263DA1F5B285BAF
SHA1:	16A67009F0575422BDF6AA5B64068C0E18F5B9D0
SHA-256:	BE64D3EB72F0B8F029CA5DAB4869114CAC16996CD0769C0C1C9617E5D346F9AD
SHA-512:	F341F5EE5C3EE5D2F1BB1D9058F8A09CD173E7548280EDF40035DB546755E84CF27CD3DEC6704CB3F48859307FCEBD85EACEDAFFC87B448AE4E5C3D6D5B67275
Malicious:	false
Preview:	p...... ..........U.#..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aviso de transferencia.exe.log

Download File

Process:	C:\Users\user\Desktop\Aviso de transferencia.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windowsBook.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat

Download File

Process:	C:\Users\user\Desktop\Aviso de transferencia.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.043945954580936
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5o0nacwRE2J5xAIhTsmqRD0nacwRE2J5xAInTRIMGmloL1ZPy:hWKqTtT6cNwi23fhTsmq1cNwi23fTtGa
MD5:	114782AD96C91AECE1527EDC2FBE6363
SHA1:	6DB150820FCCD5D5193C37E3E5EE31BDD4B0455E
SHA-256:	748B349FAD1659FA03B0EF4F46223ED8797C42B40410B582DBDE243F45AF5148
SHA-512:	0B15896CED567DF35A227F5E0F73D77BAAD8C91757722AE8A7B24B1B0DAC74D31A276D2EFDB7045C87B9E5A3CEF7F9907A37C78AF1686401B9A195AABF5395B2
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Local\Temp\windowsBook.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpCD5C.tmp.bat" /f /q..

C:\Users\user\AppData\Local\Temp\windowsBook.exe

Download File

Process:	C:\Users\user\Desktop\Aviso de transferencia.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	509440
Entropy (8bit):	7.893327073826682
Encrypted:	false
SSDEEP:	12288:9dSkhMOoltiJWCjRPuUW8FmGevNPJWBG9ythzO40BUhq:DSkh5oDiJhuUdyPJWBGYthzOBBJ
MD5:	8D664129AF173ED945236EFB82D4AD67
SHA1:	7E0F8F79786EBBEB561171032EA65FCFCD6DB437
SHA-256:	AE26ACE2F3BCB3C94A3A8AF4A6684DA129AA08D73C18A5311D7491D006B20042
SHA-512:	A0217BF3C09B55B56A2B1D2E520406C920EBE9397E0B8054810244BE5C01674695615F90C180AE17B3797886A0829744A576B98ADDE24B8523B681B8B4BCC1BA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@.................................d...O.......<...........................<...p............................................ ............... ..H............text........ ...................... ..`.rsrc...<...........................@..@.reloc..............................@..B........................H...........XY......y.......0............................................0............}......}......}......}......}......}.....r...p}.....r...p}.....(....}.....( ...}............}............}......}.....(!......(+......0..)........{.........("...t......\|......(...+...3.....0..)........{.........($...t......\|......(...+...3.....0..)........{.........("...t......\|......(...+...3.....0..)........{.........($...t......\|......(...+...3.&...}......0............{.....+..*.0..

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.893327073826682
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Aviso de transferencia.exe
File size:	509'440 bytes
MD5:	8d664129af173ed945236efb82d4ad67
SHA1:	7e0f8f79786ebbeb561171032ea65fcfcd6db437
SHA256:	ae26ace2f3bcb3c94a3a8af4a6684da129aa08d73c18a5311d7491d006b20042
SHA512:	a0217bf3c09b55b56a2b1d2e520406c920ebe9397e0b8054810244be5c01674695615f90c180ae17b3797886a0829744a576b98adde24b8523b681b8b4bcc1ba
SSDEEP:	12288:9dSkhMOoltiJWCjRPuUW8FmGevNPJWBG9ythzO40BUhq:DSkh5oDiJhuUdyPJWBGYthzOBBJ
TLSH:	E8B4014033FC4F1BEA3A6BFA50F4506117F6998AA961F71D5CC721EB4522F428A60F1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x47d9b6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC5CCFDE4 [Thu Feb 28 02:18:12 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7d964	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7e000	0x63c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7b23c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7b9bc	0x7ba00	8da60fb641d9d5c90d9bf999944594ef	False	0.9201805801314459	OpenPGP Public Key Version 7	7.9062155732125765	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x7e000	0x63c	0x800	0d66329dc362e874be0e7e71eb9d3e5f	False	0.34375	data	3.522781974943758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0xc	0x200	856e85440c0ca15d572b9b781d2eefe3	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7e090	0x3ac	data			0.42446808510638295
RT_MANIFEST	0x7e44c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T14:18:28.281688+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.38.142.240	1962	192.168.2.7	49775	TCP
2024-10-21T14:18:28.281688+0200	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.38.142.240	1962	192.168.2.7	49775	TCP
2024-10-21T14:18:28.281688+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	185.38.142.240	1962	192.168.2.7	49775	TCP
2024-10-21T14:18:28.281688+0200	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	185.38.142.240	1962	192.168.2.7	49775	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 14:18:27.428352118 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:27.433665991 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:27.433747053 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:27.444564104 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:27.449923038 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:28.266586065 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:28.266606092 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:28.266689062 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:28.276408911 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:28.281687975 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:28.517374039 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:28.574573994 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:29.659198999 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:29.666515112 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:29.666572094 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:29.672401905 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:40.748640060 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:40.793495893 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:40.864810944 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:40.918557882 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.310321093 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.315778017 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:44.315881968 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.321177006 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:44.555716038 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:44.605891943 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.672353983 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:44.674150944 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.680293083 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:44.680380106 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:44.685868025 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:58.966114998 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:58.971426964 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:58.971502066 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:58.977067947 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:59.211204052 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:59.262171030 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:59.327712059 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:59.329469919 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:59.335589886 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:18:59.335676908 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:18:59.341049910 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:10.748553991 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:10.793561935 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:10.864550114 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:10.918591976 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.622239113 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.627655983 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:13.627727032 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.633040905 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:13.867919922 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:13.918557882 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.983944893 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:13.985897064 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.991338015 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:13.991465092 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:13.997334957 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.278130054 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:28.283444881 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.283515930 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:28.288866043 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.523392916 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.574718952 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:28.639596939 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.641052961 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:28.646409988 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:28.646495104 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:28.651787043 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:40.749310970 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:40.793714046 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:40.865466118 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:40.918579102 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:42.934695959 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:42.940592051 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:42.940738916 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:42.947382927 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:43.183751106 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:43.231007099 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:43.299782991 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:43.301278114 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:43.306703091 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:43.306787968 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:43.312243938 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.592406988 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:57.597701073 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.597769976 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:57.603091955 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.837631941 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.887381077 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:57.953531981 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.955519915 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:57.960978031 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:19:57.961064100 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:19:57.967112064 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:10.749448061 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:10.793569088 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:10.865566015 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:10.918535948 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.028273106 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.033833981 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:13.036900043 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.042279005 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:13.276534081 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:13.324791908 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.392775059 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:13.393474102 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.399589062 CEST	1962	49775	185.38.142.240	192.168.2.7
Oct 21, 2024 14:20:13.399857998 CEST	49775	1962	192.168.2.7	185.38.142.240
Oct 21, 2024 14:20:13.405679941 CEST	1962	49775	185.38.142.240	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 14:18:27.411679983 CEST	60998	53	192.168.2.7	1.1.1.1
Oct 21, 2024 14:18:27.425823927 CEST	53	60998	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 14:18:27.411679983 CEST	192.168.2.7	1.1.1.1	0xf432	Standard query (0)	quin.ydns.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 14:18:23.891134024 CEST	1.1.1.1	192.168.2.7	0xf932	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:18:23.891134024 CEST	1.1.1.1	192.168.2.7	0xf932	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:18:27.425823927 CEST	1.1.1.1	192.168.2.7	0xf432	No error (0)	quin.ydns.eu	185.38.142.240	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:18:04
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Aviso de transferencia.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aviso de transferencia.exe"
Imagebase:	0x550000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1276809734.0000000009470000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.1275545686.0000000002948000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1275781875.0000000003909000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:18:09
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Aviso de transferencia.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aviso de transferencia.exe"
Imagebase:	0xde0000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000008.00000002.1321474542.0000000001F88000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000008.00000002.1320113027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000008.00000002.1322217899.0000000003581000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"' & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat""
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "windowsBook" /tr '"C:\Users\user\AppData\Local\Temp\windowsBook.exe"'
Imagebase:	0xff0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:18:14
Start date:	21/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0x4d0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:18:16
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Imagebase:	0xb20000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000011.00000002.1390252194.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:18:17
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Imagebase:	0x810000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:18:20
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Imagebase:	0x280000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:18:20
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Imagebase:	0xce0000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.1444950747.0000000005630000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000014.00000002.1440972671.000000000304C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:18:21
Start date:	21/10/2024
Path:	C:\Users\user\AppData\Local\Temp\windowsBook.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\windowsBook.exe"
Imagebase:	0xb50000
File size:	509'440 bytes
MD5 hash:	8D664129AF173ED945236EFB82D4AD67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000016.00000002.2483789589.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000016.00000002.2483789589.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000016.00000002.2486571211.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	110
Total number of Limit Nodes:	7

Executed Functions

Function 094D0040 Relevance: 7.3, Strings: 5, Instructions: 1001
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TJq, xrefs: 094D01E3
pq, xrefs: 094D0CFF
xbq, xrefs: 094D0170
4'q, xrefs: 094D0C2A
Teq, xrefs: 094D088E

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: 4'q$TJq$Teq$pq$xbq
API String ID: 0-4142780942
Opcode ID: 8334ea13ec533fa4c24bb9758a067b889224c7a93b2529501c7f39575cc97cc6
Instruction ID: a3b581cb8a98814f341bef4f198cab1062bef8f4784a03560ee83a18d6b42a1f
Opcode Fuzzy Hash: 8334ea13ec533fa4c24bb9758a067b889224c7a93b2529501c7f39575cc97cc6
Instruction Fuzzy Hash: FAB2B474E01228DFDB64CF69C984AD9BBB2FF89304F1581E9D509AB265DB319E81CF40

Function 0111D3E8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0111D476
GetCurrentThread.KERNEL32 ref: 0111D4B3
GetCurrentProcess.KERNEL32 ref: 0111D4F0
GetCurrentThreadId.KERNEL32 ref: 0111D549

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 923a5486c9ac5bf648d31b8b0a7df0e015c18542db572099f854530b86274d3a
Instruction ID: ee25b2ff33b72e0ad974760138ba84313422143fde7e964ba0929f6dc14ca295
Opcode Fuzzy Hash: 923a5486c9ac5bf648d31b8b0a7df0e015c18542db572099f854530b86274d3a
Instruction Fuzzy Hash: 935178B0D013098FDB18DFAAD548B9EBBF1AF48304F20C469D519A72A0D7346945CF26

Function 0111D3F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0111D476
GetCurrentThread.KERNEL32 ref: 0111D4B3
GetCurrentProcess.KERNEL32 ref: 0111D4F0
GetCurrentThreadId.KERNEL32 ref: 0111D549

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f1c55e693d553e68486f93f5c1610677b82f60e7296aad179bd217f646127bda
Instruction ID: 2a95ca05e4e9297eda5d6761153916f7e16e732c94267f462c791a494f2cac78
Opcode Fuzzy Hash: f1c55e693d553e68486f93f5c1610677b82f60e7296aad179bd217f646127bda
Instruction Fuzzy Hash: C55147B0D013098FDB18DFAAD548B9EBBF1EF88314F20C469E519A7250D7346945CF66

Function 094DF424 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 094DF666

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 353777a6fc4f8b836a3a418c81582bd241bf5f1970622d7589e9da6f8acf8179
Instruction ID: 43ef5a666aab29d93f1319719af956524681c64228f0edcf57fc67850cb73eee
Opcode Fuzzy Hash: 353777a6fc4f8b836a3a418c81582bd241bf5f1970622d7589e9da6f8acf8179
Instruction Fuzzy Hash: BCA15D75D117198FDB24CF68C851BEEBBF2BF44310F1482AAE809A7240DB759985CFA1

Function 094DF430 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 094DF666

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3e871dcbc3c81db7c71c467c7501a7bdbd6cb38efcb67f1578316c5deddd41fc
Instruction ID: c1e2a0593dbe028ff568c9409d12bed46b7066c0beeab58bb1b8bdc0c3a70ace
Opcode Fuzzy Hash: 3e871dcbc3c81db7c71c467c7501a7bdbd6cb38efcb67f1578316c5deddd41fc
Instruction Fuzzy Hash: FE915D75D117198FDB24CF68C851BEEBBF2BF48310F1481AAE809A7240DB759985CFA1

Function 0111AD68 Relevance: 1.7, APIs: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0111AFBE

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb217b7b90cc5292aa89a0f39ebfbe4b29f8d5e1e602ffb5d056a348ec91c834
Instruction ID: c31299b0f9451af427d54e91014dc045e2517f62b118985e950f2f7f5f0a3e4a
Opcode Fuzzy Hash: eb217b7b90cc5292aa89a0f39ebfbe4b29f8d5e1e602ffb5d056a348ec91c834
Instruction Fuzzy Hash: 37815670A02B458FEB28DF29E04579AFBF1BF88304F00892DD58AD7A54D735E846CB91

Function 0111590C Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011159C9

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d6e2bfa5e6a0fb08be039b6d3b730ef463c430a5c4b604797096f96669fc96b4
Instruction ID: 84fed31b56e9e5880e789f81ee276572465e3680e044d985c5adfc643ab661aa
Opcode Fuzzy Hash: d6e2bfa5e6a0fb08be039b6d3b730ef463c430a5c4b604797096f96669fc96b4
Instruction Fuzzy Hash: 4B41F4B1C0071DCBEB28CFA9C88479DFBB6BF89314F20806AD508AB255DB755946CF50

Function 011144E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011159C9

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 52ba2722f613ed2ef79ca6bde1742fc82cb0c242079383ac7ca000f408be7938
Instruction ID: e31a39023070ef2e4e3f135db5c0d3f54f9d3f6f284f3babe644bdea175f5283
Opcode Fuzzy Hash: 52ba2722f613ed2ef79ca6bde1742fc82cb0c242079383ac7ca000f408be7938
Instruction Fuzzy Hash: 0941D4B1C0071DCBEB28DFA9C84479DFBB6BF49314F208169D408AB255DB755946CF90

Function 0111D701 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0111D6C7

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 970e99816e8fb77c5c88a9155d09f3a930330c3a0a36e05c0a234759fe01bd9b
Instruction ID: 80664a9192caa9aad9f295cfa2f177492c1ca2c94c9c84ebe7ca0fbd2a1a37a6
Opcode Fuzzy Hash: 970e99816e8fb77c5c88a9155d09f3a930330c3a0a36e05c0a234759fe01bd9b
Instruction Fuzzy Hash: 6131A134E803808FE704EFA1F4587693BA5F785718F118929E9518F3D9CAB84956CB11

Function 094DF1A2 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 094DF238

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 36f20c5151dcef1c7b46d185e6842014e0b3bbb4499bf83dd121891201c8b52e
Instruction ID: bb3abdedec15fe3fa0f102e1a3811bace902dccaa8a08a58ee4cc018ea18cd20
Opcode Fuzzy Hash: 36f20c5151dcef1c7b46d185e6842014e0b3bbb4499bf83dd121891201c8b52e
Instruction Fuzzy Hash: EB2104759103099FDB20DFA9C885BEEBBF1FF48310F50852AE919A7240C7799945CBA4

Function 094DF1A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 094DF238

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7b179ca4eaab96b716029fe14d395a2c3b65387fb79783eee1a67489f0b0077e
Instruction ID: 24cc3df44513c84596dc8dab78b36797706c2af016e5e5bc2847ba7161512d96
Opcode Fuzzy Hash: 7b179ca4eaab96b716029fe14d395a2c3b65387fb79783eee1a67489f0b0077e
Instruction Fuzzy Hash: 1D212575D003099FDB20DFAAC885BEEBBF5FF48310F50842AE919A7240D7799945CBA4

Function 094DF008 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 094DF08E

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9fc0656d7a28aa1802b5d8c60c3878f76c91fe15f5e08eec28021d9d0b77d2d2
Instruction ID: 54984a78cd97c7c6ff4b8208697b2f20b8c3957a394d48383d3b1834d58dbd74
Opcode Fuzzy Hash: 9fc0656d7a28aa1802b5d8c60c3878f76c91fe15f5e08eec28021d9d0b77d2d2
Instruction Fuzzy Hash: D1212875D103098FDB20DFAAC4857EEBBF4AF48314F14842AD559A7240DB789945CFA0

Function 094DF290 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 094DF318

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 67dca6083272e2da80dd990bcec6eab9fd46c0b7cbf0c45289f4abcfc8550724
Instruction ID: c3d5711b62bcd98f9536e6d1f8628acd1f47ae290c1e6f7be3b9ec8b3db5aec4
Opcode Fuzzy Hash: 67dca6083272e2da80dd990bcec6eab9fd46c0b7cbf0c45289f4abcfc8550724
Instruction Fuzzy Hash: FF210575D103499FDB20DFA9D881BEEBBF5FF48310F50842AE919A7240C7399945CB64

Function 094DF010 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 094DF08E

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: abd36593d17b0f383ff8cab78b28f3513918973422a8a9ebc1ee084d604e2bad
Instruction ID: a92c2dbb55b4b0ef40ddab4fee004f6270a303603697a635d5d7cd2066fdb491
Opcode Fuzzy Hash: abd36593d17b0f383ff8cab78b28f3513918973422a8a9ebc1ee084d604e2bad
Instruction Fuzzy Hash: 00213575D003098FDB20DFAAC485BAEBBF4EF48324F54842AD559A7240DB789945CFA4

Function 094DF298 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 094DF318

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: dfd681bdc33db16956341cf414935a1aa0ecc66eebcec88ed79932d556fc41bd
Instruction ID: a9bf63a552f6c067b58c007801abeecc270c534f211356a2bedd047475bdc4bb
Opcode Fuzzy Hash: dfd681bdc33db16956341cf414935a1aa0ecc66eebcec88ed79932d556fc41bd
Instruction Fuzzy Hash: 80212875C003499FDB20DFAAC841BEEBBF5FF48310F50842AE919A7240C7399945CBA4

Function 0111D640 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0111D6C7

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 687d3bd4dbda95cbece45c47e2ae3821982fa1316bcbd75cd7b2c8b39a4cafb0
Instruction ID: eca2fbe6db9f7863f2c52318769691561121f8d89716cbd395d97e8eb77fb023
Opcode Fuzzy Hash: 687d3bd4dbda95cbece45c47e2ae3821982fa1316bcbd75cd7b2c8b39a4cafb0
Instruction Fuzzy Hash: 3421E4B5D003089FDB10CF9AD984ADEFBF4EB48310F14842AE958A3350D374A940CF64

Function 0111D638 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0111D6C7

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6de527a25b1083cdc958a87d0b4e08915104b04d3b65c52d7ff1fa36bd322a11
Instruction ID: 727d2644ae2adde6df602dbb5a85b7950cda604bd11ab83e2090681443a6c91f
Opcode Fuzzy Hash: 6de527a25b1083cdc958a87d0b4e08915104b04d3b65c52d7ff1fa36bd322a11
Instruction Fuzzy Hash: F221E3B5D00209DFDB10CFAAD585ADEFBF5FB48310F14842AE958A3250D774A941CF64

Function 094DF0E0 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 094DF156

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fb83d4db39905c59dd309e2bbce0172f781212f407b393a53fd21e28a3c9246d
Instruction ID: cfd5c50c592b0c459f69a5bfa8cfa62386633f748b9448b48f0205e1d419f28f
Opcode Fuzzy Hash: fb83d4db39905c59dd309e2bbce0172f781212f407b393a53fd21e28a3c9246d
Instruction Fuzzy Hash: 83114776C003498FDB20DFA9C845BDEBBF1EF48320F20841AE519A7250CB359945CFA0

Function 094DF0E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 094DF156

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c6e6bb550b4616f541d5b173f288439b189b021dd1e534090551977ed99bdd9c
Instruction ID: 6b890faa6481ae1abc451e3a441573aa52b15efbafcafc738e7598c21466ae0e
Opcode Fuzzy Hash: c6e6bb550b4616f541d5b173f288439b189b021dd1e534090551977ed99bdd9c
Instruction Fuzzy Hash: 04112675D003499FDB20DFAAC845BEFBBF5EB48320F14841AE529A7250CB75A945CFA0

Function 094DEF60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 094DEFC2

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cae030684fd82d277bda2344ca7f69509ac085dc3ceb7a692140b9e0d26c88fd
Instruction ID: cc153ab46a24fac92ca2391d513a336c4b1029b3b2632b7e24478fbddccd6e63
Opcode Fuzzy Hash: cae030684fd82d277bda2344ca7f69509ac085dc3ceb7a692140b9e0d26c88fd
Instruction Fuzzy Hash: AD112875D003498FDB20DFAAC4457AFFBF5EB48220F24882ED519A7640CB75A941CBA4

Function 0BF610B9 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BF6111D

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a72e8838e1417191a271242bcff2a7e3cb2bfa2d4b4ce601fe343ece71a7480e
Instruction ID: 7ae13ec070baf91086a6219ba0e993b36a5f858259983850c22d84a39aa918de
Opcode Fuzzy Hash: a72e8838e1417191a271242bcff2a7e3cb2bfa2d4b4ce601fe343ece71a7480e
Instruction Fuzzy Hash: 0311F5B58003499FDB20DF9AD885BDEFBF4EB48310F108419D519A7210C375A544CFA1

Function 0111AF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0111AFBE

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2e2061970f75ad5dbb356bfbd677f78d6e5e91fdeb681685d25e781dd73881b
Instruction ID: 60201ddfec18eaba284c00fd453f4a0228d9355eff1df1f90ebf9aa8ef80e491
Opcode Fuzzy Hash: b2e2061970f75ad5dbb356bfbd677f78d6e5e91fdeb681685d25e781dd73881b
Instruction Fuzzy Hash: 32110FB5C003498FDB24CF9AD444ADEFBF4EF88224F10842AD528A7644C379A545CFA1

Function 0BF610C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BF6111D

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d8087f8f203494b7212c1f11993137d8c948aa51254df7c8bd4b172cb2b7e9c5
Instruction ID: bc86526926fa894a6e46b4b7e6aa01963242b42fa059776ec9c08bdb686d8d9f
Opcode Fuzzy Hash: d8087f8f203494b7212c1f11993137d8c948aa51254df7c8bd4b172cb2b7e9c5
Instruction Fuzzy Hash: 5711E5B58003499FDB20DF9AD845BDEFBF8EB48320F108419D958A7240C375A944CFA5

Function 0BF63C30 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0BF63C90

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4de85f3b5691c262235f3af1e357f2403bb5e700202d41149801282ceb65dcc7
Instruction ID: f4053d17ca22f0a78b3771a15a94f01c6d5d698aead7f3ba675f4c21b9fbcb38
Opcode Fuzzy Hash: 4de85f3b5691c262235f3af1e357f2403bb5e700202d41149801282ceb65dcc7
Instruction Fuzzy Hash: 82113AB5C003498FDB20DF9AD545BEEBBF4EF48320F108419D958A7241D738A545CFA5

Function 0BF63C38 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0BF63C90

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 89ccb7ca9fcc84b5b317a3a37b8272af165f66c9b284cfea60b2d29f90f8d061
Instruction ID: 71d40cda39fcfdb64a0aef75b7a4bb3fe72e72d942dd4e3652b589e5ca65a975
Opcode Fuzzy Hash: 89ccb7ca9fcc84b5b317a3a37b8272af165f66c9b284cfea60b2d29f90f8d061
Instruction Fuzzy Hash: 201148B5C003498FCB20DF9AC445BDEBBF4EB48320F108419D958A7340D738A544CFA5

Function 00C9D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274900848.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd7e13e7df5a88aef6196b97e82d1b4250d3dd1b3e27187bda7171435597d37
Instruction ID: 23453c7874c8efd89f2a653672ac79761aaca1ccfa3649dc90b33b79adcc3139
Opcode Fuzzy Hash: ffd7e13e7df5a88aef6196b97e82d1b4250d3dd1b3e27187bda7171435597d37
Instruction Fuzzy Hash: 1D212571604304DFDF14DF14D9C8B26BB65FB98324F20C1A9E90A1F256C336E856CBA2

Function 00CAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274948402.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414d0fd553eb95f6df9d753b6b9041fc83d637ef67399d43033ab3aa7678d375
Instruction ID: a8f44c94ebc9e33208486046667070d3222e7ed135238a00c81dfed589108d40
Opcode Fuzzy Hash: 414d0fd553eb95f6df9d753b6b9041fc83d637ef67399d43033ab3aa7678d375
Instruction Fuzzy Hash: 38212271604301DFDB14DF20D9C4B16BB61EB89318F20C5ADE84B4B686C336D807CA62

Function 00CAD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274948402.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884dc1c775e0d63ad06bfb1d6d746907d70cd0974ef267a6e4a244eb181655ac
Instruction ID: 9d264c1b30ecb98e625c764c2db62846bfca1089fa2263a4835a8e93eb6bbf60
Opcode Fuzzy Hash: 884dc1c775e0d63ad06bfb1d6d746907d70cd0974ef267a6e4a244eb181655ac
Instruction Fuzzy Hash: 6E210475A04305EFDB15DF10D9C4B26BBA5FB85318F20C6ADE84B4B692C336DC46CA61

Function 00CAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274948402.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f2667af42f49e2fb287e3aca2efba7af632b184bc57d00686b68ca330b846b
Instruction ID: 7077a3ef508c3321d1ce169278e14fb536aa7d176ab3fc85eec8e928211748a0
Opcode Fuzzy Hash: 27f2667af42f49e2fb287e3aca2efba7af632b184bc57d00686b68ca330b846b
Instruction Fuzzy Hash: 3A2165755093C08FCB16CF24D594715BF71EB46314F28C5DAD84A8F6A7C33A990ACB62

Function 00C9D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274900848.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 3b77cf89e72c6d7167099bacaec92b0a664f53a212a1488ab8d186332d52dceb
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: CD110376504240CFCF05CF00D5C4B16BF72FB94324F24C2A9D80A1B256C33AE956CBA1

Function 00CAD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274948402.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 4552db2639f76489b5e73456e393b3beb0ef704058b196a164f9d50216a44871
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0D11DD75504284DFCB05CF10C5C4B15FBB2FB85328F24C6ADD84A4B6A6C33AD84ACB61

Function 00C9D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274900848.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024559a7e6761edb55a5b41a6ef3f68ac662d2640c7f94b67aff7a66b2f48321
Instruction ID: 16e8afddfc0a9ff393e2ce6260a2c6f4b2450aa8e6785e4e5d1ea877a5c4dced
Opcode Fuzzy Hash: 024559a7e6761edb55a5b41a6ef3f68ac662d2640c7f94b67aff7a66b2f48321
Instruction Fuzzy Hash: 23012B311083049EEF204E62DCC8B26FF98DF41721F18C45AED1A1A28AC7389C40CAB1

Function 00C9D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1274900848.0000000000C9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c9d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298811263a8d2f4945d47338cc4988e1940252fb7ed1401c44dc0aebb8acc003
Instruction ID: 2846471fe65d7a7d557068566c6b8c7c605f8157846e737c0a7b5ffc2f9b18ab
Opcode Fuzzy Hash: 298811263a8d2f4945d47338cc4988e1940252fb7ed1401c44dc0aebb8acc003
Instruction Fuzzy Hash: 86F09671504344AEEB208E16DC88B62FFA8EF51735F18C55AED195B287C379AC44CBB1

Non-executed Functions

Function 094D0016 Relevance: 4.0, Strings: 3, Instructions: 245COMMON

Download Yara Rule

Strings

TJq, xrefs: 094D01E3
xbq, xrefs: 094D0170
Teq, xrefs: 094D088E

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: TJq$Teq$xbq
API String ID: 0-4091408781
Opcode ID: 3746bab848c34562c794a433796afece8ece7571b127802bf1e1f638a66ab341
Instruction ID: 50eb4eea38fc56f25997b815a93635e97c4aa7669c0cc408ec391c30ad4cb0fd
Opcode Fuzzy Hash: 3746bab848c34562c794a433796afece8ece7571b127802bf1e1f638a66ab341
Instruction Fuzzy Hash: 5AC1B075E01658CFDB28CF6AD9456DDBBF2AF89300F14C0EAD809AB265DB305A85CF50

Function 0BF62A99 Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

ZKL, xrefs: 0BF62C93

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: ZKL
API String ID: 0-3693865558
Opcode ID: c516a43658e44b15cb60f47be9f3bcaf066aa535e612a433220f8907f6f71a62
Instruction ID: a2b52a8cd8fbb924907e8aadd510b53afa989c8181bdb3008280b3d0754be24e
Opcode Fuzzy Hash: c516a43658e44b15cb60f47be9f3bcaf066aa535e612a433220f8907f6f71a62
Instruction Fuzzy Hash: 6A02DC72F016098FDB19DFB9C8507AEBBF6AF89740F10406AD84AAB390DB34D945CB51

Function 094DC820 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862ca6cb7197f644e50895019b5df8b9572f79813e4b704b9a5dd35db439318d
Instruction ID: 22c17aa3b3b375b6ed12908e7cccc1c567c8d4a17277116728661ca30305bf5b
Opcode Fuzzy Hash: 862ca6cb7197f644e50895019b5df8b9572f79813e4b704b9a5dd35db439318d
Instruction Fuzzy Hash: D9E13C74E002198FDB14DFA8C590AAEFBB2FF89305F24825AD454AB355DB31AD42CF60

Function 094DCC58 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd769f1a1aea4886d21e0e343dc9cf785e07b49d8bdbccbb2a82352984a8c85
Instruction ID: 05f88eff4db61bc9d1c4f6e9aefa13915cbdc1b6dc7aa0be12827d5fb75400e3
Opcode Fuzzy Hash: 4fd769f1a1aea4886d21e0e343dc9cf785e07b49d8bdbccbb2a82352984a8c85
Instruction Fuzzy Hash: 84E12E74E042198FDB14DFA9C590AAEFBB2FF89305F24815AD444AB355D731AD41CF60

Function 094DD090 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2752ed29c2197d0aca3d4578482eefbe2b0366d0ecc6b619c5a744e16679ddbe
Instruction ID: fe9e360285ef10c0ddd115c19baab0f46dbb3057c4371a2884ffb30bc32730a9
Opcode Fuzzy Hash: 2752ed29c2197d0aca3d4578482eefbe2b0366d0ecc6b619c5a744e16679ddbe
Instruction Fuzzy Hash: 5FE11B74E002198FDB14DFA9C590AAEFBB2FF89314F24816AD414AB755D731AD42CF60

Function 094DC3E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a125bcc7dfb2c026bf24cf16053c31be57265f00ef6a532df9fccdce56d081
Instruction ID: f23ca573d1f4738404f47d5a11aaf79a740fcb576832d8cd2bf1b3a67ac8a388
Opcode Fuzzy Hash: b2a125bcc7dfb2c026bf24cf16053c31be57265f00ef6a532df9fccdce56d081
Instruction Fuzzy Hash: FCE11A74E042198FDB14DFA8C590AAEFBB2FF89305F24826AD454AB355DB31AD41CF60

Function 094DE738 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cc8211e8e29e399e227806de8b81de9e62eaf0f8e29e230e600869c2737120
Instruction ID: 957ef9d76f77ed3eee165e0de6469956930a9ab19a9692c9a0b87198cc261a40
Opcode Fuzzy Hash: 10cc8211e8e29e399e227806de8b81de9e62eaf0f8e29e230e600869c2737120
Instruction Fuzzy Hash: EEE13B74E042198FDB14DFA9C590AAEFBB2FF89304F24826AD414AB355DB31AD41CF60

Function 094D4B58 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fd5865e374d4943d000f968b8b9e5c46779a30de7629fff4793df1e5b1ddd5
Instruction ID: a080c05a1a9a5cd1352ea4ef17df077c51812b71a478ff26c9dfba6f3d249722
Opcode Fuzzy Hash: 20fd5865e374d4943d000f968b8b9e5c46779a30de7629fff4793df1e5b1ddd5
Instruction Fuzzy Hash: 2ED10A78D09218CFDB24DFA5C89479EBBF2FF89304F00916AD409AB294DB745A86CF51

Function 094D3980 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0833bc0a804c7241578c3f3ee81bb9a628e4cc7568cfb0bc6e733fc6162180
Instruction ID: 423948826b5e0adc06da8b42be9cbd5a8819d76b88ad0c353f98cf36e01a8200
Opcode Fuzzy Hash: 2e0833bc0a804c7241578c3f3ee81bb9a628e4cc7568cfb0bc6e733fc6162180
Instruction Fuzzy Hash: D0D13735D2475A8ACB11EFA4D894A99F7B1FFD5300F20D79AE0093B215EB706AC4CB81

Function 0111D324 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275304574.0000000001110000.00000040.00000800.00020000.00000000.sdmp, Offset: 01110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1110000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ce94876dd9d39b33f9792695d5b13c1a5f024c17ffba8f2c9b94dec58e3aa4
Instruction ID: 9a009a35e0ab0500aae530826067e9679762b32d0411f8a748d970665aa242bb
Opcode Fuzzy Hash: 29ce94876dd9d39b33f9792695d5b13c1a5f024c17ffba8f2c9b94dec58e3aa4
Instruction Fuzzy Hash: 41A15E36E00216CFCF09DFB9D44459EBBB2FF85304B15857AE905AB269DB31D91ACB40

Function 094DC3B4 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1276917195.00000000094D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d0000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70909590697d72f8a4e62ef60cfad858253eaa737e72d0e8c53c6e1ace380565
Instruction ID: ac57682b0f455c8f5b04736bace5d13ed008bc9c4cd6971e4d70e13157c7790d
Opcode Fuzzy Hash: 70909590697d72f8a4e62ef60cfad858253eaa737e72d0e8c53c6e1ace380565
Instruction Fuzzy Hash: EB514A74E042198FDB14CFA9C5905AEBBF2BF89305F24826AD448AB355DB359D42CFA0

Function 0BF60457 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1277388593.000000000BF60000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BF60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bf60000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9a9016909b0b3e6c4dca9d3d7066a69397d38efe90c11aadddfbef554e2db3
Instruction ID: 2cae188a16cee5c62a38182761d5d3795d033f9cfcab2b329ef027c2ab0cc0b5
Opcode Fuzzy Hash: 8e9a9016909b0b3e6c4dca9d3d7066a69397d38efe90c11aadddfbef554e2db3
Instruction Fuzzy Hash: 52E0C077959104DBC7108B64E4892F8BB79BB4F755F107151981E93252DF305994CE14

Analysis Process: Aviso de transferencia.exePID: 7212, Parent PID: 6756COMMON

Executed Functions

Function 01580EBA Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

(q, xrefs: 01581192
Teq, xrefs: 01580EED

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: (q$Teq
API String ID: 0-2049869722
Opcode ID: 5517c05aae8e9c546aa14a5a464d5243ce57a6ecc42a058e0ba511e59786005c
Instruction ID: 0da11d82e48ae9adfc05b634517394db7a5266566cf30273833575a2f210d932
Opcode Fuzzy Hash: 5517c05aae8e9c546aa14a5a464d5243ce57a6ecc42a058e0ba511e59786005c
Instruction Fuzzy Hash: 8F519F30B101148FCB54DF69C494A5DBBF6FF89710F2580A9E806EF3A5CA799C068B90

Function 01580D20 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

dLq, xrefs: 01580D5B
Hq, xrefs: 01580E40

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: Hq$dLq
API String ID: 0-4038822049
Opcode ID: 7a4a544fedff69fd168ed500f13d018591e71d7726c151e1f8965026b01340c6
Instruction ID: edbd7e69defc48bb0b41190e59932085afc5e1b9813bac34cfc79c59becfc481
Opcode Fuzzy Hash: 7a4a544fedff69fd168ed500f13d018591e71d7726c151e1f8965026b01340c6
Instruction Fuzzy Hash: 1751B031B002148FDB189F68D454A9EBBF6BF89310F1545A9E405EF3A1CA799C09CBA0

Function 01581339 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

LRq, xrefs: 0158138B

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 1ecdc3485ee5f1668dd3750960625717d23bac119b313fbe7f94fc5557893a57
Instruction ID: 579c09557190b61c82f7fd88c7b4131f8f936d76738996281e952388e72bf171
Opcode Fuzzy Hash: 1ecdc3485ee5f1668dd3750960625717d23bac119b313fbe7f94fc5557893a57
Instruction Fuzzy Hash: 4F310D31F002158FCB14AB7D9890AAEBFE6FFC9210B14456EE516EB3A0DE34DD028790

Function 01580D10 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

dLq, xrefs: 01580D5B

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: dLq
API String ID: 0-2312315067
Opcode ID: c032e4842a66e83bae0e6dc0c16ab8d21a299d313a7f6bf3c046b9da121aab64
Instruction ID: 70d123b034d90e71d8b033092f7d707f403a3584a1935a947e674b0bb22ef136
Opcode Fuzzy Hash: c032e4842a66e83bae0e6dc0c16ab8d21a299d313a7f6bf3c046b9da121aab64
Instruction Fuzzy Hash: 62319275A002049FDB14DF68C454BAEBBF5FF88300F148569E505AF3A1CB75AD09CB90

Function 01580E3F Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Hq, xrefs: 01580E40

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 3b7a1d9e0915df1a660b4d94c9f9cb8cd1ccfcd6e9ebf0de9baea42619077046
Instruction ID: d53502aad2b7590a5fc15f02bf6d0ec6f55a93b218ee87c828916958b75edbcf
Opcode Fuzzy Hash: 3b7a1d9e0915df1a660b4d94c9f9cb8cd1ccfcd6e9ebf0de9baea42619077046
Instruction Fuzzy Hash: 1101F9317043504FC749973C945596E3BE6EFC626031548BEE409CF3A2DD2C8C0A8765

Function 01581CA4 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f156c85de2f881dbe24961f4645f958a01047dac1e6c87dfdf28f1b254e9bcd3
Instruction ID: 8ed2bc85134f3c9ed91cf6852332bc6b311f619332f3b3acb4b2b51e1ec4e17e
Opcode Fuzzy Hash: f156c85de2f881dbe24961f4645f958a01047dac1e6c87dfdf28f1b254e9bcd3
Instruction Fuzzy Hash: 2EC11A347006048FDB54EB68D494A6D7BF2FF88310F2544A9E906AB3A5DF35EC46CB51

Function 01581EAC Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47f0eed35849f5301e043db94a673f7b05735650b4062ea97d227161b8972e9
Instruction ID: da8429194266e7036d96973b38d8729a7822b00df07163ccd7010ef2904c22c7
Opcode Fuzzy Hash: b47f0eed35849f5301e043db94a673f7b05735650b4062ea97d227161b8972e9
Instruction Fuzzy Hash: 836109387002048FDB58EB68D4A4A6D7BF2FF88710F254499E906AB3A5CF75EC42DB51

Function 01580AA0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932c21a4cfa70cf57b3d953ace15958d7235537d5d2ea0b60cf36ebe4e92e165
Instruction ID: f608e5daf889713dcf70c6ce47df7ce3eed0a599c6b9c4f4c77fd8b9f98c9f2f
Opcode Fuzzy Hash: 932c21a4cfa70cf57b3d953ace15958d7235537d5d2ea0b60cf36ebe4e92e165
Instruction Fuzzy Hash: BB51D435610211CFC725DF24E49495977A2FF84605750AA6DDC02EB368EF3AAD0EEF80

Function 015811D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5caaab5f722d6ce46d310ca8ec3cac2740ee6ae23004745bd4b7473fdd7c37eb
Instruction ID: f668d7660e77bba7abc779e562175370e40cdb34cdb91eade6cdfae09e89485b
Opcode Fuzzy Hash: 5caaab5f722d6ce46d310ca8ec3cac2740ee6ae23004745bd4b7473fdd7c37eb
Instruction Fuzzy Hash: 2E419171F00219AFCB44EBB9C44466EBBFAFFC9300F248569D44ADB345DA34AD428B91

Function 01580998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc917338bc40d1ebe23657f7f737ef15c135a03cd785110c17b9831d1fb45b
Instruction ID: 80b66991d3243e8b57154780f53cd26ecaa57105cab7e4d71f747a9398a3b472
Opcode Fuzzy Hash: bebc917338bc40d1ebe23657f7f737ef15c135a03cd785110c17b9831d1fb45b
Instruction Fuzzy Hash: C32151306542029FEB68BB78D84466EBBA4BF04701705562DB816EE281EB64894C9B61

Function 0152D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320555627.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_152d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c339bfd1eece56ae672fe44bb8d57ca9b2674605f01f69d26eaaf57e5961602
Instruction ID: f547f1b5ae35113ff8bddc8cf2c68c3c24d29f4354dd50f42d5edb6e3e4a4077
Opcode Fuzzy Hash: 3c339bfd1eece56ae672fe44bb8d57ca9b2674605f01f69d26eaaf57e5961602
Instruction Fuzzy Hash: 8D210672604240DFDB15DF54D9C0B2ABFB5FB84324F20C569D9090E296C376D456CBA2

Function 015809A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b14cc96f997dfd96a764ac116eaa3aa897dbdd0f589d7be4562cc72acf150e
Instruction ID: c3f9713634e6c7beb0b2e298bf6e6af984b09405b5bbb6b262f837b26b6583c3
Opcode Fuzzy Hash: 85b14cc96f997dfd96a764ac116eaa3aa897dbdd0f589d7be4562cc72acf150e
Instruction Fuzzy Hash: 9A2130307112028FEB68BB7DD51462EBBE5BF04601705593DB912EA2C5EFA0D94C9751

Function 01581431 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b42beeb6a02bf1e20202d8ce2de51fb9d649670b35d6469eefa4bb17e8491d1
Instruction ID: 1d2c2f68ab437d99f3c77a1173f53a8d526b7fa62fff23a278bbd594b6e46977
Opcode Fuzzy Hash: 5b42beeb6a02bf1e20202d8ce2de51fb9d649670b35d6469eefa4bb17e8491d1
Instruction Fuzzy Hash: 74118C70A002019FCB54EBB8D5449AA7BFAFF88620715047DE805DB224EB359C06DB90

Function 0152D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320555627.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_152d000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 3d559abf8628a4567d530933b0b44676d2f38ed0fc472d54ec121c94db05e393
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: FC119D76604280CFDB16CF58D5C4B1ABF72FB84324F2485A9D9490A296C376D456CBA2

Function 01581440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0cb6a6c89df29dafd28759c9b39861ad2d7decafc03337d329a1e118c47c26
Instruction ID: a808ce982e35810fbaec353d4cb47c3cc5e63a6e016d5a10b35661689d5b8e45
Opcode Fuzzy Hash: 4d0cb6a6c89df29dafd28759c9b39861ad2d7decafc03337d329a1e118c47c26
Instruction Fuzzy Hash: EB118730B002049FCB54EBBDD559A6A7BE6BF88611725487CD80AEB324EE31DC02CB90

Function 01582200 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d249cdb908ddeda253f428d674673f1a2e9ad1c67cd931af7be7b3a5fe4269
Instruction ID: f8079fb7e56423d895e0ddb9436907efa8192071bf334c0961fa7774aba5da90
Opcode Fuzzy Hash: 96d249cdb908ddeda253f428d674673f1a2e9ad1c67cd931af7be7b3a5fe4269
Instruction Fuzzy Hash: A7F065717452915FC707627C58109AD3FA9AF8721071554DAE401EF2A3D5188C0587A1

Function 01580E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa122cc6faa8f99d3bf2b942c7d3a12f5c9ec53c23a690a8fc11490cd52abf2
Instruction ID: ab5258335aef4abe0ee74361c201b8ca94667505099d797500528cc8e0569520
Opcode Fuzzy Hash: baa122cc6faa8f99d3bf2b942c7d3a12f5c9ec53c23a690a8fc11490cd52abf2
Instruction Fuzzy Hash: 6DE08C323002105F8748966EA88495ABBDAEBC8260325487AE50AC7315DD71DC054790

Function 01582195 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44cb893927432abd5c64344fc247da63b32cd0ed11e3b53c082fa71c81873784
Instruction ID: 5279d5e69eeee961841670ce652f4fd652b376b62d7a66f5f762c94c3d4cfafb
Opcode Fuzzy Hash: 44cb893927432abd5c64344fc247da63b32cd0ed11e3b53c082fa71c81873784
Instruction Fuzzy Hash: 42E09B312087A54BDB35D378D01139E7FD26F81319F04096EC1865B681CBB7B90943A2

Function 01582210 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1320828986.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1580000_Aviso de transferencia.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec62f7b8f168807b04c0d78f84c9f2e6e34afb7f98ae91ea9f80e54f8a21e3f
Instruction ID: ab9cea84fbdf2fcac38ee9a67a93fef3e1f43691f7e83441cc76401bb82c3c03
Opcode Fuzzy Hash: fec62f7b8f168807b04c0d78f84c9f2e6e34afb7f98ae91ea9f80e54f8a21e3f
Instruction Fuzzy Hash: 24D0A7327001245BC700B6FDE40559D3BD9AFCE61076444A5E105DF3A5DD25EC0107D4

Analysis Process: windowsBook.exePID: 7760, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	151
Total number of Limit Nodes:	8

Executed Functions

Function 02CED3E8 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02CED476
GetCurrentThread.KERNEL32 ref: 02CED4B3
GetCurrentProcess.KERNEL32 ref: 02CED4F0
GetCurrentThreadId.KERNEL32 ref: 02CED549

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6449129c1b9b0958328f1ee1d83f80c0adcf6a86eb6bf5e0c873118e5859cef4
Instruction ID: 86c44702b1da78a1e55ee3a874bd1e2a716e41552eb44db10547685feaaea61f
Opcode Fuzzy Hash: 6449129c1b9b0958328f1ee1d83f80c0adcf6a86eb6bf5e0c873118e5859cef4
Instruction Fuzzy Hash: 055178B0D013098FDB24DFAAD549B9EBBF5EF88314F208459E01AA73A0DB346945CF65

Function 02CED3F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02CED476
GetCurrentThread.KERNEL32 ref: 02CED4B3
GetCurrentProcess.KERNEL32 ref: 02CED4F0
GetCurrentThreadId.KERNEL32 ref: 02CED549

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 008fd6aeed677fd54e3ff2d90502466f7a2ee19a0512908020f91a4d3b299da1
Instruction ID: 5bd7a84ee993fbf77099cc6a5464e725d60132d470c8657c9a1a3b0cb1ce33ed
Opcode Fuzzy Hash: 008fd6aeed677fd54e3ff2d90502466f7a2ee19a0512908020f91a4d3b299da1
Instruction Fuzzy Hash: 285176B0D013098FDB24DFAAD549B9EBBF5EF88314F208059E41AA73A0DB346944CF65

Function 073FF424 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073FF666

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 052b3d4f132cfc63b258baeda7501b40e032e3368c65d68347bac69b3ffabb9a
Instruction ID: 55d6d4b34357d57f84e6d3f0043f8ff16516e85280136f4e98ba5bf92a1f4ba6
Opcode Fuzzy Hash: 052b3d4f132cfc63b258baeda7501b40e032e3368c65d68347bac69b3ffabb9a
Instruction Fuzzy Hash: 73A17FB1D0071ACFEB24DF68C841BEDBBB2BF44350F148169E948A7280DB759985CF91

Function 073FF430 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 073FF666

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 63976a595c57d82b03599c3acc66d1332aa2732a490d42c1764c88c43aa05f33
Instruction ID: 3fcdcfaaa8ca3cac6b6eb2b81e3503bc687b1209dbff88474d053adabaf7536b
Opcode Fuzzy Hash: 63976a595c57d82b03599c3acc66d1332aa2732a490d42c1764c88c43aa05f33
Instruction Fuzzy Hash: 61916DB1D0071ACFEB24DF68C841BEDBBB2BF48354F148169E948A7280DB759985CF91

Function 02CEAD68 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CEAFBE

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4c2a4f0044be2ab8666442e3c076ab59a54d5153b5eb591e2cf60bccd3379d0a
Instruction ID: 740d3bf9c2e93d2cf9fe07a620fd08d8ca515eddb7377c11e09d23bd5a114f82
Opcode Fuzzy Hash: 4c2a4f0044be2ab8666442e3c076ab59a54d5153b5eb591e2cf60bccd3379d0a
Instruction Fuzzy Hash: 20712470A00B458FDB24DF2AD44175ABBF2FF88304F048A2DD48AD7A50DB75E956CB91

Function 02CE44E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CE59C9

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cb2f60facadcff4d65db5e877b6509d9343c7de4a13c66c6b34112ca4a3fc067
Instruction ID: f1aca9ed84d32a181b31a3de1f984707f31acceaab84a10207f3b9dd4f3d5cbd
Opcode Fuzzy Hash: cb2f60facadcff4d65db5e877b6509d9343c7de4a13c66c6b34112ca4a3fc067
Instruction Fuzzy Hash: 2241F2B1C0071DCBEB24DFA9C88579DBBF5BF48304F60806AD409AB251DB756946CF90

Function 02CE590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CE59C9

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b8714edac8f9e4b28e1e4f4069647c061ccb12e51c2c83420c5d7d76eb5ab973
Instruction ID: 4437bf9cae3885ae2e5ff0abfd7f8a8272e4373f433d7d8c1fd41d0d9c467c3b
Opcode Fuzzy Hash: b8714edac8f9e4b28e1e4f4069647c061ccb12e51c2c83420c5d7d76eb5ab973
Instruction Fuzzy Hash: 1341F1B1C0071DCBEB24CFA9C98579DBBB5BF48304F60816AD409AB254DB755946CF90

Function 02CED701 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02CED6C7

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6b6ef95caf47f22f11a8ba4f0df2f7082315b61e43b417a7dd9a63011db3826f
Instruction ID: e38c6f3ac82b18f44a35b085802c7e3e3217d12cde7ccfc37f1ae085b5f4e0df
Opcode Fuzzy Hash: 6b6ef95caf47f22f11a8ba4f0df2f7082315b61e43b417a7dd9a63011db3826f
Instruction Fuzzy Hash: B9318434E80341CFEB15DF61F8557293BA9F788310F108929EA118F7D4CAB49865CF51

Function 073FF1A2 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073FF238

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d2f7cb4339ac47cc7cd484ea6a5f865ee5fed237a09a6f76fd665b6989874d81
Instruction ID: 6fdc3f4d4c9dc2b8ecb272c9cfb7c0431bd7156cebcdeb6ec7e3781d3ee3bece
Opcode Fuzzy Hash: d2f7cb4339ac47cc7cd484ea6a5f865ee5fed237a09a6f76fd665b6989874d81
Instruction Fuzzy Hash: 832137B590034D9FDB10DFA9C881BEEBBF5FF48310F50842AE958A7240C7789945CBA0

Function 073FF1A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 073FF238

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7f435b60d32297525caf825d31894ce92f69344a2c3b944712c89bcc6676f284
Instruction ID: 5bb6eddf186d906fa7ead0529d0fbdc2705c6a777a6d7cd8bbf90ca0d7d2ac8e
Opcode Fuzzy Hash: 7f435b60d32297525caf825d31894ce92f69344a2c3b944712c89bcc6676f284
Instruction Fuzzy Hash: E62115B590034D9FDB10DFA9C881BEEBBF5FB48310F50842AE918A7240C7789941CBA4

Function 073FF290 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073FF318

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 51be9f8477caf34bb187ca64916e3ef8cca81fa8b43bdcc2b48235ed2859c3c1
Instruction ID: 1d90ad785eb6caf803605793e8ad00cd7a70e88ca2e6f4ab357b9870887d8217
Opcode Fuzzy Hash: 51be9f8477caf34bb187ca64916e3ef8cca81fa8b43bdcc2b48235ed2859c3c1
Instruction Fuzzy Hash: E52105B5C003599FDB10DFAAC881BEEBBF5FF48310F50842AE959A7240C7399945CBA5

Function 073FF008 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073FF08E

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7a6dbe105353c370d38360b5c1528e369ef3c24b60dc2dfafbf3106fceaf72b7
Instruction ID: 0317151884b2abe20fcb39a45a7093c60e7cd91998875affa714276c62f60e7f
Opcode Fuzzy Hash: 7a6dbe105353c370d38360b5c1528e369ef3c24b60dc2dfafbf3106fceaf72b7
Instruction Fuzzy Hash: BD2148B5D0030A9FDB24DFA9C4817EEBBF0AF48310F14842AD919A7340DB789945CFA1

Function 073FF298 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 073FF318

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fc33ae8fc5707d3e616b1f35d10864d91194f27fd5aad237bbea64c1ffa5f241
Instruction ID: e3a37cb48ad2a40737f7f0284d805ef684d636f83b4bd7183539ea2c926004e4
Opcode Fuzzy Hash: fc33ae8fc5707d3e616b1f35d10864d91194f27fd5aad237bbea64c1ffa5f241
Instruction Fuzzy Hash: 0621F5B5C003599FDB10DFAAC881BEEBBF5FF48310F50842AE959A7240C7799941CBA5

Function 073FF010 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 073FF08E

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a574b92650c31ec8d28227b3d5b1beee2b723e5779548bbd4d55cec57040b446
Instruction ID: 6232527cbf659560488423dacd3851d3a406fded751744a47a6726e9f1160043
Opcode Fuzzy Hash: a574b92650c31ec8d28227b3d5b1beee2b723e5779548bbd4d55cec57040b446
Instruction Fuzzy Hash: 082138B5D0030A8FDB20DFAAC4857AEBBF4EF48310F54842AD959A7340CB789945CFA5

Function 02CED640 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02CED6C7

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2e72c90d40f42626278ffa90383661b68353e891e5ef6872146fa001f72cf96a
Instruction ID: 260a221736cd8baecf8b5b0f08646bed1c29cd80f02db35d190d257a38ea039b
Opcode Fuzzy Hash: 2e72c90d40f42626278ffa90383661b68353e891e5ef6872146fa001f72cf96a
Instruction Fuzzy Hash: AF21E4B5D003489FDB10CF9AD985ADEBBF8FB48310F14841AE919A3350C378A940CF65

Function 02CED638 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02CED6C7

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3cc3a5a92064aaa62206a6663d3dbd041cdb8c9ac15b1ed839c8abc88640654
Instruction ID: d9f159212210ab1149e0b7906b622cc721c028f38270b89c511c4da2a29241b7
Opcode Fuzzy Hash: e3cc3a5a92064aaa62206a6663d3dbd041cdb8c9ac15b1ed839c8abc88640654
Instruction Fuzzy Hash: 4E21E4B5D002089FDB10CF9AD985AEEBBF9FB48310F14841AE959A7350D378A944CF65

Function 073FF0E0 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073FF156

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d3395f94830fc5fd929835caf05f9b909cd579b8e5d78b9d2ad88d64352761b
Instruction ID: a9ad6fc84420879f30c9999eff3b71b965e81b1a536c9898c30ce3404787976a
Opcode Fuzzy Hash: 8d3395f94830fc5fd929835caf05f9b909cd579b8e5d78b9d2ad88d64352761b
Instruction Fuzzy Hash: B92147768003499FDB20DFAAC845BEFBBF5EF48320F14841AE919A7250CB759944CFA5

Function 073FF0E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 073FF156

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 65e15936234eb8ee900556c1b77475b9536b80a998cfee7d6027521f1856f997
Instruction ID: 05632553cad0a20c33bb107eecba31ab6281fbdee8266c70460fddada0d8f66e
Opcode Fuzzy Hash: 65e15936234eb8ee900556c1b77475b9536b80a998cfee7d6027521f1856f997
Instruction Fuzzy Hash: 8D112675C003499FDB20DFAAC845BEFBBF5EB48320F148419E919A7250CB759940CFA4

Function 073FEF59 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073FEFC2

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a170c5cea498429170f63be67393908cb33f08d5fe042bb239fe08539b608d2e
Instruction ID: 702d3168a91970b257db20dde118f3de5848b7609a4bbb88f83983230e39802e
Opcode Fuzzy Hash: a170c5cea498429170f63be67393908cb33f08d5fe042bb239fe08539b608d2e
Instruction Fuzzy Hash: 98118BB5C003498FDB20DFAAC4457EEFBF4EB48320F60841AD519A7640CB355904CB90

Function 09C711F8 Relevance: 1.6, APIs: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 09C7125D

Memory Dump Source

Source File: 00000011.00000002.1395335887.0000000009C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9c70000_windowsBook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ae90090450c93ba7bd98a2ca0e5bad458f565f1b38d05d3b52711b3c2184e204
Instruction ID: 3d36a08a27219e4db1abb243a2205b49085d6817837361b67c6a3112644a09c4
Opcode Fuzzy Hash: ae90090450c93ba7bd98a2ca0e5bad458f565f1b38d05d3b52711b3c2184e204
Instruction Fuzzy Hash: 6311F5B58003499FDB10DF9AD885BEEFBF8EB48324F20845AE518A7640C375A944CFA1

Function 073FEF60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 073FEFC2

Memory Dump Source

Source File: 00000011.00000002.1394733947.00000000073F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_73f0000_windowsBook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 76ded82ccb2144b602b5127ead64871b022a54a7f0d922e0dcca95721cb90487
Instruction ID: 75edc3c93890ef77fa862cf85e9f708cb508001f1491e2659d06a9ed24201093
Opcode Fuzzy Hash: 76ded82ccb2144b602b5127ead64871b022a54a7f0d922e0dcca95721cb90487
Instruction Fuzzy Hash: A8116AB1C003498FDB20DFAAC4457AEFBF4EB88320F208419D519A7340CB396900CF94

Function 02CEAF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CEAFBE

Memory Dump Source

Source File: 00000011.00000002.1390058911.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2ce0000_windowsBook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f0a82f652c4ff2bd2a6fc00ce70de320be3af226826ead2322e94f336aaf7ec
Instruction ID: 2f5930c1ca8f003e094c966af6cdcb31e3cbf1cd037bc50d65cc0026dc7b4db5
Opcode Fuzzy Hash: 4f0a82f652c4ff2bd2a6fc00ce70de320be3af226826ead2322e94f336aaf7ec
Instruction Fuzzy Hash: E311E3B6C003498FDB10DF9AD444BDEFBF4EB88314F11845AD419A7610C379A545CFA5

Function 09C71200 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 09C7125D

Memory Dump Source

Source File: 00000011.00000002.1395335887.0000000009C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9c70000_windowsBook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 47000c3aff16c12cb02b4df98f256b3ff855df7573d8c6906a8f1127c7dccebb
Instruction ID: 1d8b7d2ce4d336a1c85f09ff273dc14e7f9f88eff30a435383a2abf556e0cb26
Opcode Fuzzy Hash: 47000c3aff16c12cb02b4df98f256b3ff855df7573d8c6906a8f1127c7dccebb
Instruction Fuzzy Hash: 3B1103B5C003499FDB10DF9AD885BDEFBF8EB48320F10841AE518A7200C375A944CFA1

Function 09C73D7A Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 09C73DD8

Memory Dump Source

Source File: 00000011.00000002.1395335887.0000000009C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9c70000_windowsBook.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 05836626dda0cd5d3d84da8133b5a5310f30dbf700af216ea3228e97628fcbad
Instruction ID: bd80573a84c5a13a8a80742b52bd31a83f1404bbdd4a4f7702a7947100dbd03e
Opcode Fuzzy Hash: 05836626dda0cd5d3d84da8133b5a5310f30dbf700af216ea3228e97628fcbad
Instruction Fuzzy Hash: 5D1125B5C003898FDB20DF9AD445BEEBBF4EB48320F14845AE958A7340C739A945CFA1

Function 09C73D80 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 09C73DD8

Memory Dump Source

Source File: 00000011.00000002.1395335887.0000000009C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_9c70000_windowsBook.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b2339c4b8d1a52b806ed72413ded299c4b5887cf5718dbfa86c7ff1f2678dad
Instruction ID: aac491a090ef3dd5e22e8a688bd3174318e8c3b872996b9f03cb0679c9090225
Opcode Fuzzy Hash: 5b2339c4b8d1a52b806ed72413ded299c4b5887cf5718dbfa86c7ff1f2678dad
Instruction Fuzzy Hash: AD11F2B5C103498FDB20DF9AD545BEEBBF4EB48320F10841AE958A7340D739A945CFA5

Function 0149D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389822529.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_149d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3782382f5345001a4397f256dcbe482d7c4166e058979e52b62d3486b4545d11
Instruction ID: b889847a5237d705064ab33abe611c7dad74549e750a37d95d3817bad5c323a0
Opcode Fuzzy Hash: 3782382f5345001a4397f256dcbe482d7c4166e058979e52b62d3486b4545d11
Instruction Fuzzy Hash: 3C21C171904240DFDF15DF54D9C0B26BF65FB88328F24C56AE9090B266C336D456CBA2

Function 014AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389872953.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_14ad000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432dc663d8f62c6692a6c3c91d15f62657d1719cf49e60566d24eaa1738fff62
Instruction ID: 7bb3ebdc192a9d3941e85b36a798b648a9edf8f31653514c38df8a26e02dad83
Opcode Fuzzy Hash: 432dc663d8f62c6692a6c3c91d15f62657d1719cf49e60566d24eaa1738fff62
Instruction Fuzzy Hash: 782125B1A48300DFDB15DF54D9C4B16BB61EB94318F60C56ED84A4B7A6C336D407CA61

Function 014AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389872953.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_14ad000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed20f741a0bc8dc1389f7240541f8990f0ddf73974df1c2e346299499cb6dbe4
Instruction ID: c5f477e55c67b0d6fa55772a0cc04e9a436416cd1ac6aa63985dd113c110b973
Opcode Fuzzy Hash: ed20f741a0bc8dc1389f7240541f8990f0ddf73974df1c2e346299499cb6dbe4
Instruction Fuzzy Hash: 0D212572A04200DFDB05DF94D9C0B26BB61FB94324F60C56ED8094B762C336D807CA61

Function 014AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389872953.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_14ad000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f56e2ec05a56a126547bb3e50665b302da4e96f81c1d3786c297f475d3a2a0
Instruction ID: c9a4f098ba9a0322aa8d20be176cef49eb409c84bee46f4cd3178ac3cd9e9d8d
Opcode Fuzzy Hash: 80f56e2ec05a56a126547bb3e50665b302da4e96f81c1d3786c297f475d3a2a0
Instruction Fuzzy Hash: F22192755493808FCB07CF24D590716BF71EB46214F29C5DBD8498F6A7C33A980ACB62

Function 0149D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389822529.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_149d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: d8da1343f289fb4bcae28cecd105f4a0d5e8a29e35869aaabf21caa8aca59e61
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 8011AF76904280CFCF16CF54D9C4B16BF72FB84324F24C6AAD8494B666C336D456CBA1

Function 014AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389872953.00000000014AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_14ad000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 676b8090ba658df29c6a8a6fbef1539b05be9a5abd32143830599f167a518fec
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 2111BB76904280DFCB06CF54C5C4B16BBA2FB84324F24C6AED8494B7A6C33AD40ACB61

Function 0149D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389822529.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_149d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b0e2567b6331e212de3d70050b3dbdeadb576e8cb88bfb724d7694a126b0eb
Instruction ID: fe00910d5a36b29186721662241c53b1c29b154678b79f5f0dbb7170d3fd4449
Opcode Fuzzy Hash: 19b0e2567b6331e212de3d70050b3dbdeadb576e8cb88bfb724d7694a126b0eb
Instruction Fuzzy Hash: 0A01F7318043809EEB204A65CCC4B2BBF98DF41221F18C49BED180A396C3389845CAB1

Function 0149D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1389822529.000000000149D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0149D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_149d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b1a9ddf3d67647566ff3544816ba535342fcba84431306009cad997df5371a5
Instruction ID: 5b935d8dc1f4fdaf6a72304e3222c0e3ff3915d159db210f7f212f750ed7edc6
Opcode Fuzzy Hash: 9b1a9ddf3d67647566ff3544816ba535342fcba84431306009cad997df5371a5
Instruction Fuzzy Hash: 37F0C871404340AEEB108E15CC84B67FF98EF41634F14C49BED180A397C3795844CB71

Analysis Process: windowsBook.exePID: 7800, Parent PID: 7608COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	145
Total number of Limit Nodes:	7

Executed Functions

Function 00FCD3E8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FCD476
GetCurrentThread.KERNEL32 ref: 00FCD4B3
GetCurrentProcess.KERNEL32 ref: 00FCD4F0
GetCurrentThreadId.KERNEL32 ref: 00FCD549

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6e89102927869d770d74ed72fc09ded1100124be1805b11995b61177e1922348
Instruction ID: 8313d3fdb27685eb0dc676d0b3a199cf85b1f9c8832414528df5dd7fba4fd329
Opcode Fuzzy Hash: 6e89102927869d770d74ed72fc09ded1100124be1805b11995b61177e1922348
Instruction Fuzzy Hash: FC5175B0D007098FDB14DFAAD549B9EBBF1EF88314F24842DE009A7360DB746945CB25

Function 00FCD3F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FCD476
GetCurrentThread.KERNEL32 ref: 00FCD4B3
GetCurrentProcess.KERNEL32 ref: 00FCD4F0
GetCurrentThreadId.KERNEL32 ref: 00FCD549

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c2e6d1563237749d463eb944ff53b736e349c725f623d02248e2c35eddb7a57a
Instruction ID: da147d4059150349cff6fd763cce36ce390f8ee09d998a1ea359cb91276c6116
Opcode Fuzzy Hash: c2e6d1563237749d463eb944ff53b736e349c725f623d02248e2c35eddb7a57a
Instruction Fuzzy Hash: 705185B0D0070A8FDB14DFAAD549B9EBBF1EF88314F20842DE408A73A0DB746945CB61

Function 06FEF424 Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FEF666

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8288069500f9ed2d143b6f180c81504b8ae9da11811366e8d9420b9d2e122f0c
Instruction ID: 80ab9c5de7173da98dc0601f37ef0e28b9f99a4648b2e5cf8b72d2e84c372f43
Opcode Fuzzy Hash: 8288069500f9ed2d143b6f180c81504b8ae9da11811366e8d9420b9d2e122f0c
Instruction Fuzzy Hash: 66914C71D017198FEB64DF68C841BEDBBB2BF48310F1485AAE809A7280DB759985CF91

Function 06FEF430 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FEF666

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b8f3065aea7c42b8ffb7cd9b405273dcb27d11395c62d06ef9268c46999e159b
Instruction ID: 79f40db19222f0009b25458fc71137c98021927ca6c1c5a45e8e1b22bd4ff59d
Opcode Fuzzy Hash: b8f3065aea7c42b8ffb7cd9b405273dcb27d11395c62d06ef9268c46999e159b
Instruction Fuzzy Hash: A3914D71D017198FEB64DF68CC41BEDBBB2BF48310F1485AAE809A7280DB759985CF91

Function 00FCAD68 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FCAFBE

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3077d193abb22d32d2cd7aa11d307488078e81733ad7d00b86ec4aab4740b4ce
Instruction ID: c9ee592731a0fdba4109d300df871e2d921bc9a885161a9b49c2329cc7f6d0dd
Opcode Fuzzy Hash: 3077d193abb22d32d2cd7aa11d307488078e81733ad7d00b86ec4aab4740b4ce
Instruction Fuzzy Hash: 45713470A00B0A8FD724DF2AD542B5ABBF1BF88318F00892DD486D7A50DB35F845DB91

Function 00FC44E0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FC59C9

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0a0ed7dd2092310e416edb7604b9f37921f1de3989d9dc75c6681078f54cb3fa
Instruction ID: 15465de6bcf3f4f30fe588772edce3f9d1d48b9461b500ab80c14cfeb9b16afe
Opcode Fuzzy Hash: 0a0ed7dd2092310e416edb7604b9f37921f1de3989d9dc75c6681078f54cb3fa
Instruction Fuzzy Hash: 8D41F3B1C0071DCBDB24DFAAC985B8DBBF5BF48714F20816AD408AB251DB756946CF90

Function 00FC590C Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FC59C9

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b46432b863353f1af8011bdea0b34122bf9e9ab6a29086ef6f65881da5fff2f4
Instruction ID: 64dd24145710b8c6763fd5c5637083d1e2c257f93a5fa4a400398e7cc8ac4dde
Opcode Fuzzy Hash: b46432b863353f1af8011bdea0b34122bf9e9ab6a29086ef6f65881da5fff2f4
Instruction Fuzzy Hash: 8741E3B1C0071DCFDB24DFAAC985B8DBBB1BF48714F24816AD408AB251DB756946CF50

Function 00FCD701 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FCD6C7

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2c2b6a01846f1e41dab87450c3d055ac229f1b17edffd514ef725ef805a5834f
Instruction ID: e9fbd961f3e342c151abc1a7effcbf4991e0cf08e614a697a3e02fc8a89de0c8
Opcode Fuzzy Hash: 2c2b6a01846f1e41dab87450c3d055ac229f1b17edffd514ef725ef805a5834f
Instruction Fuzzy Hash: 74316D34A913408FEB149F60E9457793BA2E7C8320F918129FD918B7D8CEFE5946CB20

Function 06FEF1A1 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FEF238

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 542764a997a2741fb878666626ebed5ff063c87a4a9fe1da625b1269f3403652
Instruction ID: 56055214fef79efb75c53bb1314a0758933f96a28ba8838e7dfc7b98a8fa6cb2
Opcode Fuzzy Hash: 542764a997a2741fb878666626ebed5ff063c87a4a9fe1da625b1269f3403652
Instruction Fuzzy Hash: 6F212275D013499FDB10DFAAC881BEEBBF5FF48310F54842AE918A7240C7799941CBA0

Function 06FEF1A8 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FEF238

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f3b5a915cf0c46c901e1d426ed425d9fdd5ce87afbcdf54795e37d0bb0456817
Instruction ID: 98442e08dba7e52bfea88b2ca7de640d90ef2f64a11ac5ae62ac148919e3b455
Opcode Fuzzy Hash: f3b5a915cf0c46c901e1d426ed425d9fdd5ce87afbcdf54795e37d0bb0456817
Instruction Fuzzy Hash: 32212475D013499FDB10DFAAC881BDEBBF5FF48310F50842AE918A7240D7789941CBA4

Function 06FEF290 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FEF318

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ee88241d6f740c8fbb2588af5711899dd015a5be851d985f300d62ed00bbc627
Instruction ID: 62481663d10c1b5c3ca0729839e1a214d2a05a3867a4a11492f2eed55bb979fc
Opcode Fuzzy Hash: ee88241d6f740c8fbb2588af5711899dd015a5be851d985f300d62ed00bbc627
Instruction Fuzzy Hash: B2211671C013499FDB10DFAAC881BDEBBF5FF48310F54842AE958A7240C7799945CBA1

Function 06FEF298 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FEF318

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e16dd7e95e0b62a79bce6ca990476b4cd280fabc79e2af2120e80933c66379e8
Instruction ID: ca49e6a532540714e6e18fa7d0178c661adc9c3495dbb1f05749be5d5fe0f5ba
Opcode Fuzzy Hash: e16dd7e95e0b62a79bce6ca990476b4cd280fabc79e2af2120e80933c66379e8
Instruction Fuzzy Hash: 6221F571C013499FDB10DFAAC881BEEBBF5FF48310F54842AE919A7240D7799941CBA5

Function 06FEF010 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FEF08E

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a7c0387b4ce61a1229da8f91ad08551026c41adf9b08c51e934baddc6451465f
Instruction ID: bb08aba2382325592ff2a2e2c74bebe3d5f71a50e34e2737673838b0631982a9
Opcode Fuzzy Hash: a7c0387b4ce61a1229da8f91ad08551026c41adf9b08c51e934baddc6451465f
Instruction Fuzzy Hash: B9214771D003098FDB20DFAAC485BEEBBF4EF88320F54842AD519A7240DB789945CFA4

Function 06FEF008 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FEF08E

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bc9a35ad3a576a62ee363580f9e4fe3f2418e8930052af42476f1e0dc18edc6b
Instruction ID: 54c1eff87ce76efec09a91a4f80392d86f2d79a008be36c47e8a03a4cca9d672
Opcode Fuzzy Hash: bc9a35ad3a576a62ee363580f9e4fe3f2418e8930052af42476f1e0dc18edc6b
Instruction Fuzzy Hash: 5A2137B1D003098FDB54DFAAC485BAEBBF0EF48320F14842AD559A7640DB789945CFA0

Function 00FCD638 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FCD6C7

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ef1f5c8d52d417de9b0fe535097e90667c31b50f9b9b89fb589c92352fc39d64
Instruction ID: 42c6aa4b3ebe65cead77df0cdcfefdbe65600179e5f0a36a9d6e26e744ea3cc2
Opcode Fuzzy Hash: ef1f5c8d52d417de9b0fe535097e90667c31b50f9b9b89fb589c92352fc39d64
Instruction Fuzzy Hash: 4F21E2B5D002099FDB10CFAAD985ADEBBF5FB48320F14842AE918A7350D378A944DF61

Function 00FCD640 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FCD6C7

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 170bbfcdbd016b1cba3ff6c19804b3d4ade12f89d1db368f54ef0829cd584d7d
Instruction ID: fbb56fcc20126d7ce3a0f159e46c75a3672346de4e89860f3d310e05e85aad67
Opcode Fuzzy Hash: 170bbfcdbd016b1cba3ff6c19804b3d4ade12f89d1db368f54ef0829cd584d7d
Instruction Fuzzy Hash: 4E21E4B5D003099FDB10CF9AD985ADEBBF4FB48320F14842AE918A3350D374A940DF65

Function 06FEF0E0 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FEF156

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 98814f3115263b2c443b3ab556bf111977f503e7b99cae2d098f3ea7e145f3ee
Instruction ID: 57ce5f42f769b7d9a93cf560a90ec482d29ad29093de5ac198f40b3bf2adc9c4
Opcode Fuzzy Hash: 98814f3115263b2c443b3ab556bf111977f503e7b99cae2d098f3ea7e145f3ee
Instruction Fuzzy Hash: C2213871C003499FDB21DFA9C845BDFBFF5AB49320F148419E559A7250CB759540CFA1

Function 06FEF0E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FEF156

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aa903478afa1f0f3fb2a37ad16fc1b3cacf5db685a7907c71aaea372ca6cc8a5
Instruction ID: 45bed3aab0e135d02506ac36a63b1b31770fa07e3e72aa1b68c19db8a9931476
Opcode Fuzzy Hash: aa903478afa1f0f3fb2a37ad16fc1b3cacf5db685a7907c71aaea372ca6cc8a5
Instruction Fuzzy Hash: 64111471C0034D9FDB20DFAAC845BDEBBF5EB48320F148419E519A7250CB799940CBA0

Function 06FEEF59 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FEEFC2

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9699394a61d1c8abd659055604f8343482159f207e3ce81604c62fbf81d79bb9
Instruction ID: dff22d52e7772099ce306eea28e5ae9c8098872dd4bbeeb7450874769d822434
Opcode Fuzzy Hash: 9699394a61d1c8abd659055604f8343482159f207e3ce81604c62fbf81d79bb9
Instruction Fuzzy Hash: 8D114671C003898FDB20DFAAD8457DEBFF5EB88320F24841AD419AB640CB79A901CB95

Function 06FEEF60 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FEEFC2

Memory Dump Source

Source File: 00000012.00000002.1406959136.0000000006FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_6fe0000_windowsBook.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ab1ecdb97b62fe8051079d3b089f844836c825d39c9ee2b37dfe5d0b76ef4908
Instruction ID: 2060816e5cfebe4df23bbd3aed18cba36ab0ea1ed575bbbea7e7c87033add8cd
Opcode Fuzzy Hash: ab1ecdb97b62fe8051079d3b089f844836c825d39c9ee2b37dfe5d0b76ef4908
Instruction Fuzzy Hash: 59116671C003488FDB20DFAAD8457DEFBF4EB88320F24842AD419A7240CB79A900CFA5

Function 098510B9 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0985111D

Memory Dump Source

Source File: 00000012.00000002.1410166866.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_9850000_windowsBook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a099bee9ee040726aa39b80b25bd53b1b5530afab8c42cc7d027c3942574f9eb
Instruction ID: 4228f1660854e73a63f65a1af7a64e1f57955db01e86c08ed87493333db73db0
Opcode Fuzzy Hash: a099bee9ee040726aa39b80b25bd53b1b5530afab8c42cc7d027c3942574f9eb
Instruction Fuzzy Hash: 9711F5B58003499FDB10DF9AD845BDEFFF8EB48320F108459E959A7250C375A944CFA1

Function 00FCAF58 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FCAFBE

Memory Dump Source

Source File: 00000012.00000002.1398883352.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_fc0000_windowsBook.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 04c033820acfaa970040ae7c8d6b93d927f48c1871ac59d2d0f7599408a222d8
Instruction ID: fa02fa035d8de8cdc3348608740d9710543fd13ab1ce4f0025f6d23d43ec5a8a
Opcode Fuzzy Hash: 04c033820acfaa970040ae7c8d6b93d927f48c1871ac59d2d0f7599408a222d8
Instruction Fuzzy Hash: 27110FB5C002498FCB20CF9AD545BDEFBF4EB88328F10842ED428A7600D379A945CFA1

Function 098510C0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0985111D

Memory Dump Source

Source File: 00000012.00000002.1410166866.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_9850000_windowsBook.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 446b8b549f89a3db6c5b46494f566fd6b09fb82e2510716b1f01ee1966498e4c
Instruction ID: 233b6e227c7366780c4fa839875eab6afe3148321fdd21c8ec92ce7893eee8f6
Opcode Fuzzy Hash: 446b8b549f89a3db6c5b46494f566fd6b09fb82e2510716b1f01ee1966498e4c
Instruction Fuzzy Hash: D811D3B58003499FDB10DF9AD985BDEFBF8EB58320F10845AE919A7340C375A944CFA5

Function 09853C30 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 09853C90

Memory Dump Source

Source File: 00000012.00000002.1410166866.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_9850000_windowsBook.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 402c378b91826afd511805761d3173241d59bec35e9fbfc64ca65fc335ef1abe
Instruction ID: 4d4997d101e144619e1202d648c1029944dbb1b14015c4159b131a8004967436
Opcode Fuzzy Hash: 402c378b91826afd511805761d3173241d59bec35e9fbfc64ca65fc335ef1abe
Instruction Fuzzy Hash: 571143B5C003498FCB20DF9AC545BDEBBF4EB48320F14841AD968A7341D739A944CFA1

Function 09853C38 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 09853C90

Memory Dump Source

Source File: 00000012.00000002.1410166866.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_9850000_windowsBook.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5113f05906762baa64b65f5ebc950fc570d372fa73bcc315e056764f095dd8ca
Instruction ID: 9d06661bb2d9dab0c17d5ce3d5447d5f02a76b1271f779009c6cb7a3bb8b9e26
Opcode Fuzzy Hash: 5113f05906762baa64b65f5ebc950fc570d372fa73bcc315e056764f095dd8ca
Instruction Fuzzy Hash: 5F1110B58002498FCB20DF9AC545BDEBBF4EB48320F10841AD959A7340D738A944CFA5

Function 00E5D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061e42cc4abdbb12d6523322b7302f671ff00cffbe6dc5b59a2b11bbcc011ad1
Instruction ID: 92576e66012ce14541e12f090d48105a6afdd72cbc4c6f35855687ec468a6d8d
Opcode Fuzzy Hash: 061e42cc4abdbb12d6523322b7302f671ff00cffbe6dc5b59a2b11bbcc011ad1
Instruction Fuzzy Hash: A2210371508240DFDB25DF14DDC0B26BF65FB98329F20C969EC091B256D336D85ACAA2

Function 00E5D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c605f159b1816ded107fbd096fc9cd2efadea2b5bca1a5abe51a41837892216b
Instruction ID: 9a59674df63228bb9090cd9e213efb954e51d4df02bd9cf171b45ab19bfa8329
Opcode Fuzzy Hash: c605f159b1816ded107fbd096fc9cd2efadea2b5bca1a5abe51a41837892216b
Instruction Fuzzy Hash: 64210671508204DFDB24DF10DDC0B16BB65FB94325F20C969DC095F256C336E85ACAA2

Function 00F6D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1398653330.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f6d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88521fcf595318f859f63f0e23a66a53e6d2ea3d96c5b2a57405dcc547764fa8
Instruction ID: 6bd0e26eefb6bf08218e00153431f2329e5e1d9e5fa81aed66d7df6feba4f8ef
Opcode Fuzzy Hash: 88521fcf595318f859f63f0e23a66a53e6d2ea3d96c5b2a57405dcc547764fa8
Instruction Fuzzy Hash: B6210771F04304DFDB15DF10D9D0B25BB65FB84324F24C56DD8494B292C336D846DA61

Function 00F6D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1398653330.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f6d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbf134b2dca36ac630a172d609f2fd62df74ac035c270524ea46b74a62b20a7
Instruction ID: 1e97a4adbf307a9b20c33a486de657acc17581ae704ceb456ec94078920aae4f
Opcode Fuzzy Hash: bbbf134b2dca36ac630a172d609f2fd62df74ac035c270524ea46b74a62b20a7
Instruction Fuzzy Hash: 1A21D375A04240EFDB14DF14D984B16BB65EB84324F24C569D84A4B28AC336D847DA62

Function 00F6D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1398653330.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f6d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db315feab1fd1a67f535e0b16af95d816cdc040630129cd07fa0074ba6edcdec
Instruction ID: 9ce974275455e3f7fb0e0648ecd0824211a8f148325c564e83b5123645d3cdf7
Opcode Fuzzy Hash: db315feab1fd1a67f535e0b16af95d816cdc040630129cd07fa0074ba6edcdec
Instruction Fuzzy Hash: EF2165759093C09FC716CF24D594715BF71EB46324F28C5EAD8498F6A7C33A980ACB62

Function 00E5D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 97b8fb33a3b28f16bfaf6ce296df58a428611f287df0ed966dd367048e0efa09
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 1111E676504280CFCB15CF14D9C4B16BF72FB94328F24C6A9DC494B656C336D85ACBA1

Function 00E5D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: e918e4fec5ed091c438fff124a4a24a1a57d15f8d96ec304f4a7daf4e566702c
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: 50110376504240CFCB15CF00D9C0B16BF72FB94324F24C6A9DC490B256C33AE85ACBA1

Function 00F6D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1398653330.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_f6d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: b8a72a34bdd94e10a1d3db9b82406a2793dfbf07a1022aaad0477399f4898a2e
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: AB11DD75A04280DFCB15CF10C9D0B15FBB2FB84324F28C6ADD8494B296C33AD84ACB61

Function 00E5D759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22642287001b20adf2b768e5f395ac36fdc961590326538ab20dbb0fdfdd8396
Instruction ID: 9a2669bf015ecac846f03821a0a75d874dc3ea4822fb50a4befaf34f0e33574f
Opcode Fuzzy Hash: 22642287001b20adf2b768e5f395ac36fdc961590326538ab20dbb0fdfdd8396
Instruction Fuzzy Hash: 0701A73150C3449FE7305A15DCC4B66BB98DF49726F18C95BED192A286C2799848CAB2

Function 00E5D758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1397916209.0000000000E5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_e5d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803b53f89bd10d2d87967b783a2e0d8e5f38409542a80a5720312b344e3964a2
Instruction ID: ceb85c32ac46e74538a936fcc0ed758322b06cc5d584322339c000634c295fea
Opcode Fuzzy Hash: 803b53f89bd10d2d87967b783a2e0d8e5f38409542a80a5720312b344e3964a2
Instruction Fuzzy Hash: 9CF06D71408344AEE7208A16DC84B62FFA8EF55739F18C95BED085A296C279AC44CAB1

Analysis Process: windowsBook.exePID: 7848, Parent PID: 7760COMMON

Executed Functions

Function 02EA0EBA Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

(q, xrefs: 02EA1192
Teq, xrefs: 02EA0EED

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID: (q$Teq
API String ID: 0-2049869722
Opcode ID: f92ba375016fa22124fb5e310227dc349e5f1a540d35f283700ebb322e005501
Instruction ID: d274a62c8aa5802257cb930809478e31ad62ea8d652e14d0fab4ed263131ae90
Opcode Fuzzy Hash: f92ba375016fa22124fb5e310227dc349e5f1a540d35f283700ebb322e005501
Instruction Fuzzy Hash: 5E517E30B502149FC754DF69C464A9EBBF6FF89710F2581AAE806EF3A5CA759C01CB90

Function 02EA0D20 Relevance: 2.6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

dLq, xrefs: 02EA0D5B
Hq, xrefs: 02EA0E40

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID: Hq$dLq
API String ID: 0-4038822049
Opcode ID: 80688ef2b11f960f72a40a9ed48cf9432c869e16a47f4ca0cdca1ada88f19054
Instruction ID: 5396966f8ac6caf36923fe611b6b0b50f0f50977e2f8c38536b60c6e5fe09bc0
Opcode Fuzzy Hash: 80688ef2b11f960f72a40a9ed48cf9432c869e16a47f4ca0cdca1ada88f19054
Instruction Fuzzy Hash: 4B51BD31A003148FDB18DF68D4A4B9EBBF6BF89314F1485AAE405EB361CB75AC05CB91

Function 02EA1339 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

LRq, xrefs: 02EA138B

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: a8b1dfa35e10366a8cb98008f7f0777b93b9a60764070fbed65d0a01d91d0df2
Instruction ID: 6531d5d5bdac26725aa4c032d6d5722a4504f74b1c7dd0bad847a135bf20bcc4
Opcode Fuzzy Hash: a8b1dfa35e10366a8cb98008f7f0777b93b9a60764070fbed65d0a01d91d0df2
Instruction Fuzzy Hash: 93318D70F012158FCB44EB7DC861A6EBBF6BFC9304B15406AE509DB364EA35DD018791

Function 02EA0D10 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

dLq, xrefs: 02EA0D5B

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID: dLq
API String ID: 0-2312315067
Opcode ID: 24e58a134657e3949fba3037bf715e88bae88997e3126e316f75d683af715bc4
Instruction ID: 3bfa34c3bf9fa99f5d3ab8368b8968841d22cd4360d06550ed07100a22f3b8ea
Opcode Fuzzy Hash: 24e58a134657e3949fba3037bf715e88bae88997e3126e316f75d683af715bc4
Instruction Fuzzy Hash: 00319E75A002049FDB14DF68C498BAEBBF2BF89304F189569E406AF361CB75AD04CB91

Function 02EA0E3F Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Hq, xrefs: 02EA0E40

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 45a990f8c106bd99ca24793a68e1a206e30acfa4429e2acc07cdf60b29c54aba
Instruction ID: a322ffb9cff1f3032fb0ddf6fba14306dfd9966a2a57432557663b7963f19abb
Opcode Fuzzy Hash: 45a990f8c106bd99ca24793a68e1a206e30acfa4429e2acc07cdf60b29c54aba
Instruction Fuzzy Hash: 0F01F9307043505FC389973C94659AF7BE6AFC626431544BEE049CF372DE288C0683A5

Function 02EA0AA0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49aa33c0ecb52606ebf83f6bbf46af957d0b3f819d1f3440fd81fbbbe0aa02d
Instruction ID: 676a01262c7173c183cb7e1dedebce082bc153a1c8419faece5531bef66e8387
Opcode Fuzzy Hash: f49aa33c0ecb52606ebf83f6bbf46af957d0b3f819d1f3440fd81fbbbe0aa02d
Instruction Fuzzy Hash: 8A51D3B8611211CFC725FF28E6489597772FFC4245750A679D801EB268EB3DAC0ADF80

Function 02EA11D0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810682e933d1d9dd565ebb0deadc78f1d9cb8ecb0ae85dfc28013f83decc5a4a
Instruction ID: 6ad4f13bfe04d44bd93a3f6e886b5363e58554e703070bdce1ba0ee9af12e249
Opcode Fuzzy Hash: 810682e933d1d9dd565ebb0deadc78f1d9cb8ecb0ae85dfc28013f83decc5a4a
Instruction Fuzzy Hash: 1F416F70E00209AFCB44DBB9C45466EBBFAFFC8340F24856AD44ADB345DA34AD428B91

Function 02EA0998 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485c1fc94a468afb5ea23929d0e2001450696ea3757b6ff456f45b9819ff232f
Instruction ID: 9ca308f68f46e2aab6313a932edd91f17f3d5986564a5f9948eeac7788b2b40e
Opcode Fuzzy Hash: 485c1fc94a468afb5ea23929d0e2001450696ea3757b6ff456f45b9819ff232f
Instruction Fuzzy Hash: 4021BD307902029FDF68AF38D9687AE7BA4AF44348B05E43DE817DA150FB34E904DB91

Function 0155D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440566703.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_155d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01963a493a25aa09d0066611082a1899bc3634f75d30ba62491ac70334eecef0
Instruction ID: d708cf7d75b1e206ada85eb7bd226a59d2132e3aa017c4de5761834cc856572c
Opcode Fuzzy Hash: 01963a493a25aa09d0066611082a1899bc3634f75d30ba62491ac70334eecef0
Instruction Fuzzy Hash: 81210372504200DFDB55DF94D9D0B2ABFB5FB88328F20C56AED090E256C336D456CBA2

Function 02EA09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992acf3b97e04f17c168a023a75d43bb1d72f79cb6e5020d03b01532619e8793
Instruction ID: f88dd23e3a7ff38a20ff09a8dd365f1774a69c6fdf84fb3f7412d42f607a155a
Opcode Fuzzy Hash: 992acf3b97e04f17c168a023a75d43bb1d72f79cb6e5020d03b01532619e8793
Instruction Fuzzy Hash: 74219F347902028FDF68AF78D92876E7AA4AF44348B05A439D813DE154FF34F904DB92

Function 02EA1431 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf68e490f9dddfb3dee09a290f867934ec332b48d0ea72a8a3845bd54cfb3a1
Instruction ID: af1e4f722d61a5906463111b46edad414a0f1684350959784dbe3659b8eb38ae
Opcode Fuzzy Hash: fbf68e490f9dddfb3dee09a290f867934ec332b48d0ea72a8a3845bd54cfb3a1
Instruction Fuzzy Hash: F6118570B00211DFCB54EBBCC654AAA7BFAEF89215B154579E409DB228EB35AC11CB90

Function 0155D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440566703.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_155d000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 6b8adc8c6639e318d76304be54f369e141b785db3a0089b71dd26122c9a67e63
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: E611AF76504240CFDB16CF58D5C4B1ABF72FB84328F2485AADD094B257C336D45ACBA2

Function 02EA1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e472050f84ed68a3458dde31f784a07053929a0cc40b0afd0317459e883e2eb
Instruction ID: f601dddcff49884f96de3bf849811e0cbe156789101b7edefafff10ab2d9cfb3
Opcode Fuzzy Hash: 4e472050f84ed68a3458dde31f784a07053929a0cc40b0afd0317459e883e2eb
Instruction Fuzzy Hash: 7911AD70B00204DFCB54EBBDC614A6A7BF6EFC8215B254478D80ADB324EA35EC01CB90

Function 02EA0E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.1440813600.0000000002EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_2ea0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef4705c54a3423c809cfefba7a35bec685cd7a259cc2ab04996f6776fac1f2f
Instruction ID: f20df4316ed6fb969dc5043f769f4ac7b1313297329869db102b29af7aeda146
Opcode Fuzzy Hash: fef4705c54a3423c809cfefba7a35bec685cd7a259cc2ab04996f6776fac1f2f
Instruction Fuzzy Hash: 7DE08C323002105F8748966EA88895ABBDAEBC8260325447AE509C7325DE71CC014790

Analysis Process: windowsBook.exePID: 7928, Parent PID: 7800COMMON

Executed Functions

Function 02CD63D8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 677f4f93a6b1e5a3fee7e39edd2348fea79b51bb273cc0e6458aa54f4ed0b780
Instruction ID: 8e25e2b5d1198d3f6e1b43e4cb3aca09dbf49c8e887d62e9b8b9b84980e84e92
Opcode Fuzzy Hash: 677f4f93a6b1e5a3fee7e39edd2348fea79b51bb273cc0e6458aa54f4ed0b780
Instruction Fuzzy Hash: 95B15F70E00219CFDB24CFA9D8857DDBBF6AF88314F248129D915A7298EB749946CF81

Function 02CD6CA8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52eb6c3dd2eb444dca7c96071dae9916533bab482cf549609e72e3d496ceecc
Instruction ID: e8de07169893d4847e49d4a4b3b22c0a1e338ed02045b011773c06c0107725d2
Opcode Fuzzy Hash: d52eb6c3dd2eb444dca7c96071dae9916533bab482cf549609e72e3d496ceecc
Instruction Fuzzy Hash: 8AB19E70E006098FDF20CFA9E8817DDBBF6AF88314F248529D915EB294EB35D945CB81

Function 02CD236F Relevance: 5.4, Strings: 4, Instructions: 448COMMON

Download Yara Rule

Strings

aq, xrefs: 02CD2927
,, xrefs: 02CD24B8
xq, xrefs: 02CD29BE
aq, xrefs: 02CD2984

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: aq$ aq$,$xq
API String ID: 0-2948420561
Opcode ID: f8e22c9e7ea7d15fe62d01f750cb3069c26d6480977ebcf9a5c9f679189aab7d
Instruction ID: 4adf3fe9b40a77f418bd69dbfabe6b37ee2170e02a62f784c550e68f936b2790
Opcode Fuzzy Hash: f8e22c9e7ea7d15fe62d01f750cb3069c26d6480977ebcf9a5c9f679189aab7d
Instruction Fuzzy Hash: 9E02DD34B002008FDB25EF65E850B2E7BE2BF84310F248669D9159F3A5DF71AC46CB82

Function 02CD25AA Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

aq, xrefs: 02CD2927
xq, xrefs: 02CD29BE
aq, xrefs: 02CD2984

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: aq$ aq$xq
API String ID: 0-4256304875
Opcode ID: 2c5dfa3a1ffc5c782a24e9646077ebdd8e9da9e63645fc509d2b02b9cb15b208
Instruction ID: 82cd675331f8b35a87cccd9360e86a4c406e47a47ac79c65ebb8e7c812efa6b4
Opcode Fuzzy Hash: 2c5dfa3a1ffc5c782a24e9646077ebdd8e9da9e63645fc509d2b02b9cb15b208
Instruction Fuzzy Hash: 9661BD74B403008FE724EF69E850B5E7BE3BB84314F188669D5059F3A1DBB1AC46CB82

Function 02CD0EB8 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

(q, xrefs: 02CD1192
Teq, xrefs: 02CD0EED

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: (q$Teq
API String ID: 0-2049869722
Opcode ID: 687f74f925626f876de35d854c5ee03e630803755030c09c3c68cb4c08e8ba95
Instruction ID: 3144b97b79abaaa653d4c6f40843fcddfbc010c8e207af5d608b2dafbe7a73f2
Opcode Fuzzy Hash: 687f74f925626f876de35d854c5ee03e630803755030c09c3c68cb4c08e8ba95
Instruction Fuzzy Hash: BD518F30B101148FD758DF69D458A6EBBF2EF88710F2581A9E906EB3A5CB75DD02CB90

Function 02CD0D20 Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

dLq, xrefs: 02CD0D5B
Hq, xrefs: 02CD0E40

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Hq$dLq
API String ID: 0-4038822049
Opcode ID: 858b3d4101b3870909998fd7e23b7d7fc71e2b7ca3a18290b4de0009df8fbc09
Instruction ID: fe1b4c65bf924e4859bf5d3b31ff869aaa9ff84ffed4baee095cf7fe111aeb1b
Opcode Fuzzy Hash: 858b3d4101b3870909998fd7e23b7d7fc71e2b7ca3a18290b4de0009df8fbc09
Instruction Fuzzy Hash: E841F031B002048FDB19DF69D454BAEBBF6AF88300F1484AAE506DB3A1CB75DC05CB91

Function 02CD9958 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

$q, xrefs: 02CD998D
$q, xrefs: 02CD9997

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 7c01199fe093eb0e154b16bf81fb4167c018f78b91f4fb7893ac461b034bbcd1
Instruction ID: 3cc0ecfdbb0d0e6903f81cda099e032b7e36555a26f93f2d8085de1fb466971b
Opcode Fuzzy Hash: 7c01199fe093eb0e154b16bf81fb4167c018f78b91f4fb7893ac461b034bbcd1
Instruction Fuzzy Hash: D341BC39B08502DBC728AB1AA409629BB77FFC470133C9A48F60A8B354CB35DC53CB85

Function 02CD63CE Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

l, xrefs: 02CD63D0

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: ce6cddba4ba24d8b4fd0ce07015eb485d988b71e253036412943f5a5447e8aae
Instruction ID: d3177b7a8544cafb0c5ac342fa693dd4ee961c6d850b17344305c7f518d2ccc2
Opcode Fuzzy Hash: ce6cddba4ba24d8b4fd0ce07015eb485d988b71e253036412943f5a5447e8aae
Instruction Fuzzy Hash: F3B15F70E00219CFDB20CFA9E885BDDBBF5BF88304F248129D915A7298EB749945CF91

Function 02CDA0E8 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

xq, xrefs: 02CDA42E

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: xq
API String ID: 0-3670251435
Opcode ID: 41596eebe7ed0faacd7fcbe0724580ef234062d1d5d0130bf6ad98ceb7d81ce8
Instruction ID: 1d83679adcf48e6da6a1603e533811c525ba47a3ef660df8ac9b2e4ec0e0db6f
Opcode Fuzzy Hash: 41596eebe7ed0faacd7fcbe0724580ef234062d1d5d0130bf6ad98ceb7d81ce8
Instruction Fuzzy Hash: 68917974D41212CFDB28DF29E80871937E2B785318F14DB2AC9148B680E771AA65CFD2

Function 02CD9E90 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CD9F2E

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 9f52138d49ad1c67e86f8e5da2d2cf4d5c82c44bfaea2321c77ac9e389fcc3e8
Instruction ID: 984d72bf17e9b0d834104c390b64abf3bc948854c435b5f906dac59a51701bbc
Opcode Fuzzy Hash: 9f52138d49ad1c67e86f8e5da2d2cf4d5c82c44bfaea2321c77ac9e389fcc3e8
Instruction Fuzzy Hash: 1B518F34640204DFE714DF66D854F69BBF2BF48714F1442A9E6129B3E1CBB2AC41CB80

Function 02CD9941 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

$q, xrefs: 02CD998D

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 51acaba21eb7dc79881e6a4e6a389f28fb052f1154eb330ad9629b697ef2fa89
Instruction ID: 5daa22fb75e11d8ef03bdd6179ba8e4b98215e6932c0b4f66be3caf15c8d67e5
Opcode Fuzzy Hash: 51acaba21eb7dc79881e6a4e6a389f28fb052f1154eb330ad9629b697ef2fa89
Instruction Fuzzy Hash: 8C41C239708502DFC7299B5AA418539BB33BFC070533C9A99F20A9B355CB359D53CB85

Function 02CD1339 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

LRq, xrefs: 02CD138B

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 88a8087eb91283e40b0d770632b9664715807a6316185886e23a8706b3ea8d3a
Instruction ID: 23abfcf1dc9a3db62796e4e4a89bab444ffea911f4b0f7b9f2775d37fa163875
Opcode Fuzzy Hash: 88a8087eb91283e40b0d770632b9664715807a6316185886e23a8706b3ea8d3a
Instruction Fuzzy Hash: 61317A70F012158FDB44EB799461A7EBBF2BFC9300B284569E509DB3A4EB70DD018B90

Function 02CD0D10 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

dLq, xrefs: 02CD0D5B

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: dLq
API String ID: 0-2312315067
Opcode ID: 38c8516289e86405e9bd8dce51812750d9296d290efc078309666d75e82289b0
Instruction ID: 707898b0d125a6f37fe7ba7337aba37dcd174c5653ad9dbbbc0301761ae49270
Opcode Fuzzy Hash: 38c8516289e86405e9bd8dce51812750d9296d290efc078309666d75e82289b0
Instruction Fuzzy Hash: 8F31A175A002048FDB14DF69D458BAEBBF2BF88300F1485AAE502EB361CB75ED45CB91

Function 02CD35E0 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

p @, xrefs: 02CD3620

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: p @
API String ID: 0-1223218288
Opcode ID: 681bb68aa7a728e0da323ac9b5bbcd51b42733df5b62edd530078f877d15fb98
Instruction ID: 2ec559e292560dbc3ff14dde6161ad7566f781fed4e5d0be9773063982fca0ea
Opcode Fuzzy Hash: 681bb68aa7a728e0da323ac9b5bbcd51b42733df5b62edd530078f877d15fb98
Instruction Fuzzy Hash: 5F21F370A013548FDB02DB20E81479ABF72EB81321F24C6AAC5058F296D7358A17CBD1

Function 02CD9860 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CD988A

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 5461e63a52e7463e49c7accd5a3d2d5f451b2492ff3c834c35f13a7cc77a149d
Instruction ID: d91b1b386b1f70765c11fd61469b9d0da71d99546d618226b5f309fca29a6899
Opcode Fuzzy Hash: 5461e63a52e7463e49c7accd5a3d2d5f451b2492ff3c834c35f13a7cc77a149d
Instruction Fuzzy Hash: 2C219D34B501548FDB14DB68D818BAEBBF2BF88B10F24419AE506EB3A1CF718D01CB91

Function 02CD9870 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CD988A

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 347195a10cf58ba7e44fb5b464c31d0a268789d8f52787e03ac401d1cb324183
Instruction ID: 98792afcabe39d8e8934c5e9af1673a0d4fca81f38e945a9d8e9335eaf7669bd
Opcode Fuzzy Hash: 347195a10cf58ba7e44fb5b464c31d0a268789d8f52787e03ac401d1cb324183
Instruction Fuzzy Hash: 7E216D34B502148FDB149B79D818B6E77F6BF88B10F24416AE606EB3A1CF719D01CB91

Function 02CD3A08 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

|, xrefs: 02CD3A68

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 150b6fe190dbbea796e09e0615ad1e3de4f1a071573ee52a023a71c207b4b33f
Instruction ID: 48759816efa29a18fe79549922e961fddf5ee04aca09bf4475206b50557d0375
Opcode Fuzzy Hash: 150b6fe190dbbea796e09e0615ad1e3de4f1a071573ee52a023a71c207b4b33f
Instruction Fuzzy Hash: A2210674B402149FDB54EF799904B6EBBF1AF48604F1188A9EA4AE73A0DB759900CB81

Function 02CD9D77 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CD9DA3

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: e083f3b560a3dfc52885bba60a45298d1bae788ab4f5e96613b211f39c828f98
Instruction ID: bfea656d14a1da733cec081545fd14feec2ed20e3ec79d0efcc5d84736a43508
Opcode Fuzzy Hash: e083f3b560a3dfc52885bba60a45298d1bae788ab4f5e96613b211f39c828f98
Instruction Fuzzy Hash: 12117F34B50140DFDB149F69C498BAEBBE2AF88710F244469FA01EB3E5CB719C01CB90

Function 02CD9D88 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CD9DA3

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 5c2deedb276a5f3e310dbec39091b85b3c2e1b8f05297b7ec8bba36d0ea87987
Instruction ID: 5dbaf8fbc4d07e692ecde6ab007a761f81d647afdd8ac40093d1ac352ae1907b
Opcode Fuzzy Hash: 5c2deedb276a5f3e310dbec39091b85b3c2e1b8f05297b7ec8bba36d0ea87987
Instruction Fuzzy Hash: CB114F34B50204DFDB149B69C498BAEBBB6AF88710F145059FA02AB3A5CFB19C01CB90

Function 02CDACB0 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

Teq, xrefs: 02CDACDD

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: f2bbb3af22a54ebd2e50900fdb6f964d2d1b5df477ee87528d3280f7d788068d
Instruction ID: 072d1f40342e8ca99ab21d001b83c65ea75f4e4ba702e895ee3b570bf2bf1cbc
Opcode Fuzzy Hash: f2bbb3af22a54ebd2e50900fdb6f964d2d1b5df477ee87528d3280f7d788068d
Instruction Fuzzy Hash: 011182717401149FDB199F68D858BAE7BF2AF8C701F214469E506EB3A0CFB19D05CB91

Function 02CD93A8 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

LRq, xrefs: 02CD93CD

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 87aeb4ae08d03a7a9970b0aaada13ff132145c7c303e52b11a76fe902a7057d6
Instruction ID: 4390e30d91845dd506aebdfedb147b7174af30e89c16dc21109ef87cc77f0b15
Opcode Fuzzy Hash: 87aeb4ae08d03a7a9970b0aaada13ff132145c7c303e52b11a76fe902a7057d6
Instruction Fuzzy Hash: 61016270F001159FCB54EB7998527AF7BF1BF45700F10415DE646DB295E7709A02DB82

Function 02CD93B8 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

LRq, xrefs: 02CD93CD

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: bea9cab9caf15d2e382e5ecbb0adcfd516115c362b583b0e4454febfa359e6f5
Instruction ID: 9966c50d5b66a98619e913dbeba59974c9c2be1d01484f409f5b17a4c6e9c58d
Opcode Fuzzy Hash: bea9cab9caf15d2e382e5ecbb0adcfd516115c362b583b0e4454febfa359e6f5
Instruction Fuzzy Hash: 16016275F401159FCB44EB69E9017AE77B5FF88700F1042A9E609DB294EB70AE11CBC1

Function 02CD0E3F Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

Hq, xrefs: 02CD0E40

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 496197a89e420d61fe5c5282c9ba71c099ac052da78519636e1a9e665f4ea359
Instruction ID: 814c32d328b742f98be0bda3fe02932addc442f4e71056d609098413609bdae8
Opcode Fuzzy Hash: 496197a89e420d61fe5c5282c9ba71c099ac052da78519636e1a9e665f4ea359
Instruction Fuzzy Hash: 2AF0F6317082500FD35DA77DA82456F3FD79FC925436988BAE149CB366CE25CC068795

Function 02CD3AE0 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d29c23a37e8bb1f4d4fef365c70cf15807a61454cca495b62eca68a44a9123e
Instruction ID: 5258bc2f95bd436ea7247a8e472fa18a2bbfcdca2754b0689cfb4831de9b5498
Opcode Fuzzy Hash: 3d29c23a37e8bb1f4d4fef365c70cf15807a61454cca495b62eca68a44a9123e
Instruction Fuzzy Hash: 68C1211191E3D02FEB276B7858B02EA7FB18E8755571A04CBD1D0CF0A3D908894ED7AB

Function 02CD1DC0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c170c6b1c3dfc773a3f98473d090dc8ec10027266f387a92da1850f1f4f9d2ed
Instruction ID: 8482b34876fa7fbef87d902083a479022de0ca907c319b9c6aded246322108c5
Opcode Fuzzy Hash: c170c6b1c3dfc773a3f98473d090dc8ec10027266f387a92da1850f1f4f9d2ed
Instruction Fuzzy Hash: 17C12B34B002148FDB18EF79D454A6DBBF2BF88310B258569E906EB3A5CB71EC42CB51

Function 02CD6C9C Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab619e1f9ac5bf3c48d03fb5162642fd5dc4a8b3b7b2790db2135870b4125262
Instruction ID: 669e25bbb0525ab43d04a90e4eac4a16a0b87da2fb35ceba4a8bd02b8a10ec95
Opcode Fuzzy Hash: ab619e1f9ac5bf3c48d03fb5162642fd5dc4a8b3b7b2790db2135870b4125262
Instruction Fuzzy Hash: A9B19E70E006098FDF20CFA9E8817DDBBF5AF88314F248529E914E7294EB759945CF81

Function 02CDA8E8 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988c6f553e78cf236d41bc2eba29bbbca673b381c6a32a037c6ee7f81bc30b96
Instruction ID: ea56ab75ca3658b683faa9b78ad2b2310dd168e062c3a69981db1c98db4f7faa
Opcode Fuzzy Hash: 988c6f553e78cf236d41bc2eba29bbbca673b381c6a32a037c6ee7f81bc30b96
Instruction Fuzzy Hash: 32A18B74B017509FCB19EF35E85066D7BE2AFC8310B148A69DA029B359EF35AD068F81

Function 02CD3269 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a719b6cffbee0ff691ea48ea839ad97f020b59f85bb90b92fdde6b995864b0
Instruction ID: 825cc9332bd3189f2a77d102a9f0fb994890f9de13cb2e7ac3c2d08aa848d140
Opcode Fuzzy Hash: 36a719b6cffbee0ff691ea48ea839ad97f020b59f85bb90b92fdde6b995864b0
Instruction Fuzzy Hash: F4A18E74A013518FDB05EF34E844A6D7BB2BF84350B20CB69D5028B359DB34A96ACFD1

Function 02CD3278 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6898973251c77790e6638d2c432264148d3ea7d0e4964a2bdb7d055f8f0cc34a
Instruction ID: c551519b23c1da2b3987f721623f0c04556b775d099eb4a6ad2b4fcfc88c9a8a
Opcode Fuzzy Hash: 6898973251c77790e6638d2c432264148d3ea7d0e4964a2bdb7d055f8f0cc34a
Instruction Fuzzy Hash: F5A18D74A013118FDB05EF35E844A6E7BB2BB84350B20CB69D5028B359DB34AD6ACFD1

Function 02CD9B08 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9effeac3d06389e2b1acc3ce5f71d4fd5bba056d7217de77e6f43cd3fa7dae
Instruction ID: f96e2f1082e89c3e6678de6144bad1b0c3f0ea7db48335b09fa6f5d2c04b2dc0
Opcode Fuzzy Hash: bb9effeac3d06389e2b1acc3ce5f71d4fd5bba056d7217de77e6f43cd3fa7dae
Instruction Fuzzy Hash: 61518C78601245DFCB15DF68D884A6ABBF2FF85310F1684A5E545AF3A6C730EC01CB91

Function 02CD0AA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd06b20dea1a0ee8fb97aaaf6ebc830e0091a4acc2a755c2b6443c772a4e4b2
Instruction ID: 60b2f71876a0e37e4b3e12aef50b416feae3b2820f477e7682f270d9c07cbe14
Opcode Fuzzy Hash: 3dd06b20dea1a0ee8fb97aaaf6ebc830e0091a4acc2a755c2b6443c772a4e4b2
Instruction Fuzzy Hash: 1651C838902221CFCB16FB65F8445597B63FF842457908B68D4018B66CEB71AD66DF82

Function 02CD11D0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd00f977e9dad3f8971f299f32d9411ad535bf35604157e868b7ef2ab940046c
Instruction ID: d4e4c68cfc0fc2a9df2bb44ca9e17aed59686eb38e59ad12ba6ec402ea324e2a
Opcode Fuzzy Hash: bd00f977e9dad3f8971f299f32d9411ad535bf35604157e868b7ef2ab940046c
Instruction Fuzzy Hash: 9F419F70F04208AFCB44EBB9845476EBFF6EFC8310F248569D54AD7345DA349D429B91

Function 02CD48EC Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6524c6f75911404c6e43daffb6a3282c229a872e9d584080ecd69c8601666987
Instruction ID: a0c4f9ffe3b371120e156e693570520a99018bede26dcfaf1a4094a29bc6ecda
Opcode Fuzzy Hash: 6524c6f75911404c6e43daffb6a3282c229a872e9d584080ecd69c8601666987
Instruction Fuzzy Hash: 834112B0D0034C9FDB24DFA9C484ADEBBF5FF48304F248029E519AB250DB75A946CB90

Function 02CD96D0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8caa10cdd46147e4e42bcf4c4e2fd5fe7625abe824395867bb01782cc9edf15
Instruction ID: cf2f472cba78e89cbca63053e588eb86f691f72c6efaaea8df83985eb0b2d13d
Opcode Fuzzy Hash: f8caa10cdd46147e4e42bcf4c4e2fd5fe7625abe824395867bb01782cc9edf15
Instruction Fuzzy Hash: 4C21A138A052148FDB18EF78D5546BE7BB2AF89314F154928C602AB358CF359D42CB94

Function 02CDA8DA Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25317fb104f8fa6a0714be6a5ec0ccaa9a17fa7ceda73c3e6470d226bf7816f4
Instruction ID: 7299198153ba451fc6f22b293ae57f7c14efd5d6acefa2e171a1ac9dd3a6d762
Opcode Fuzzy Hash: 25317fb104f8fa6a0714be6a5ec0ccaa9a17fa7ceda73c3e6470d226bf7816f4
Instruction Fuzzy Hash: 06210534B012549FCB15EB75E8506AEBBE6EFC82547104AADCD4587348EB31AA06CBD2

Function 02CD48F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80aa91c02fdd8b0a75def84c06801375034ed6bc630baaf2e0327a31751452e1
Instruction ID: 971d96c84730868bbe876bf5f7fbf040cce72a4ae5dc2af9e418a8e92769168c
Opcode Fuzzy Hash: 80aa91c02fdd8b0a75def84c06801375034ed6bc630baaf2e0327a31751452e1
Instruction Fuzzy Hash: CB41EFB0D003499FDB24DFA9C484ADEBBF5FF48314F608029E919AB250DB75A945CB94

Function 02CDBC91 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2db2b8fafdda8a3c6b2b05eb3fac154387c801006c82a1d8f422d762a6447c4
Instruction ID: ee4f480cacddda936dac7b6e66fbe979844771855f06c7f81eca834850b8ddcf
Opcode Fuzzy Hash: e2db2b8fafdda8a3c6b2b05eb3fac154387c801006c82a1d8f422d762a6447c4
Instruction Fuzzy Hash: 06318234A002559FCB55EF79E880A9DBBF2EF85314B204AADD105CB295DB71AD0ACFC1

Function 02CD0998 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16c532b5ab387e7c250eacc9fad3e5987787963aca5f45f3f3662dba0b5ead2
Instruction ID: f14235f5287a1ef8d4368f0bb37640519932bf592fa1ca23a319f58813054868
Opcode Fuzzy Hash: b16c532b5ab387e7c250eacc9fad3e5987787963aca5f45f3f3662dba0b5ead2
Instruction Fuzzy Hash: 4C218734B852128FDB68AB7DEC4473E3FA4AB84345F559A3DD60BD5140DB70C650CB52

Function 02CD09A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a046c849bd55418d8906f21835237438021e2439702cd5024028405492c919
Instruction ID: dad84dbc5790033b2937c7cb17c1b93d581f2454f6bd9c3614c1c522d445b1f5
Opcode Fuzzy Hash: d1a046c849bd55418d8906f21835237438021e2439702cd5024028405492c919
Instruction Fuzzy Hash: 28219334B812138FDF58AB7EE81872E7AA4AF80345F458A3DD60BC5144EF70D650CB52

Function 02CDA143 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5412460131c051f54627820b42eff755fa514b85cadcd16a2575e59c9ef5e6f4
Instruction ID: 4ccaa17be680d502abd206b733abff2e407b653980c3aa6d72dbc9a8d58ea2ea
Opcode Fuzzy Hash: 5412460131c051f54627820b42eff755fa514b85cadcd16a2575e59c9ef5e6f4
Instruction Fuzzy Hash: 75216435D80202CFE729CB2AFC447183BE2B784218F14DB5AD90087645E3B29B61CF82

Function 02CD1431 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34148ce6bfc5c6d11470a87b7643498bf51461cdf0af660ceac04d085b53e979
Instruction ID: a1785efb4d8de886e7f35725ff2c45d952787e9115d1c208dc4468160156840d
Opcode Fuzzy Hash: 34148ce6bfc5c6d11470a87b7643498bf51461cdf0af660ceac04d085b53e979
Instruction Fuzzy Hash: 8D110474A01210CFCB45EBB9D91467E7BF6AF882107540578C009CB328DB30DD51CB80

Function 02CD1440 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b011f13fbecd9b73b64eea0c8e6a2eceaac5c50e90f877c80cd3a7c3377b1de
Instruction ID: c49a9eb74b0309181d5e15adadae8e24024d5e94d703477a2b2b083ecafec60b
Opcode Fuzzy Hash: 7b011f13fbecd9b73b64eea0c8e6a2eceaac5c50e90f877c80cd3a7c3377b1de
Instruction Fuzzy Hash: C511C030B01215DFCB54EBBAD504A6ABBF6AFC82117684578D50ACB318EF31ED11CB90

Function 02CD3AD1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fbc5ec2192cbcd96d8c2993728085254f069c4a88e90668067410c42d6a73b4
Instruction ID: 5afcb7fedcf8bfbc4327141426c07afdbf65fb8f7f5c7322468bc03822033fab
Opcode Fuzzy Hash: 3fbc5ec2192cbcd96d8c2993728085254f069c4a88e90668067410c42d6a73b4
Instruction Fuzzy Hash: 1401B1317082809FD729AB38AAA077D7BE3AFCA241715047ED64ACB341CF70CC129B52

Function 02CDBCA0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e8dac3b017fee67f64050889f2a442af70350e0e45b2075773a740132fc003
Instruction ID: 0e3ba17ce7f805b109bf7656e5837f2701828462a4942b5362380a9d239a6cfb
Opcode Fuzzy Hash: 31e8dac3b017fee67f64050889f2a442af70350e0e45b2075773a740132fc003
Instruction Fuzzy Hash: 55119470A002559FCB45FB74E80069E7BF2AF81314B104769C2058B285EB71A91ACFD2

Function 02CD9440 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3559b0b2d7deeeb2cd4debc1ee71ad43a7b8970c9bace04e200529197fdd1ea0
Instruction ID: f04e4a35d976863cdddf46e57ab952860234cd82ad8843e72318a3a3e4013346
Opcode Fuzzy Hash: 3559b0b2d7deeeb2cd4debc1ee71ad43a7b8970c9bace04e200529197fdd1ea0
Instruction Fuzzy Hash: 181133B48007498FCB20DF9AC985BDFFBF4EB48324F208419D518A3640C3356544CFA1

Function 02CD2A75 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438743480b549dd07891657871f40a3144c1dcb22dd4219621aa85f1dda95006
Instruction ID: fddb04c6cd58efa3b7890ff7d8fde858c77f1dfc533c9417f505395a53d82dab
Opcode Fuzzy Hash: 438743480b549dd07891657871f40a3144c1dcb22dd4219621aa85f1dda95006
Instruction Fuzzy Hash: 97017874A042049FE7119B18EC50B6EBFA0EF44214B14819AD1888F326C732DC078BA2

Function 02CD9448 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947ca110a1a975ade08b078a45a0552ef8934023d378bb2fbf6c398a6bba76d5
Instruction ID: 30d1a5b2424dcc8535de1a76d74a583efef132e823ece05f35ae72b5f655f37a
Opcode Fuzzy Hash: 947ca110a1a975ade08b078a45a0552ef8934023d378bb2fbf6c398a6bba76d5
Instruction Fuzzy Hash: AF11EEB5C007498FDB20DF9AC585BDEFBF4EB49324F208459D929A7250C379A944CFA1

Function 02CD9367 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777bcdd29baa2092c576193a7acbb8cd931976c5f03b1cc5bc40cdde2c48fde5
Instruction ID: c70732a4d292e163f441b73e196942d212147518fd9f5bfd43b1088bc342816a
Opcode Fuzzy Hash: 777bcdd29baa2092c576193a7acbb8cd931976c5f03b1cc5bc40cdde2c48fde5
Instruction Fuzzy Hash: 54E026307062501FC302BBBCE8544E93FAB9FCA30036405D6E045EB7A2CB24CD024BD4

Function 02CDA02E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0826c5ba78b52c417906c5c886b8f3ef99c12b9d2ed72dfcc3414c047b73f68f
Instruction ID: 478e92647beeba770a9c18dba6775e8584da8e3cdf2f11add7cc36ad4e3a0d03
Opcode Fuzzy Hash: 0826c5ba78b52c417906c5c886b8f3ef99c12b9d2ed72dfcc3414c047b73f68f
Instruction Fuzzy Hash: A7F0E5B5A4430ADFE7109F22C851BAD3BB4AF09348F44019AD303D72A2C7B9AE41CF90

Function 02CD0E80 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c48f1e4726c14cb217690254c27ca70a0fb308488eb59483a4e66cd2e3cb2c5
Instruction ID: e0ed7238ab6240b44a12be3a7b552eba0aa7c6570aab6ad174c401015b70d17f
Opcode Fuzzy Hash: 6c48f1e4726c14cb217690254c27ca70a0fb308488eb59483a4e66cd2e3cb2c5
Instruction Fuzzy Hash: C2E08C323002105F8748966EA88495ABBDAEBC8260365487AE509C7315DD71CC014690

Function 02CD2204 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e00abdd142c887c5bf911c7fc2be47f1a1042c9f492bf22503dbcf624a54a5
Instruction ID: e2517633ebf3eeca7686a27f90954f554354a26b0f0589d3ac291858a73215b8
Opcode Fuzzy Hash: 26e00abdd142c887c5bf911c7fc2be47f1a1042c9f492bf22503dbcf624a54a5
Instruction Fuzzy Hash: 43D012B0C492095EDB85DFE894113AD7FF6FB0D210F2042A9D94DE2700E73106128F52

Function 02CD2E38 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960c58b7a424d52bb28381688e5f6a745c6b4bce4696059de3b8481e11f68fa1
Instruction ID: 14c5f86da2a64743304b8b17f098073fa12233ddf140b119cd8932fdd5ece430
Opcode Fuzzy Hash: 960c58b7a424d52bb28381688e5f6a745c6b4bce4696059de3b8481e11f68fa1
Instruction Fuzzy Hash: CFD02238005A01CFE303CA6AE0348113F24FF2860030201A6D041CB732E711DC10CB10

Function 02CD0A8F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e49297bb7b1de8b347c33b9a99c1d402d854f671aeff2e4fe7b9f8cf1a3c133
Instruction ID: 8b6c99d5eb94204aa1d8598e0ba15bbf27b2f06e534ece000b6df8e0dde17b4a
Opcode Fuzzy Hash: 5e49297bb7b1de8b347c33b9a99c1d402d854f671aeff2e4fe7b9f8cf1a3c133
Instruction Fuzzy Hash: B1C08C34EC4207CFE32423A8E80C32C7D50AB80303FC18A06E206880828FB009208317

Function 02CD0A73 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd97880f32f503eb2ec306f347f86b39c0a3e89139ac46f342317c201b0cc84
Instruction ID: 535838d1ca1dda219bd0d8388136694de1d5cf5dd3b32497f30a1858af1b4cf7
Opcode Fuzzy Hash: 5cd97880f32f503eb2ec306f347f86b39c0a3e89139ac46f342317c201b0cc84
Instruction Fuzzy Hash: 89C08C30EC464BCFE7246368E80C32C7E50A780303FC18A0AE206880828FB00920C717

Function 02CD2E48 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2485964887.0000000002CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2cd0000_windowsBook.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506751fbfa7685a27fa30d8dd7812f3f285af8717179c1bbe3a770d94d8c176c
Instruction ID: 1791b6693c35da7a340fe042f121b8d76dbd1af5d53c121d0ff3060837cd2ea6
Opcode Fuzzy Hash: 506751fbfa7685a27fa30d8dd7812f3f285af8717179c1bbe3a770d94d8c176c
Instruction Fuzzy Hash: E3C048392602088F8244EA9AE588C12B7A8BF58A0034100A9E5018B722CB21F820DA62

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Aviso de transferencia.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Aviso de transferencia.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windowsBook.exe.log

C:\Users\user\AppData\Local\Temp\tmpCD5C.tmp.bat

C:\Users\user\AppData\Local\Temp\windowsBook.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
Aviso de transferencia.exe

Function 094D0040 Relevance: 7.3, Strings: 5, Instructions: 1001
COMMON

Function 0111D3E8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Function 0111D3F8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre