Edit tour

Windows Analysis Report
RKVaYznwyT.exe

Overview

General Information

Sample name:	RKVaYznwyT.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	7a7f4077096e5048ab837413f71d7d8e04f04e4fe9bdcafe93113dd60562bf4f
Analysis ID:	1541502
MD5:	fdb7614d7064da1a089a7f330177b2dd
SHA1:	ea44186936ad92c902ff1e8d9019efd46904e53f
SHA256:	7a7f4077096e5048ab837413f71d7d8e04f04e4fe9bdcafe93113dd60562bf4f
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AI detected suspicious sample

Creates a process in suspended mode (likely to inject code)

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential time zone aware malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

RKVaYznwyT.exe (PID: 6296 cmdline: "C:\Users\user\Desktop\RKVaYznwyT.exe" MD5: FDB7614D7064DA1A089A7F330177B2DD)

conhost.exe (PID: 6324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 6492 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

cleanup

Sigma Signatures

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: "C:\Users\user\Desktop\RKVaYznwyT.exe", ParentImage: C:\Users\user\Desktop\RKVaYznwyT.exe, ParentProcessId: 6296, ParentProcessName: RKVaYznwyT.exe, ProcessCommandLine: hostname, ProcessId: 6492, ProcessName: HOSTNAME.EXE

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.3% probability

Source: RKVaYznwyT.exe

Static PE information: Number of sections : 14 > 10

Source: RKVaYznwyT.exe	Static PE information: Section: /19 ZLIB complexity 0.9985184957349081
Source: RKVaYznwyT.exe	Static PE information: Section: /46 ZLIB complexity 0.999921875
Source: RKVaYznwyT.exe	Static PE information: Section: /99 ZLIB complexity 1.0000082179172511
Source: RKVaYznwyT.exe	Static PE information: Section: /112 ZLIB complexity 0.9919689685314685

Source: classification engine

Classification label: sus23.winEXE@4/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6324:120:WilError_03

Source: RKVaYznwyT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RKVaYznwyT.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RKVaYznwyT.exe	String found in binary or memory: p->status= pageSize= s.nelems= schedtick= span.list=, s.base()=, s.npages=-start_date//*[symid='/dev/stderr/dev/stdout30517578125: frame.sp=<invalid op> in space CloseHandleCreateFileWDeleteFileWExitProcessFreeLibraryGOTRACEBACKGetFileTypeIdeographicInstCap
Source: RKVaYznwyT.exe	String found in binary or memory: p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=, s.base()=, s.npages=-start_date//*[symid='/dev/stderr/dev/stdout30517578125: frame.sp=<invalid op> in space CloseHandleCreateFileWDeleteFileWExitProcessFreeLibraryGOTRACEBACKGetFileTypeIdeogra
Source: RKVaYznwyT.exe	String found in binary or memory: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=, s.base()=, s.npages=-start_date//*[symid='/dev/stderr/dev/stdout30517578125: frame.sp=<invalid op> in space CloseHandleCreateFileWDeleteFileWExitPro
Source: RKVaYznwyT.exe	String found in binary or memory: gcwaiting= gp.status= heap_live= idleprocs= in status m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=, s.base()=, s.npages=-start_date//*[symid='/dev/stderr/dev/stdout30517578125: frame.sp=<invalid op> in space CloseHandleCreateFileWDeleteFileWExitProcessFreeLibraryGOTRACEBACKGetFileTypeIdeographicInstCaptureInstRuneAnyInstallPathMedefaidrinMoveFileExWNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySYMCLI_SID=SYSTEMROOT=SetFileTimeSignWritingSoft_DottedVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_Space[:^xdigit:]_SYMINQ.TXTalarm clockapppathrootbad addressbad messagebad timedivbroken pipecgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfinal tokenfloat32nan2float64nan2float64nan3gatekeeper gccheckmarkgetpeernamegetsocknamei/o timeoutlost mcachemSpanManualmethodargs(mswsock.dllno root keyparse errorruntime: P runtime: p scheddetailschema1 %s

Source: unknown	Process created: C:\Users\user\Desktop\RKVaYznwyT.exe "C:\Users\user\Desktop\RKVaYznwyT.exe"
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname	Jump to behavior

Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll	Jump to behavior

Source: RKVaYznwyT.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: RKVaYznwyT.exe

Static file information: File size 4375040 > 1048576

Source: RKVaYznwyT.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x15fc00
Source: RKVaYznwyT.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x18fe00

Source: RKVaYznwyT.exe	Static PE information: section name: /4
Source: RKVaYznwyT.exe	Static PE information: section name: /19
Source: RKVaYznwyT.exe	Static PE information: section name: /32
Source: RKVaYznwyT.exe	Static PE information: section name: /46
Source: RKVaYznwyT.exe	Static PE information: section name: /63
Source: RKVaYznwyT.exe	Static PE information: section name: /80
Source: RKVaYznwyT.exe	Static PE information: section name: /99
Source: RKVaYznwyT.exe	Static PE information: section name: /112
Source: RKVaYznwyT.exe	Static PE information: section name: /124
Source: RKVaYznwyT.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\RKVaYznwyT.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\RKVaYznwyT.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: HOSTNAME.EXE, 00000002.00000002.1710624664.000002B580939000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: RKVaYznwyT.exe, 00000000.00000002.1712910823.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RKVaYznwyT.exe

Process created: C:\Windows\System32\HOSTNAME.EXE hostname

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RKVaYznwyT.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541502
Start date and time:	2024-10-24 22:23:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RKVaYznwyT.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	7a7f4077096e5048ab837413f71d7d8e04f04e4fe9bdcafe93113dd60562bf4f
Detection:	SUS
Classification:	sus23.winEXE@4/0@0/0
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Stop behavior analysis, all processes terminated

Warnings

Execution Graph export aborted for target RKVaYznwyT.exe, PID 6296 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: RKVaYznwyT.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.549810661574742
TrID:	Win64 Executable (generic) (12005/4) 74.80% Generic Win/DOS Executable (2004/3) 12.49% DOS Executable Generic (2002/1) 12.47% VXD Driver (31/22) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	RKVaYznwyT.exe
File size:	4'375'040 bytes
MD5:	fdb7614d7064da1a089a7f330177b2dd
SHA1:	ea44186936ad92c902ff1e8d9019efd46904e53f
SHA256:	7a7f4077096e5048ab837413f71d7d8e04f04e4fe9bdcafe93113dd60562bf4f
SHA512:	67ee063d64f41d18bcedd5cc29a4aec054607b9a567604642af521d633739005205a2c00dced95ff69459b2d3604029bdcd288cb62601279a7455187ba1a71d3
SSDEEP:	49152:6kk3Coj5ZeSUdgX3PLCeYo/NhMNggRIH+u8psfnTb6voVMgRUaze5SV7vf2543:9Lo9DCgjDYmevoVMOzKY32
TLSH:	8A167D12FCEE14FECABEF03449A197217A7174A543327B836F94496E1A66BD47E2D300
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........>.......#...........................@...............................E............... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45ae00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1cd364a9e949d5ecebd6c614e64bc545

Entrypoint Preview

Instruction
jmp 00007FF3A8823600h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
dec eax
mov eax, dword ptr [ecx]
dec eax
mov esi, dword ptr [ecx+10h]
dec eax
mov ecx, dword ptr [ecx+08h]
dec eax
mov edi, dword ptr [00000030h]
mov dword ptr [edi+68h], 00000000h
dec eax
sub esp, 00000080h
cmp ecx, 04h
jle 00007FF3A8827273h
cmp ecx, 10h
jle 00007FF3A8827264h
int 03h
dec eax
mov edi, esp
cld
dec eax
movsd
dec eax
mov esi, esp
dec eax
mov ecx, dword ptr [esi]
dec eax
mov edx, dword ptr [esi+08h]
dec esp
mov eax, dword ptr [esi+10h]
dec esp
mov ecx, dword ptr [esi+18h]
dec ax
movd mm0, ecx
dec ax
movd mm1, edx
dec cx
movd mm2, eax
dec cx
movd mm3, ecx
call eax
dec eax
add esp, 00000080h
pop ecx
dec eax
mov dword ptr [ecx+18h], eax
dec eax
mov edi, dword ptr [00000030h]
mov eax, dword ptr [edi+68h]
dec eax
mov dword ptr [ecx+28h], eax
ret
int3
int3
int3
int3
int3
dec eax
sub esp, 30h
dec eax
mov ecx, FFFFFFF4h
dec eax
mov dword ptr [esp], ecx
dec eax
mov eax, dword ptr [0029620Ah]
call eax
dec eax
mov ecx, eax
dec eax
mov dword ptr [esp], ecx
dec eax
lea edx, dword ptr [002CEE2Ah]
dec eax
mov dword ptr [esp+08h], edx
inc esp
lea eax, dword ptr [002CEA0Ah]
dec esp
mov dword ptr [esp+10h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41a000	0x3b4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f1020	0x108	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15fa9b	0x15fc00	f896109206e2f3d600e55aa882bafa9f	False	0.41045817230810233	data	5.863451157051376	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x161000	0x18fdcd	0x18fe00	174f6b48feeecb970d0a28168f720b34	False	0.38438098331509846	data	5.184409142361513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2f1000	0x3b728	0x19000	a22ea40643bed0f4c13c05d97c8866cc	False	0.319677734375	data	4.013777148248291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x32d000	0x119	0x200	28a3e9c96b9bb43e6541a26c8f68899b	False	0.595703125	data	4.8292159200679565	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x32e000	0x2f86e	0x2fa00	d3cb1f0775d7a9692c21e29c7c5b917f	False	0.9985184957349081	data	7.9942238121734235	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/32	0x35e000	0xc49c	0xc600	20384ce26cd9ed1f9f5ca88433a6c392	False	0.988577178030303	data	7.932407977018054	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/46	0x36b000	0x31ce	0x3200	fda3f753fbff6db69dede2d69d6f2b5a	False	0.999921875	data	7.963882243244083	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/63	0x36f000	0x6057	0x6200	33a52f57e7a65f1804553e3001281293	False	0.9855707908163265	data	7.964457022101287	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0x376000	0x22	0x200	b695610b59faaff118f91fc317f4e65e	False	0.076171875	MIPSEB MIPS-II ECOFF executable not stripped - version 116.105	0.6138392741996215	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/99	0x377000	0x591a3	0x59200	e68d26b91e299b16d2ced27ef46bf5b5	False	1.0000082179172511	data	7.9972530506983714	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/112	0x3d1000	0x35854	0x35a00	07819bb1286da2d7d806ec2d50910e82	False	0.9919689685314685	data	7.994019503766179	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/124	0x407000	0x1216d	0x12200	e2108072a15891e1875ee81eeb1483d3	False	0.9723733836206897	data	7.8045801849914485	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x41a000	0x3b4	0x400	b10e00eaffd744555e02e2754e7533ad	False	0.43359375	data	4.093039033713278	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.symtab	0x41b000	0x3c7a3	0x3c800	dadf31f242ed22cd4eb6222517ec2780	False	0.23810772856404958	data	5.353104125926414	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
kernel32.dll	WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, LoadLibraryA, LoadLibraryW, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatus, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, LoadLibraryA, LoadLibraryW, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatus, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Target ID:	0
Start time:	16:24:41
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\RKVaYznwyT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RKVaYznwyT.exe"
Imagebase:	0x400000
File size:	4'375'040 bytes
MD5 hash:	FDB7614D7064DA1A089A7F330177B2DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:24:41
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:24:41
Start date:	24/10/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff729b70000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 0042C940 Relevance: 8.9, Strings: 7, Instructions: 103COMMON

Download Yara Rule

Strings

runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime:, xrefs: 0042CB30
,-./05:;<=>?CFLMNPSZ["\, xrefs: 0042CAC0
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssymaudit_start_datetime: unknown unit too many open filesunexpected InstFailunknown wait reasonwinmm.dll not foundzip: checksum, xrefs: 0042CA99
0, xrefs: 0042CA19
VirtualQuery for stack base failedexpected attribute name in elementflag provided but not defined: -%sforEachP: sched.safePointWait != 0invalid nested repetition operatorinvalid or unsupported Perl syntaxmspan.ensureSwept: m is not lockedout of memory allocati, xrefs: 0042CB61
bad g0 stackbad recoverycan't happencas64 failedchan receiveclosed by </context.TODOdebugCall128dumping heapend tracegcentersyscallexit status gcpacertracehost is downillegal seekinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneednetapi32, xrefs: 0042CB05
", xrefs: 0042CB6C

Memory Dump Source

Source File: 00000000.00000002.1712167208.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1712144015.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712272760.0000000000561000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712388676.00000000006F1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712404041.00000000006F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712420613.00000000006F8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712444834.00000000006F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712481459.0000000000702000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712514475.0000000000704000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712538136.0000000000707000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712538136.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712538136.0000000000729000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712538136.000000000072C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712610075.000000000072D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712610075.0000000000777000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712711277.000000000081A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1712728310.000000000081B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_RKVaYznwyT.jbxd

Similarity

API ID:
String ID: "$,-./05:;<=>?CFLMNPSZ["\$0$VirtualQuery for stack base failedexpected attribute name in elementflag provided but not defined: -%sforEachP: sched.safePointWait != 0invalid nested repetition operatorinvalid or unsupported Perl syntaxmspan.ensureSwept: m is not lockedout of memory allocati$bad g0 stackbad recoverycan't happencas64 failedchan receiveclosed by </context.TODOdebugCall128dumping heapend tracegcentersyscallexit status gcpacertracehost is downillegal seekinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneednetapi32$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssymaudit_start_datetime: unknown unit too many open filesunexpected InstFailunknown wait reasonwinmm.dll not foundzip: checksum
API String ID: 0-1050518859
Opcode ID: e0bc92494ebb8365101e1b5958bd766eb1d5899210d7acff0ad02c27258c3bdb
Instruction ID: ce9c4443ee57e2feaa5a4b7c4e66464f8a2cac90c852b0bcd24a234762bdaeed
Opcode Fuzzy Hash: e0bc92494ebb8365101e1b5958bd766eb1d5899210d7acff0ad02c27258c3bdb
Instruction Fuzzy Hash: E9511736609F8584DB10EB51F48535EB364F7897A8F90822AEADC03BA9DF7CC194CB44

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RKVaYznwyT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: RKVaYznwyT.exePID: 6296, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 6324, Parent PID: 6296

General

Chronological Activities

Analysis Process: HOSTNAME.EXEPID: 6492, Parent PID: 6296

General

Chronological Activities

Disassembly

Analysis Process: RKVaYznwyT.exePID: 6296, Parent PID: 2580COMMON

Non-executed Functions

Function 0042C940 Relevance: 8.9, Strings: 7, Instructions: 103COMMON

Windows Analysis Report
RKVaYznwyT.exe