Edit tour

Windows Analysis Report
NaRZIOq3O8.dll

Overview

General Information

Sample name:	NaRZIOq3O8.dll renamed because original name is a hash value
Original sample name:	e999daea87b481d11b4fd8559bdd3d68516dc0ef.dll
Analysis ID:	1558496
MD5:	8ae5deac29c6d351c2376da97b75b88a
SHA1:	e999daea87b481d11b4fd8559bdd3d68516dc0ef
SHA256:	6831f236816f9799458cff0c50116bcc3029f57e8cd8ab181204bc914789c1df
Tags:	dlluser-NDA0E
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

Queries disk data (e.g. SMART data)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 8188 cmdline: loaddll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7280 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7364 cmdline: rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7508 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7636 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7312 cmdline: rundll32.exe C:\Users\user\Desktop\NaRZIOq3O8.dll,Group MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6128 cmdline: rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 4556 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 892 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 7636 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7508 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6364 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 6196 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 6836 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7528 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Yara Signatures

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.rundll32.exe.10000000.0.unpack	Winnti_NlaifSvc	Winnti sample - file NlaifSvc.dll	Florian Roth	0x2cdf2:$x1: cracked by ximo 0x2cead:$x1: cracked by ximo 0x2cf68:$x1: cracked by ximo 0x2d023:$x1: cracked by ximo 0x2d0de:$x1: cracked by ximo 0x2d199:$x1: cracked by ximo 0x2d254:$x1: cracked by ximo 0x2d30f:$x1: cracked by ximo 0x2d3ca:$x1: cracked by ximo 0x2d485:$x1: cracked by ximo

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7312, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vicity

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NaRZIOq3O8.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: NaRZIOq3O8.dll

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.0% probability

Machine Learning detection for sample

Source: NaRZIOq3O8.dll

Joe Sandbox ML: detected

Source: NaRZIOq3O8.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source:	Binary string: c:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.Z source: rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.. source: rundll32.exe, 00000003.00000003.3709951057.0000000002B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3709925498.0000000002B33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.\.g source: rundll32.exe, 00000003.00000003.1849601371.0000000002B29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1849653083.0000000002B33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.tate\..H{ source: rundll32.exe, 00000003.00000003.2132721514.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2134419805.0000000002B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\..*m source: rundll32.exe, 00000003.00000003.2413353729.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2413606315.0000000002B3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.* source: rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2293300146.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2332381587.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2413695167.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2332599254.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.*: source: rundll32.exe, 00000003.00000003.2533864222.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B3C0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,lstrcpy,lstrcat,lstrcat,_strcmpi,PathIsDirectoryA,6D262DD0,strchr,strchr,strchr,strchr,atoi,CreateDirectoryA,Sleep,lstrcat,FindNextFileA,FindClose,		3_2_1000B3C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005A50 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,		3_2_10005A50

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.186 12354	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.185 16300	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.193 6520	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.241.186 ports 1,2,3,4,5,12354

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: global traffic	TCP traffic: 192.168.2.10:49707 -> 107.163.241.185:16300
Source: global traffic	TCP traffic: 192.168.2.10:49714 -> 107.163.241.193:6520
Source: global traffic	TCP traffic: 192.168.2.10:49715 -> 107.163.241.186:12354

Source: Joe Sandbox View

IP Address: 202.108.0.52 202.108.0.52

Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US
Source: Joe Sandbox View	ASN Name: TAKE2US TAKE2US

Source: global traffic

TCP traffic: 192.168.2.10:49717 -> 202.108.0.52:80

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.193
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.186

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10005E10 WSAStartup,socket,socket,socket,htons,htons,inet_addr,inet_addr,htons,inet_addr,bind,ioctlsocket,select,WSAGetLastError,Sleep,recvfrom,wsprintfA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,malloc,htons,htons,htons,htons,htons,htons,htonl,htons,inet_addr,sendto,closesocket,closesocket,closesocket,WSACleanup,

3_2_10005E10

Source: global traffic

DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://107.163.241.185:16300/
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.185:16300//joy.asp?sid=rungnejcndvgnJLfFe5vteX8v2LUicbtudb8mteXmJe1nde
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php#)o
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php()b
Source: rundll32.exe, 00000003.00000002.3769043111.000000000562D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3768985716.00000000055AD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php)
Source: rundll32.exe, 00000003.00000002.3769274572.000000000584A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php;
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpAkn
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpB)H
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpData
Source: rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpMkb
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpSk
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpU)U
Source: rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.php_kt
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpbV
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpckP
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpogs
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpwk
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.186:12354/login.phpykV
Source: rundll32.exe, 00000003.00000002.3768985716.00000000055AD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.24I
Source: rundll32.exe, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000003.00000002.3769344739.000000000597D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807.
Source: rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807OW64
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807osoft
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807p
Source: rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807pSk
Source: rundll32.exe, 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmp, NaRZIOq3O8.dll	String found in binary or memory: http://www.rsac.org/ratingsv01.html

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE

Matched rule: Winnti sample - file NlaifSvc.dll Author: Florian Roth

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000C0C0: wsprintfA,DeviceIoControl,

3_2_1000C0C0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10005160 ExitWindowsEx,

3_2_10005160

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10006240	3_2_10006240
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000EAE0	3_2_1000EAE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000DAF0	3_2_1000DAF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100103B0	3_2_100103B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000F460	3_2_1000F460
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000EED0	3_2_1000EED0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 10001000 appears 283 times

Source: NaRZIOq3O8.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 3.2.rundll32.exe.10000000.0.unpack, type: UNPACKEDPE

Matched rule: Winnti_NlaifSvc date = 2017-01-25, hash1 = 964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5, author = Florian Roth, description = Winnti sample - file NlaifSvc.dll, reference = https://goo.gl/VbvJtL, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.spyw.evad.winDLL@31/1@5/5

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1000C190 sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA,

3_2_1000C190

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	3_2_10005620
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100068C0 6D262DD0,6D262DD0,6D262DD0,strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,	3_2_100068C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100052E0 AdjustTokenPrivileges,	3_2_100052E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: wsprintfA,rand,OpenSCManagerA,CreateServiceA,GetLastError,OpenServiceA,StartServiceA,wsprintfA,wsprintfA,RegOpenKeyA,lstrlen,RegSetValueExA,wsprintfA,RegCreateKeyA,_CxxThrowException,RegSetValueExA,SetLastError,_CxxThrowException,RegCloseKey,RegOpenKeyExA,_CxxThrowException,RegSetValueExA,SetLastError,_CxxThrowException,GetLastError,RegCloseKey,RegCloseKey,

3_2_10008880

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_100051F0 CreateToolhelp32Snapshot,

3_2_100051F0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10006240 wsprintfA,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,6D262DD0,SysAllocString,CoSetProxyBlanket,wcscat,6D262DD0,SysAllocString,6D262DD0,VariantInit,VariantInit,VariantInit,VariantInit,6D262DD0,SysAllocString,InterlockedDecrement,_strcmpi,6D262DD0,SysAllocString,InterlockedDecrement,StrStrIA,VariantClear,VariantClear,VariantClear,CoUninitialize,

3_2_10006240

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10008880 wsprintfA,rand,OpenSCManagerA,CreateServiceA,GetLastError,OpenServiceA,StartServiceA,wsprintfA,wsprintfA,RegOpenKeyA,lstrlen,RegSetValueExA,wsprintfA,RegCreateKeyA,_CxxThrowException,RegSetValueExA,SetLastError,_CxxThrowException,RegCloseKey,RegOpenKeyExA,_CxxThrowException,RegSetValueExA,SetLastError,_CxxThrowException,GetLastError,RegCloseKey,RegCloseKey,

3_2_10008880

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\Desktop\11121541

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4556:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\107.163.241.193:6520
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\M107.163.241.193:6520

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\NaRZIOq3O8.dll,Group

Source: NaRZIOq3O8.dll

ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\NaRZIOq3O8.dll,Group
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\NaRZIOq3O8.dll,Group	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: c:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.Z source: rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.. source: rundll32.exe, 00000003.00000003.3709951057.0000000002B4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3709925498.0000000002B33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.\.g source: rundll32.exe, 00000003.00000003.1849601371.0000000002B29000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.1849653083.0000000002B33000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.tate\..H{ source: rundll32.exe, 00000003.00000003.2132721514.0000000002B25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2134419805.0000000002B31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\..*m source: rundll32.exe, 00000003.00000003.2413353729.0000000002B37000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2413606315.0000000002B3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.* source: rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2293300146.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2332381587.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2413695167.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2332599254.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.*: source: rundll32.exe, 00000003.00000003.2533864222.0000000002B41000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533457815.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2533805373.0000000002B34000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10005870 Sleep,LoadLibraryA,GetProcAddress,GetExtendedUdpTable,Sleep,malloc,GetExtendedUdpTable,htons,free,FreeLibrary,

3_2_10005870

Source: initial sample

Static PE information: section where entry point is pointing to: fdss

Source: NaRZIOq3O8.dll

Static PE information: section name: fdss

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002303D pushfd ; mov dword ptr [esp], edi	3_2_1002305D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100099FC push eax; mov dword ptr [esp], 2B3AF999h	3_2_10009A23
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009A49 push dword ptr [esp+14h]; retn 0018h	3_2_10009A58
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021AD0 push 3268CA87h; mov dword ptr [esp], ebx	3_2_10021ADA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100212FC pushfd ; mov dword ptr [esp], ecx	3_2_10022E4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100212FC pushfd ; mov dword ptr [esp], edi	3_2_10022E51
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009C3B push dword ptr [esp+2Ch]; retn 0030h	3_2_10009C4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100224AA pushfd ; mov dword ptr [esp], esi	3_2_100224C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021CF9 push B3A48B18h; mov dword ptr [esp], 1D42FA0Eh	3_2_1002213E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021D30 push B3A48B18h; mov dword ptr [esp], 1D42FA0Eh	3_2_1002213E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021D35 push B3A48B18h; mov dword ptr [esp], 1D42FA0Eh	3_2_1002213E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021D61 push dword ptr [esp+30h]; retn 0034h	3_2_10021D6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100225B0 pushfd ; mov dword ptr [esp], edi	3_2_100225B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021DD6 pushad ; mov dword ptr [esp], 4428EA9Bh	3_2_10021E1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002271A push dword ptr [esp+0Ch]; retn 0010h	3_2_10022724
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021F36 pushfd ; mov dword ptr [esp], ecx	3_2_10022E4D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021F36 pushfd ; mov dword ptr [esp], edi	3_2_10022E51
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009760 push eax; mov dword ptr [esp], 6C7BBFF6h	3_2_1002979B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009760 pushfd ; mov dword ptr [esp], CC5FD643h	3_2_1002A954
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010FA0 push eax; ret	3_2_10010FCE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10022FC1 push D32B6479h; mov dword ptr [esp], ebx	3_2_10022FC6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10022FC1 pushfd ; mov dword ptr [esp], esi	3_2_10022FCA

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

3_2_1000C190

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

3_2_1000C190

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vicity

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_10008880

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vicity			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vicity			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_3-6186

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10022EE7 rdtsc

3_2_10022EE7

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 3765			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 6007			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-6872

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_3-6264

Source: C:\Windows\SysWOW64\rundll32.exe TID: 5916	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7336	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7336	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7336	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1424	Thread sleep count: 3765 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1424	Thread sleep time: -1129500000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7412	Thread sleep time: -3000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7736	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7480	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7332	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3192	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1424	Thread sleep count: 6007 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1424	Thread sleep time: -1802100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7336	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000B3C0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,lstrcpy,lstrcat,lstrcat,_strcmpi,PathIsDirectoryA,6D262DD0,strchr,strchr,strchr,strchr,atoi,CreateDirectoryA,Sleep,lstrcat,FindNextFileA,FindClose,		3_2_1000B3C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005A50 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,		3_2_10005A50

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_100068C0 6D262DD0,6D262DD0,6D262DD0,strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,

3_2_100068C0

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000003.00000002.3755382299.00000000027CB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002ABB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3755445264.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.3768559853.00000000051E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runsses\Applications\\VMwareHostOpen.exe\Internet Settings\Lockdown_Zones\4_Zones\0x
Source: rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10022EE7 rdtsc

3_2_10022EE7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10005870 Sleep,LoadLibraryA,GetProcAddress,GetExtendedUdpTable,Sleep,malloc,GetExtendedUdpTable,htons,free,FreeLibrary,

3_2_10005870

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.186 12354	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.185 16300	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.193 6520	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10010050 GetLocalTime,SystemTimeToFileTime,

3_2_10010050

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10007420 CreateThread,Sleep,GetVersionExA,Sleep,sprintf,

3_2_10007420

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Device IO: \Device\Harddisk0\DR0	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_10005E10

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	2 Windows Service	1 Access Token Manipulation	21 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Windows Service	1 Software Packing	Security Account Manager	114 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Bootkit	111 Process Injection	1 DLL Side-Loading	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
NaRZIOq3O8.dll	89%	ReversingLabs	Win32.Backdoor.Venik
NaRZIOq3O8.dll	100%	Avira	TR/Patched.Ren.Gen
NaRZIOq3O8.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://107.163.241.186:12354/login.php;	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpU)U	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpData	0%	Avira URL Cloud	safe
http://107.163.241.185:16300/	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.php_kt	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpykV	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpogs	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.php#)o	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpwk	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.php)	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.php()b	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpB)H	0%	Avira URL Cloud	safe
http://107.163.24I	0%	Avira URL Cloud	safe
http://www.rsac.org/ratingsv01.html	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpSk	0%	Avira URL Cloud	safe
http://107.163.241.185:16300//joy.asp?sid=rungnejcndvgnJLfFe5vteX8v2LUicbtudb8mteXmJe1nde	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpckP	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpMkb	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpbV	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.phpAkn	0%	Avira URL Cloud	safe
http://107.163.241.186:12354/login.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
blogx.sina.com.cn	202.108.0.52	true	false		high
blog.sina.com.cn	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://blog.sina.com.cn/u/5655029807OW64	rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.186:12354/login.php;	rundll32.exe, 00000003.00000002.3769274572.000000000584A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.185:16300/	rundll32.exe, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpogs	rundll32.exe, 00000003.00000002.3755445264.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpU)U	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpData	rundll32.exe, 00000003.00000002.3755445264.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807pSk	rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.186:12354/login.php_kt	rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807.	rundll32.exe, 00000003.00000002.3769344739.000000000597D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.186:12354/login.php#)o	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpykV	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s	rundll32.exe, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	false		high
http://107.163.241.186:12354/login.php)	rundll32.exe, 00000003.00000002.3769043111.000000000562D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3768985716.00000000055AD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpwk	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.php()b	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpB)H	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rsac.org/ratingsv01.html	rundll32.exe, 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmp, NaRZIOq3O8.dll	false	Avira URL Cloud: safe	unknown
http://107.163.241.185:16300//joy.asp?sid=rungnejcndvgnJLfFe5vteX8v2LUicbtudb8mteXmJe1nde	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz	rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	false		high
http://blog.sina.com.cn/u/5655029807	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807p	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.186:12354/login.phpSk	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.24I	rundll32.exe, 00000003.00000002.3768985716.00000000055AD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807osoft	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.186:12354/login.phpckP	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpAkn	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpMkb	rundll32.exe, 00000003.00000003.3057253768.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.phpbV	rundll32.exe, 00000003.00000002.3755445264.0000000002B04000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.186:12354/login.php	rundll32.exe, 00000003.00000002.3755445264.0000000002AA3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.241.186	unknown	United States	20248	TAKE2US	true
107.163.241.185	unknown	United States	20248	TAKE2US	true
107.163.241.193	unknown	United States	20248	TAKE2US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558496
Start date and time:	2024-11-19 14:22:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NaRZIOq3O8.dll renamed because original name is a hash value
Original Sample Name:	e999daea87b481d11b4fd8559bdd3d68516dc0ef.dll
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winDLL@31/1@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 43 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: NaRZIOq3O8.dll

Simulations

Behavior and APIs

Time	Type	Description
08:23:08	API Interceptor	1x Sleep call for process: loaddll32.exe modified
08:23:36	API Interceptor	2585226x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.241.186	33twe7X26S.dll	Get hash	malicious	Unknown	Browse
107.163.241.186	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse
107.163.241.185	33twe7X26S.dll	Get hash	malicious	Unknown	Browse
107.163.241.185	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse
107.163.241.193	33twe7X26S.dll	Get hash	malicious	Unknown	Browse
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	http://zeuso.cc	Get hash	malicious	Unknown	Browse	202.108.0.52
	02hNixBIvP.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TAKE2US	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236
	01JkTmNJhe.dll	Get hash	malicious	Unknown	Browse	107.163.43.235
	oQy3XhO4cX.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	Bcr1Wl2Jn0.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	OL50O9ho5M.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
TAKE2US	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236
	01JkTmNJhe.dll	Get hash	malicious	Unknown	Browse	107.163.43.235
	oQy3XhO4cX.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	Bcr1Wl2Jn0.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	OL50O9ho5M.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	Vb1S2HJcnN.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	owari.mips.elf	Get hash	malicious	Unknown	Browse	111.193.177.206
	owari.x86.elf	Get hash	malicious	Unknown	Browse	60.194.199.155
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	hmips.elf	Get hash	malicious	Mirai	Browse	111.196.123.227
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	123.112.202.42
TAKE2US	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236
	01JkTmNJhe.dll	Get hash	malicious	Unknown	Browse	107.163.43.235
	oQy3XhO4cX.dll	Get hash	malicious	Unknown	Browse	107.163.56.251
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	Bcr1Wl2Jn0.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	OL50O9ho5M.dll	Get hash	malicious	Unknown	Browse	107.163.56.251

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	812
Entropy (8bit):	4.3571728803400465
Encrypted:	false
SSDEEP:	12:82vQnZ4oTzmmMrJk2qSCz/+ogjgjgjgjgjgjgjgjgR:82WDMrJkXqh
MD5:	B8A7CA3310C0048B9E0F577E01844BB2
SHA1:	FF1152820A4C88C77F741D53FE062ECAB673BA1F
SHA-256:	1BA9E7418B04DB1005E7D51D36E146CB51C051046AF72706F7899146A1FD079C
SHA-512:	1B103098A091609061BDF9426AB11B0B79DD9B01D289E272261FCFAD8C0685398FA00C794E776DEAD87602A1D8993DCDAFFDB16E296566AEA84AA382E4905EF1
Malicious:	false
Preview:	..2024-11-19 12:17..iOffset....2024-11-19 18:33..iOffset....2024-11-20 01:09..iOffset....2024-11-20 08:45..iOffset....2024-11-20 14:41..iOffset....2024-11-20 23:08..iOffset....2024-11-21 08:59..iOffset....2024-11-21 23:05..iOffset....2024-11-22 20:41..iOffset....2024-11-24 10:42..iOffset....2024-11-25 21:03..iOffset....2025-09-26 02:19..iOffset....2026-07-25 01:57..iOffset....2028-02-02 02:58..iOffset....2029-10-10 15:24..iOffset....2031-06-19 11:25..iOffset....2033-02-17 20:16..iOffset....2034-10-02 12:07..iOffset....2036-04-15 07:18..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset....2037-02-08 09:26..iOffset..

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.818659598157651
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 94.25% UPX compressed Win32 Executable (30571/9) 2.88% Win32 EXE Yoda's Crypter (26571/9) 2.50% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19%
File name:	NaRZIOq3O8.dll
File size:	100'093 bytes
MD5:	8ae5deac29c6d351c2376da97b75b88a
SHA1:	e999daea87b481d11b4fd8559bdd3d68516dc0ef
SHA256:	6831f236816f9799458cff0c50116bcc3029f57e8cd8ab181204bc914789c1df
SHA512:	a69fd417bda9b491924222066f77172c6c2a217ec6e9269f4037ff2953afb7148a31465f48705480ccc862e10c86185cb595482b9ed9c93a4dd48194396b0582
SSDEEP:	3072:BDpG6gzgHr5tCmfk455ecDBkdq+SStvAbGh:5pG6Sg9txRk/SS6bGh
TLSH:	B0A301F6290D7DD6CB35483AD6628E35F929EE348C589F887ECE6C13ACB8510E1641F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... B..N...N...N...B...N.......N.......N.K.....N.F.....N.F.@...N.-.D...N...O...N.-.E...N.}.H...N.-.J...N.Rich..N.........PE..L..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10037000
Entrypoint Section:	fdss
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x5644242A [Thu Nov 12 05:31:22 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e410f49346b1cb4eeca484464a7085c8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 000A2C2Ah
push 000D9038h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
pop eax
mov dword ptr fs:[00000000h], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov eax, 10034530h
jmp eax
nop
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x366a8	0x3c	.rsrc
IMAGE_DIRECTORY_ENTRY_IMPORT	0x363f8	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35000	0x13f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x366e4	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x1d000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x1e000	0x17000	0x16800	cb1026f8f75c78cc70a618d3d8d74f16	False	0.9822157118055556	data	7.919300310478591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35000	0x2000	0x1800	79e4d91889da7eba4072fabd611a7062	False	0.2890625	data	4.305579106560728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fdss	0x37000	0x208	0x200	da18cbcff70aaec6311fc739f52e246c	False	0.115234375	data	0.703199634755278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x351d4	0x528	Device independent bitmap graphic, 14 x 16 x 8, image size 256, resolution 2835 x 2835 px/m	English	United States	0.1
RT_BITMAP	0x35700	0x528	Device independent bitmap graphic, 14 x 16 x 8, image size 256, resolution 2835 x 2835 px/m	English	United States	0.08409090909090909
RT_BITMAP	0x35c2c	0x50	Device independent bitmap graphic, 8 x 8 x 1, image size 32	English	United States	0.4125
RT_BITMAP	0x35c80	0x50	Device independent bitmap graphic, 8 x 8 x 1, image size 32	English	United States	0.4875
RT_HTML	0x35cd4	0x49	HTML document, ASCII text, with CRLF line terminators	English	United States	0.8493150684931506
RT_HTML	0x35d24	0xd	HTML document, ASCII text, with no line terminators	English	United States	1.3076923076923077
RT_HTML	0x35d38	0x6be	HTML document, ASCII text, with CRLF line terminators	English	United States	0.5179606025492468

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
ADVAPI32.dll	RegOpenKeyA
MFC42.DLL
MSVCP60.dll	??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
MSVCRT.dll	free
NETAPI32.dll	Netbios
ole32.dll	CoUninitialize
OLEAUT32.dll	SysStringLen
SHLWAPI.dll	StrStrIA
USER32.dll	wsprintfA
WS2_32.dll	htons

Exports

Name	Ordinal	Address
Group	1	0x1000bb70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:23:08.957200050 CET	49707	16300	192.168.2.10	107.163.241.185
Nov 19, 2024 14:23:09.966401100 CET	49707	16300	192.168.2.10	107.163.241.185
Nov 19, 2024 14:23:11.966533899 CET	49707	16300	192.168.2.10	107.163.241.185
Nov 19, 2024 14:23:15.966486931 CET	49707	16300	192.168.2.10	107.163.241.185
Nov 19, 2024 14:23:23.966353893 CET	49707	16300	192.168.2.10	107.163.241.185
Nov 19, 2024 14:23:30.998902082 CET	49714	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:32.013276100 CET	49714	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:34.006580114 CET	49715	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:34.006978035 CET	49716	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:34.013407946 CET	49714	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:35.013273954 CET	49715	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:35.013276100 CET	49716	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:37.013442039 CET	49715	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:37.014686108 CET	49716	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:37.285955906 CET	49717	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:38.013365030 CET	49714	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:38.154891968 CET	49718	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:38.268796921 CET	49719	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:38.331680059 CET	49720	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:39.169543028 CET	49718	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:39.372653008 CET	49719	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:39.372862101 CET	49720	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:41.169550896 CET	49718	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:41.372699976 CET	49719	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:41.372700930 CET	49720	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:42.155886889 CET	49721	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:42.327006102 CET	49722	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:42.342318058 CET	49723	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:43.263325930 CET	49721	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:43.357085943 CET	49723	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:43.372678041 CET	49722	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:45.372658014 CET	49723	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:45.372704029 CET	49721	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:45.372740984 CET	49722	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:46.060179949 CET	49714	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:46.174069881 CET	49729	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:46.284956932 CET	49730	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:46.285339117 CET	49731	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:47.278950930 CET	49730	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:47.370641947 CET	49729	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:47.370731115 CET	49731	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:49.294560909 CET	49730	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:49.466442108 CET	49729	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:49.466748953 CET	49731	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:50.213088989 CET	49733	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:50.420217991 CET	49734	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:50.435606003 CET	49735	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:51.372833014 CET	49733	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:51.435192108 CET	49735	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:51.575663090 CET	49734	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:52.281212091 CET	49736	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:53.372790098 CET	49733	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:53.372797966 CET	49736	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:53.482116938 CET	49735	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:53.669656038 CET	49734	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:54.217175961 CET	49737	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:54.334358931 CET	49738	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:54.656538010 CET	49739	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:55.216520071 CET	49737	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:55.341499090 CET	49738	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:55.388391018 CET	49736	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:23:55.653992891 CET	49739	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:57.216496944 CET	49737	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:57.342683077 CET	49738	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:57.669692039 CET	49739	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:58.233233929 CET	49740	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:58.348911047 CET	49741	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:58.351689100 CET	49742	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:59.247757912 CET	49740	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:59.341526031 CET	49741	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:23:59.357135057 CET	49742	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:23:59.388401985 CET	49736	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:01.250782013 CET	49740	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:01.341530085 CET	49741	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:01.372750998 CET	49742	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:02.248543978 CET	49743	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:02.361884117 CET	49744	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:02.362907887 CET	49745	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:03.250777960 CET	49743	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:03.372828960 CET	49745	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:03.372876883 CET	49744	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:05.247852087 CET	49743	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:05.372807026 CET	49744	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:05.372869968 CET	49745	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:06.290110111 CET	49746	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:06.882675886 CET	49747	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:06.886926889 CET	49748	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:07.294680119 CET	49746	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:07.388384104 CET	49736	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:07.888421059 CET	49748	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:07.888422012 CET	49747	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:09.294720888 CET	49746	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:09.888407946 CET	49747	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:09.888492107 CET	49748	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:10.295761108 CET	49750	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:10.431253910 CET	49751	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:10.433980942 CET	49752	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:11.310305119 CET	49750	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:11.435338974 CET	49751	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:11.435523987 CET	49752	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:13.310282946 CET	49750	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:13.435307026 CET	49751	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:13.437458992 CET	49752	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:13.499169111 CET	49753	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:14.311327934 CET	49754	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:14.513420105 CET	49753	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:14.545057058 CET	49755	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:14.579710960 CET	49756	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:15.325906992 CET	49754	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:15.560389996 CET	49755	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:15.591620922 CET	49756	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:16.513425112 CET	49753	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:17.341630936 CET	49754	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:17.560376883 CET	49755	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:17.591751099 CET	49756	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:18.353575945 CET	49757	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:18.470721006 CET	49758	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:18.524342060 CET	49759	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:19.357167006 CET	49757	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:19.482163906 CET	49758	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:19.544698000 CET	49759	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:20.654093027 CET	49753	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:21.357219934 CET	49757	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:21.482171059 CET	49758	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:21.565722942 CET	49759	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:22.358028889 CET	49760	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:22.560842037 CET	49761	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:22.561245918 CET	49762	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:23.357233047 CET	49760	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:23.560363054 CET	49761	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:23.619606018 CET	49762	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:25.357341051 CET	49760	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:25.576013088 CET	49761	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:25.638609886 CET	49762	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:26.358103037 CET	49763	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:26.473026991 CET	49764	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:26.473716974 CET	49765	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:27.372816086 CET	49763	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:27.482403040 CET	49764	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:27.638541937 CET	49765	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:28.747883081 CET	49753	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:29.388641119 CET	49763	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:29.497852087 CET	49764	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:29.747889996 CET	49765	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:30.373573065 CET	49767	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:31.055069923 CET	49768	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:31.055732965 CET	49769	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:31.373150110 CET	49767	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:32.060437918 CET	49769	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:32.138575077 CET	49768	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:33.388520956 CET	49767	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:34.060465097 CET	49769	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:34.138485909 CET	49768	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:34.374361992 CET	49770	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:34.487642050 CET	49771	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:34.488637924 CET	49772	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:34.878078938 CET	49773	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:35.372873068 CET	49770	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:35.497899055 CET	49771	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:35.497900009 CET	49772	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:35.888485909 CET	49773	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:37.388582945 CET	49770	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:37.497929096 CET	49772	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:37.513539076 CET	49771	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:37.888644934 CET	49773	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:38.389497995 CET	49774	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:38.665736914 CET	49775	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:38.665951014 CET	49776	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:39.404112101 CET	49774	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:39.669806004 CET	49775	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:39.673082113 CET	49776	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:41.419861078 CET	49774	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:41.685420990 CET	49775	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:41.689074039 CET	49776	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:41.888539076 CET	49773	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:42.405764103 CET	49777	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:42.517746925 CET	49778	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:42.519460917 CET	49779	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:43.419748068 CET	49777	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:43.529154062 CET	49779	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:43.529162884 CET	49778	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:45.419815063 CET	49777	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:45.544925928 CET	49779	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:45.544935942 CET	49778	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:46.422786951 CET	49780	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:46.873986006 CET	49781	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:46.874166012 CET	49782	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:47.419845104 CET	49780	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:47.888660908 CET	49782	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:47.888664961 CET	49781	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:49.435436010 CET	49780	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:49.888577938 CET	49781	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:49.888683081 CET	49782	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:49.888686895 CET	49773	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:50.437005043 CET	49783	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:50.580527067 CET	49784	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:50.581937075 CET	49785	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:51.451159000 CET	49783	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:51.576056004 CET	49784	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:51.591686964 CET	49785	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:53.466671944 CET	49783	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:53.591718912 CET	49784	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:53.591722012 CET	49785	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:54.499115944 CET	49787	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:54.973107100 CET	49788	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:55.358501911 CET	49789	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:55.513581038 CET	49787	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:55.966790915 CET	49788	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:56.001343966 CET	49790	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:56.373224974 CET	49789	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:57.013595104 CET	49790	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:57.513740063 CET	49787	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:57.966811895 CET	49788	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:58.374989986 CET	49789	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:58.514921904 CET	49791	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:58.688690901 CET	49792	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:24:58.689388037 CET	49793	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:59.013598919 CET	49790	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:24:59.529202938 CET	49791	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:59.685534954 CET	49793	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:24:59.701097012 CET	49792	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:01.544879913 CET	49791	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:01.685458899 CET	49793	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:01.716754913 CET	49792	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:02.518407106 CET	49794	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:02.764303923 CET	49795	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:02.764791965 CET	49796	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:03.013828993 CET	49790	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:03.513659954 CET	49794	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:03.779249907 CET	49796	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:03.779309988 CET	49795	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:05.623038054 CET	49794	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:05.779218912 CET	49796	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:05.826102972 CET	49795	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:06.529954910 CET	49797	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:06.646595001 CET	49798	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:06.647576094 CET	49799	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:07.623004913 CET	49797	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:07.810517073 CET	49799	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:07.826126099 CET	49798	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:09.622970104 CET	49797	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:09.810532093 CET	49799	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:09.919898033 CET	49798	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:10.545696974 CET	49800	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:10.819297075 CET	49801	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:10.819554090 CET	49802	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:11.013605118 CET	49790	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:11.701167107 CET	49800	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:11.826121092 CET	49801	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:12.013644934 CET	49802	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:13.701122999 CET	49800	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:13.826121092 CET	49801	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:14.013669968 CET	49802	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:14.681323051 CET	49803	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:14.681533098 CET	49804	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:14.681857109 CET	49805	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:15.701123953 CET	49804	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:15.701220036 CET	49805	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:15.827027082 CET	49803	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:17.128073931 CET	49806	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:17.734255075 CET	49804	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:17.734306097 CET	49805	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:17.826143980 CET	49803	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:18.326220989 CET	49806	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:18.709216118 CET	49807	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:18.815663099 CET	49808	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:18.816824913 CET	49809	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:19.810564041 CET	49807	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:19.810909033 CET	49809	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:19.826169968 CET	49808	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:20.326165915 CET	49806	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:21.810544968 CET	49807	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:21.810584068 CET	49809	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:21.826164961 CET	49808	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:22.719654083 CET	49811	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:22.943854094 CET	49812	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:22.945964098 CET	49813	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:23.826306105 CET	49811	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:24.013674021 CET	49812	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:24.013675928 CET	49813	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:24.326179981 CET	49806	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:25.826472044 CET	49811	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:26.013659000 CET	49812	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:26.013695955 CET	49813	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:26.733376980 CET	49814	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:26.849895000 CET	49815	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:26.851104021 CET	49816	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:27.827009916 CET	49814	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:28.014064074 CET	49815	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:28.019062042 CET	49816	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:29.827105999 CET	49814	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:30.123100996 CET	49815	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:30.127074003 CET	49816	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:30.749066114 CET	49818	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:30.936288118 CET	49819	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:30.951965094 CET	49820	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:31.901240110 CET	49818	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:32.013701916 CET	49820	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:32.013801098 CET	49819	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:32.327092886 CET	49806	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:33.947594881 CET	49818	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:34.013669968 CET	49820	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:34.056339979 CET	49819	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:34.764420033 CET	49821	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:34.889923096 CET	49822	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:34.891557932 CET	49823	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:35.810610056 CET	49821	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:35.977252960 CET	49822	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:36.013722897 CET	49823	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:37.810601950 CET	49821	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:37.998517036 CET	49822	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:38.015193939 CET	49823	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:38.437176943 CET	49824	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:38.920519114 CET	49825	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:38.972784996 CET	49826	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:38.973191023 CET	49827	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:39.513700008 CET	49824	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:40.013745070 CET	49825	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:40.013746023 CET	49826	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:40.014017105 CET	49827	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:41.529357910 CET	49824	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:42.013711929 CET	49825	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:42.013711929 CET	49827	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:42.013729095 CET	49826	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:42.936799049 CET	49828	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:43.052885056 CET	49829	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:43.054179907 CET	49830	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:44.011044025 CET	49828	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:44.138705015 CET	49830	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:44.201215982 CET	49829	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:45.623193026 CET	49824	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:46.107491016 CET	49828	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:46.310622931 CET	49829	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:46.326256990 CET	49830	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:46.952352047 CET	49831	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:47.171063900 CET	49832	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:47.171258926 CET	49833	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:47.998117924 CET	49831	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:48.253576994 CET	49832	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:48.326225042 CET	49833	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:50.107494116 CET	49831	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:50.310659885 CET	49832	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:50.326404095 CET	49833	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:50.967982054 CET	49834	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:51.081588984 CET	49835	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:51.082614899 CET	49836	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:52.013736010 CET	49834	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:52.123116970 CET	49835	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:52.201275110 CET	49836	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:53.623137951 CET	49824	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:25:54.013752937 CET	49834	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:54.123142004 CET	49835	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:54.310648918 CET	49836	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:54.984277964 CET	49838	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:55.235299110 CET	49839	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:55.781266928 CET	49840	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:56.013926983 CET	49838	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:56.326260090 CET	49839	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:56.826364040 CET	49840	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:58.013998032 CET	49838	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:58.326275110 CET	49839	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:58.826313972 CET	49840	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:58.999727011 CET	49841	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:59.183645964 CET	49842	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:25:59.185987949 CET	49843	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:25:59.734745026 CET	49844	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:00.107600927 CET	49841	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:00.271472931 CET	49842	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:00.326303005 CET	49843	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:00.826343060 CET	49844	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:02.193212986 CET	49841	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:02.310671091 CET	49842	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:02.326704025 CET	49843	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:02.826308012 CET	49844	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:03.020301104 CET	49845	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:03.130287886 CET	49846	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:03.130894899 CET	49847	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:04.013784885 CET	49845	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:04.201312065 CET	49846	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:04.326307058 CET	49847	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:06.013952971 CET	49845	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:06.201286077 CET	49846	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:06.327136993 CET	49847	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:06.826878071 CET	49844	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:07.306355000 CET	49848	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:07.306818962 CET	49849	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:07.330537081 CET	49850	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:08.326307058 CET	49849	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:08.326370001 CET	49848	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:08.509690046 CET	49850	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:10.326304913 CET	49849	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:10.326370001 CET	49848	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:10.607609034 CET	49850	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:11.311594009 CET	49851	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:11.424372911 CET	49852	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:11.425437927 CET	49853	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:12.326384068 CET	49851	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:12.449712992 CET	49853	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:12.513812065 CET	49852	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:14.326308966 CET	49851	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:14.515177011 CET	49852	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:14.607755899 CET	49853	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:14.826314926 CET	49844	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:15.330224037 CET	49855	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:15.530678988 CET	49856	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:15.530740023 CET	49857	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:16.513856888 CET	49855	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:16.590523005 CET	49857	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:16.623325109 CET	49856	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:18.514064074 CET	49855	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:18.623262882 CET	49856	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:18.645919085 CET	49857	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:19.330279112 CET	49858	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:19.441782951 CET	49859	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:19.442440987 CET	49860	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:20.513856888 CET	49859	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:20.515156984 CET	49858	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:20.607600927 CET	49860	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:20.946676970 CET	49861	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:21.998310089 CET	49861	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:22.524121046 CET	49859	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:22.524156094 CET	49858	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:22.607608080 CET	49860	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:23.342793941 CET	49862	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:23.540503979 CET	49863	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:23.580389977 CET	49864	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:24.013904095 CET	49861	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:24.513859987 CET	49862	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:24.623307943 CET	49863	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:24.623310089 CET	49864	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:26.513900042 CET	49862	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:26.623243093 CET	49863	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:26.627239943 CET	49864	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:27.361130953 CET	49865	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:27.476914883 CET	49866	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:27.478612900 CET	49867	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:28.013916969 CET	49861	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:28.513874054 CET	49865	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:28.513875008 CET	49867	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:28.514127970 CET	49866	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:30.513968945 CET	49865	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:30.513969898 CET	49867	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:30.514030933 CET	49866	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:31.574285030 CET	49869	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:31.575514078 CET	49870	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:31.575692892 CET	49868	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:32.623689890 CET	49870	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:32.679872990 CET	49869	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:32.679876089 CET	49868	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:34.623238087 CET	49870	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:34.701411963 CET	49869	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:34.701464891 CET	49868	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:35.577670097 CET	49872	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:35.692183018 CET	49873	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:35.693097115 CET	49874	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:36.013899088 CET	49861	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:36.628499031 CET	49872	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:36.810834885 CET	49874	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:36.827510118 CET	49873	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:38.810777903 CET	49874	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:38.826387882 CET	49872	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:39.013997078 CET	49873	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:39.593848944 CET	49875	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:39.759171009 CET	49876	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:39.788111925 CET	49877	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:40.623330116 CET	49875	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:40.826781988 CET	49877	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:40.904541016 CET	49876	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:42.242604017 CET	49878	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:42.623280048 CET	49875	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:42.826445103 CET	49877	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:42.984397888 CET	49876	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:43.310796976 CET	49878	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:44.157605886 CET	49879	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:44.186698914 CET	49880	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:44.187304020 CET	49881	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:45.310898066 CET	49880	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:45.313254118 CET	49878	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:45.326477051 CET	49879	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:45.326643944 CET	49881	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:47.326431990 CET	49879	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:47.326455116 CET	49881	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:47.391455889 CET	49880	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:48.171858072 CET	49882	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:48.283902884 CET	49883	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:48.284909010 CET	49884	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:49.201543093 CET	49882	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:49.310791016 CET	49883	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:49.310808897 CET	49878	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:49.326417923 CET	49884	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:51.288141012 CET	49882	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:51.326416969 CET	49884	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:51.397835016 CET	49883	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:52.210390091 CET	49885	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:52.317163944 CET	49886	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:52.317763090 CET	49887	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:53.310836077 CET	49885	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:53.326438904 CET	49887	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:53.498387098 CET	49886	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:55.310836077 CET	49885	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:55.326466084 CET	49887	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:55.513948917 CET	49886	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:56.218348026 CET	49889	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:56.355493069 CET	49890	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:56.729166031 CET	49891	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:57.310892105 CET	49889	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:57.313441038 CET	49878	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:26:57.450083971 CET	49890	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:57.810874939 CET	49891	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:26:59.310976028 CET	49889	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:59.498353958 CET	49890	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:26:59.826452971 CET	49891	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:00.238456964 CET	49892	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:00.476861000 CET	49893	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:00.477161884 CET	49894	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:01.275685072 CET	49892	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:01.498356104 CET	49893	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:01.514012098 CET	49894	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:03.310951948 CET	49892	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:03.422241926 CET	49895	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:27:03.498512030 CET	49893	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:03.514014959 CET	49894	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:04.289127111 CET	49896	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:04.393584013 CET	49897	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:04.411619902 CET	49898	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:04.420202971 CET	49895	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:27:05.310898066 CET	49896	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:05.420259953 CET	49897	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:05.483367920 CET	49898	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:06.518098116 CET	49895	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:27:07.313317060 CET	49896	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:07.498363972 CET	49898	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:07.623383999 CET	49897	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:08.608614922 CET	49899	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:08.608794928 CET	49900	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:08.609110117 CET	49901	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:09.631351948 CET	49899	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:09.631429911 CET	49900	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:09.701478958 CET	49901	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:10.623488903 CET	49895	6520	192.168.2.10	107.163.241.193
Nov 19, 2024 14:27:11.701674938 CET	49901	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:11.810897112 CET	49899	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:11.811297894 CET	49900	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:12.624401093 CET	49902	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:12.742626905 CET	49903	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:12.745316029 CET	49904	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:13.623603106 CET	49902	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:13.811434984 CET	49904	80	192.168.2.10	202.108.0.52
Nov 19, 2024 14:27:13.811438084 CET	49903	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:15.623408079 CET	49902	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:15.810926914 CET	49903	12354	192.168.2.10	107.163.241.186
Nov 19, 2024 14:27:15.810940027 CET	49904	80	192.168.2.10	202.108.0.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 14:23:37.276221037 CET	55268	53	192.168.2.10	1.1.1.1
Nov 19, 2024 14:23:37.283813000 CET	53	55268	1.1.1.1	192.168.2.10
Nov 19, 2024 14:23:54.335678101 CET	49672	53	192.168.2.10	1.1.1.1
Nov 19, 2024 14:23:54.655605078 CET	53	49672	1.1.1.1	192.168.2.10
Nov 19, 2024 14:24:54.973100901 CET	60486	53	192.168.2.10	1.1.1.1
Nov 19, 2024 14:24:55.349698067 CET	53	60486	1.1.1.1	192.168.2.10
Nov 19, 2024 14:25:55.236169100 CET	57941	53	192.168.2.10	1.1.1.1
Nov 19, 2024 14:25:55.780548096 CET	53	57941	1.1.1.1	192.168.2.10
Nov 19, 2024 14:26:56.358879089 CET	50400	53	192.168.2.10	1.1.1.1
Nov 19, 2024 14:26:56.728183985 CET	53	50400	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 14:23:37.276221037 CET	192.168.2.10	1.1.1.1	0xddf0	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:23:54.335678101 CET	192.168.2.10	1.1.1.1	0x7018	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:24:54.973100901 CET	192.168.2.10	1.1.1.1	0x8cbe	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:55.236169100 CET	192.168.2.10	1.1.1.1	0xa670	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:56.358879089 CET	192.168.2.10	1.1.1.1	0xe8c3	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 14:23:37.283813000 CET	1.1.1.1	192.168.2.10	0xddf0	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:23:37.283813000 CET	1.1.1.1	192.168.2.10	0xddf0	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:23:54.655605078 CET	1.1.1.1	192.168.2.10	0x7018	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:23:54.655605078 CET	1.1.1.1	192.168.2.10	0x7018	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:24:55.349698067 CET	1.1.1.1	192.168.2.10	0x8cbe	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:24:55.349698067 CET	1.1.1.1	192.168.2.10	0x8cbe	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:25:55.780548096 CET	1.1.1.1	192.168.2.10	0xa670	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:25:55.780548096 CET	1.1.1.1	192.168.2.10	0xa670	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Nov 19, 2024 14:26:56.728183985 CET	1.1.1.1	192.168.2.10	0xe8c3	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 14:26:56.728183985 CET	1.1.1.1	192.168.2.10	0xe8c3	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll"
Imagebase:	0xf50000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\NaRZIOq3O8.dll,Group
Imagebase:	0x590000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",#1
Imagebase:	0x590000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:23:05
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x5d0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:23:08
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Imagebase:	0x590000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:23:08
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 5908, Parent PID: 4556

General

Target ID:	12
Start time:	08:23:08
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:23:08
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x5d0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:23:38
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Imagebase:	0x590000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:23:38
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2088, Parent PID: 7508

General

Target ID:	17
Start time:	08:23:38
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:23:38
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x5d0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:23:46
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\user\Desktop\NaRZIOq3O8.dll",Group
Imagebase:	0x590000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6836, Parent PID: 6196

General

Target ID:	20
Start time:	08:23:46
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "C:\Users\user\Desktop"
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4556, Parent PID: 6836

General

Target ID:	21
Start time:	08:23:46
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:23:46
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x5d0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.5%
Total number of Nodes:	812
Total number of Limit Nodes:	19

Executed Functions

Function 10005E10 Relevance: 72.0, APIs: 32, Strings: 9, Instructions: 263
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10005E82
socket.WS2_32(00000002,00000002,00000000), ref: 10005E94
socket.WS2_32(00000002,00000002,00000000), ref: 10005EA0
htons.WS2_32(00000035), ref: 10005EB7
inet_addr.WS2_32(127.0.0.1), ref: 10005EC9
htons.WS2_32(00000035), ref: 10005ED1
inet_addr.WS2_32(?), ref: 10005ED8
bind.WS2_32(00000000,?,00000010), ref: 10005EE2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 10005EFB
select.WS2_32 ref: 10005F3C
WSAGetLastError.WS2_32 ref: 10005F46
Sleep.KERNEL32(000003E8), ref: 10005F51
recvfrom.WS2_32(00000000,?,00000200,00000000,00000000,?), ref: 10005F8B
wsprintfA.USER32 ref: 10005FF2
StrStrIA.SHLWAPI(www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.ki|www.knbank.co.kr.ki|openbank.cu.co.kr.ki|www.busanbank.co.kr.ki|www.nonghyup.com.ki|www.shinhan.com.ki|www.wooribank.com.ki|www.hanabank.com.ki|www.epostbank.go.kr.ki|www.ibk.co.kr.ki|www.idk.c,?), ref: 1000600E
StrStrIA.SHLWAPI(?,alyac), ref: 1000602A
StrStrIA.SHLWAPI(?,ahnlab), ref: 1000603A
StrStrIA.SHLWAPI(?,v3lite), ref: 1000604A
malloc.MSVCRT ref: 1000605A
htons.WS2_32(00008180), ref: 10006091
htons.WS2_32(00008182), ref: 100060A8
htons.WS2_32(00000001), ref: 100060B4
htons.WS2_32(0000C00C), ref: 100060DA
htons.WS2_32(00000001), ref: 100060E3
htons.WS2_32(00000001), ref: 100060EC
htonl.WS2_32(0000007B), ref: 100060F5
htons.WS2_32(00000004), ref: 10006101
inet_addr.WS2_32(127.0.0.1), ref: 1000611C
sendto.WS2_32(?,?,00000010,00000000,?,00000010), ref: 1000615B
closesocket.WS2_32(?), ref: 10006194
closesocket.WS2_32(00000000), ref: 10006197
WSACleanup.WS2_32 ref: 10006199

Strings

ahnlab, xrefs: 10006034
127.0.0.1, xrefs: 10005EBF, 10006117
%s|, xrefs: 10005FEB
iRecv=0, xrefs: 10006177
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.ki|www.knbank.co.kr.ki|openbank.cu.co.kr.ki|www.busanbank.co.kr.ki|www.nonghyup.com.ki|www.shinhan.com.ki|www.wooribank.com.ki|www.hanabank.com.ki|www.epostbank.go.kr.ki|www.ibk.co.kr.ki|www.idk.c, xrefs: 10006009
8.8.8.8, xrefs: 10005E5D
v3lite, xrefs: 10006044
alyac, xrefs: 10006024
c:\3.txt, xrefs: 1000617C

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: htons$inet_addr$closesocketsocket$CleanupErrorLastSleepStartupbindhtonlioctlsocketmallocrecvfromselectsendtowsprintf
String ID: %s|$127.0.0.1$8.8.8.8$ahnlab$alyac$c:\3.txt$iRecv=0$v3lite$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.ki|www.knbank.co.kr.ki|openbank.cu.co.kr.ki|www.busanbank.co.kr.ki|www.nonghyup.com.ki|www.shinhan.com.ki|www.wooribank.com.ki|www.hanabank.com.ki|www.epostbank.go.kr.ki|www.ibk.co.kr.ki|www.idk.c
API String ID: 3913902103-3128632860
Opcode ID: b85d70ee679bfbae6654c32a675e835e059487f67f27821f8a9bdb85a842703e
Instruction ID: 6a78d858e6a5a08b9cde055bca40f9f9f98f5805156c37e08f8545c097103a96
Opcode Fuzzy Hash: b85d70ee679bfbae6654c32a675e835e059487f67f27821f8a9bdb85a842703e
Instruction Fuzzy Hash: 8AA1BC71608345AFE720DB60CC85BAFB7E9EF88744F00491DF68597290DBB4EA08CB56

Function 1000B3C0 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 237
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 1000B3F4
lstrcat.KERNEL32(00000000,10019C10), ref: 1000B40D
lstrcat.KERNEL32(00000000,*.*), ref: 1000B41C
FindFirstFileA.KERNEL32(00000000,?), ref: 1000B42E
FindNextFileA.KERNEL32(00000000,?), ref: 1000B454
lstrcpy.KERNEL32(00000000,?), ref: 1000B4AA
lstrcat.KERNEL32(00000000,10019C10), ref: 1000B4BD
lstrcat.KERNEL32(00000000,0000002E), ref: 1000B4CF
_strcmpi.MSVCRT ref: 1000B4DE
PathIsDirectoryA.SHLWAPI(?), ref: 1000B531
6D262DD0.MFC42(00A00000,?,?,?,?,00000000), ref: 1000B544

Strings

NPKI, xrefs: 1000B4D9
*.*, xrefs: 1000B416
/image.php, xrefs: 1000B67B
107.163.241.186:12354/login.php, xrefs: 1000B5DC
%s\%s, xrefs: 1000B51A
., xrefs: 1000B463
11121541, xrefs: 1000B502

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindlstrcpy$D262DirectoryFirstNextPath_strcmpi
String ID: %s\%s$*.*$.$/image.php$107.163.241.186:12354/login.php$11121541$NPKI
API String ID: 3598801687-675274852
Opcode ID: 819a45a9d1b067640268757ad9253d2cf9f23331dbc3ac5890bd5eee83ea9760
Instruction ID: 7599fc823e929f38516ac2ea80dcb634581b4eaf94ee74f111db2df8a507a940
Opcode Fuzzy Hash: 819a45a9d1b067640268757ad9253d2cf9f23331dbc3ac5890bd5eee83ea9760
Instruction Fuzzy Hash: 6381E771604785AFE324CB24CC45BEB77E9EBC8344F004D2DE68993291EB75A648C792

Function 10005870 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 1000588A
GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 1000589A
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100058B1
malloc.MSVCRT ref: 100058CA
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,1000BBE4,00000035), ref: 100058F0

Strings

GetExtendedUdpTable, xrefs: 10005890
iphlpapi.dll, xrefs: 10005875

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable$AddressLibraryLoadProcmalloc
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2385667234-1809394930
Opcode ID: e1b00724cfaacc8b843fa86b310e38769440c808da8af4b399ce40dbed45f0c6
Instruction ID: d7c0e26cda9d5ea5ce5ff2f3001dfa376abaab0d7e51cba96a5469bc1a5c6616
Opcode Fuzzy Hash: e1b00724cfaacc8b843fa86b310e38769440c808da8af4b399ce40dbed45f0c6
Instruction Fuzzy Hash: CB21E171204302ABF710DF28EC85BAB37E4EF847A0F008A25F995D62C0D772D949C7A2

Function 1000C190 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 1000C1A9
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 1000C1C6
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 1000C1F8
GetLastError.KERNEL32(00000400,?,00000000,00000000), ref: 1000C20C
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 1000C21A

Strings

\\.\PHYSICALDRIVE%d, xrefs: 1000C1A3

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ControlCreateDeviceErrorFileFormatLastMessagesprintf
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1111953355-613073274
Opcode ID: c53000877ec2aa7fee595b4572a85b816ff392d08c2107d39e209743fa20e477
Instruction ID: 45ae0edda3d41c4c2eec03a22dee8fc668454583b3e0103b580059d381486647
Opcode Fuzzy Hash: c53000877ec2aa7fee595b4572a85b816ff392d08c2107d39e209743fa20e477
Instruction Fuzzy Hash: 3D4127762443046BF324DA38DC46FEB7385EB98760F508729FA55CB2C0EEB59A188395

Function 10005620 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000), ref: 1000562A
OpenProcessToken.ADVAPI32(00000000), ref: 10005631
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10005647
AdjustTokenPrivileges.KERNELBASE ref: 1000568A
CloseHandle.KERNEL32 ref: 10005695

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: e3783ca1f29b139df8556e5866564b38593cf1fe3dbbde3397e265e7e817bc56
Instruction ID: a2edfa9b86e6a0acb4b0852c084eebde7c3743d30616468f98f68bef03f890e1
Opcode Fuzzy Hash: e3783ca1f29b139df8556e5866564b38593cf1fe3dbbde3397e265e7e817bc56
Instruction Fuzzy Hash: 7B0129B4608301ABE704DF64CD85B6B77E8FBC8B41F80CA1CF94986291DB75D904CB62

Function 1000C0C0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?,00000210,1000C265,00000000), ref: 1000C110

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 6efe1891206b3777681fb32c89ca79adf49100392fac54556cb4e8c3ccab099b
Instruction ID: dd68c41c000daad9a29386f739e30e366fb2defe37250152ab40d60b23e964fe
Opcode Fuzzy Hash: 6efe1891206b3777681fb32c89ca79adf49100392fac54556cb4e8c3ccab099b
Instruction Fuzzy Hash: 63F0A96228A3C29EE702CB688855BD2FF947B76710F0CD7C9F1D85B283C2548598D766

Function 100051F0 Relevance: 1.5, APIs: 1, Instructions: 6processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(?,?), ref: 100051FA

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: b1a37351201e7f7fa222f0003396ead25511c011be7531a2d416dfbceb343984
Instruction ID: b514baa08b3f1d8f82369d583fde96a78a05e9397895c3dcff7847106b415855
Opcode Fuzzy Hash: b1a37351201e7f7fa222f0003396ead25511c011be7531a2d416dfbceb343984
Instruction Fuzzy Hash: EDB09275108300ABD304DB10C984C2BB7A9AB94320B008808F48582118C630D880CB21

Function 10001000 Relevance: 61.7, APIs: 3, Strings: 32, Instructions: 403
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6D262DD0.MFC42(?), ref: 10001800
6D262DD0.MFC42(00001000,?), ref: 100018F9
lstrcpy.KERNEL32(00000000,00000001), ref: 10001905

Strings

$, xrefs: 1000136C
7, xrefs: 1000113C
", xrefs: 10001356
(, xrefs: 10001398
+, xrefs: 100013B9
VUUU, xrefs: 1000181E
<, xrefs: 10001173
., xrefs: 100013DA
2, xrefs: 10001406
%, xrefs: 10001377
4, xrefs: 1000111B
3, xrefs: 10001411
,, xrefs: 100013C4
-, xrefs: 100013CF
:, xrefs: 1000115D
*, xrefs: 100013AE
>, xrefs: 100010F0
1, xrefs: 100013FB
;, xrefs: 10001168
0, xrefs: 100013F0
#, xrefs: 10001361
5, xrefs: 10001126
9, xrefs: 10001152
&, xrefs: 10001382
/, xrefs: 100013E5
!, xrefs: 1000134B
), xrefs: 100013A3
8, xrefs: 10001147
, xrefs: 10001340
', xrefs: 1000138D
6, xrefs: 10001131
?, xrefs: 10001110

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262$lstrcpy
String ID: $!$"$#$$$%$&$'$($)$*$+$,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$<$>$?$VUUU
API String ID: 1611889739-3561551665
Opcode ID: e46855ab96d208aa0919aa6072f022ac120e40eb92bef6f217f5988191405041
Instruction ID: 8cabffa663a16b6991171aaa738c89542f520e9d9bfc23d5e5b8b96ced797da2
Opcode Fuzzy Hash: e46855ab96d208aa0919aa6072f022ac120e40eb92bef6f217f5988191405041
Instruction Fuzzy Hash: 9C325AB09293A18BE375CF09C5987DFBAE8FB89B44F10891FE1D986241C7B54645CF82

Function 1000BB70 Relevance: 57.9, APIs: 26, Strings: 7, Instructions: 186
sleepthreadfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007280: wsprintfA.USER32 ref: 100072AE
Part of subcall function 10007280: GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\rundll32.exe,00000104), ref: 100072C5
Part of subcall function 10007280: GetModuleFileNameA.KERNEL32(10000000,C:\Users\user\Desktop\NaRZIOq3O8.dll,00000104), ref: 100072D7
Part of subcall function 10007280: strrchr.MSVCRT ref: 10007305
Part of subcall function 10007280: wsprintfA.USER32 ref: 10007322
Part of subcall function 10007280: wsprintfA.USER32 ref: 10007333
Part of subcall function 10007280: wsprintfA.USER32 ref: 10007344
Part of subcall function 10007280: 6D262DD0.MFC42(00000084), ref: 1000734B

CreateMutexA.KERNEL32(00000000,00000001,M107.163.241.193:6520,10019CD8), ref: 1000BB91
GetLastError.KERNEL32 ref: 1000BB97
PathIsDirectoryA.SHLWAPI(C:\Users\user\Desktop\11121541), ref: 1000BBCD
CreateDirectoryA.KERNEL32(C:\Users\user\Desktop\11121541,00000000), ref: 1000BC01
Sleep.KERNEL32(000007D0), ref: 1000BC17
DeleteFileA.KERNEL32(?), ref: 1000BC1A
CreateThread.KERNEL32(00000000,00000000,100099A0,00000000,00000000,00000000), ref: 1000BC3E
Sleep.KERNEL32(000003E8), ref: 1000BC45
WSAStartup.WS2_32(00000202,?), ref: 1000BC54
CreateThread.KERNEL32(00000000,00000000,10009520,107.163.241.193:6520,00000000,00000000), ref: 1000BC72
CreateThread.KERNEL32(00000000,00000000,1000B700,00000000,00000000,00000000), ref: 1000BC83
Sleep.KERNEL32(00000BB8), ref: 1000BC8A
CreateThread.KERNEL32(00000000,00000000,10009C70,00000000,00000000,00000000), ref: 1000BCCA
CreateThread.KERNEL32(00000000,00000000,1000B7C0,00000000,00000000,00000000), ref: 1000BCDB
Sleep.KERNEL32(00000BB8), ref: 1000BCE2
CreateThread.KERNEL32(00000000,00000000,10005E10,00000000,00000000,00000000), ref: 1000BCF3
CreateThread.KERNEL32(00000000,00000000,100099B0,00000000,00000000,00000000), ref: 1000BD04
Sleep.KERNEL32(000927C0), ref: 1000BD0B
Sleep.KERNEL32(000927C0), ref: 1000BD1B
CreateThread.KERNEL32(00000000,00000000,10009450,00000000,00000000,00000000), ref: 1000BD2C
Sleep.KERNEL32(0000EA60), ref: 1000BD33

Part of subcall function 10005870: LoadLibraryA.KERNEL32 ref: 1000588A
Part of subcall function 10005870: GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 1000589A
Part of subcall function 10005870: GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100058B1

CreateThread.KERNEL32(00000000,00000000,1000BA00,00000000,00000000,00000000), ref: 1000BD44
Sleep.KERNEL32(000000FF), ref: 1000BD48

Part of subcall function 100056F0: StrStrIA.SHLWAPI(?,cmd.exe,774D0F00,?,00000000), ref: 10005706

wsprintfA.USER32 ref: 1000BD75
Sleep.KERNEL32(000007D0), ref: 1000BD9B
DeleteFileA.KERNEL32(?), ref: 1000BDA2

Part of subcall function 10005620: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 1000562A
Part of subcall function 10005620: OpenProcessToken.ADVAPI32(00000000), ref: 10005631
Part of subcall function 10005620: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10005647
Part of subcall function 10005620: AdjustTokenPrivileges.KERNELBASE ref: 1000568A
Part of subcall function 10005620: CloseHandle.KERNEL32 ref: 10005695

Strings

123, xrefs: 1000BBEC
C:\Users\user\Desktop, xrefs: 1000BD66
107.163.241.193:6520, xrefs: 1000BC64
SeDebugPrivilege, xrefs: 1000BBB4
cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s", xrefs: 1000BD6F
C:\Users\user\Desktop\11121541, xrefs: 1000BBC6, 1000BBFC
M107.163.241.193:6520, xrefs: 1000BB88

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create$SleepThread$wsprintf$File$DeleteDirectoryModuleNameProcessToken$AddressAdjustCloseCurrentD262ErrorExtendedHandleLastLibraryLoadLookupMutexOpenPathPrivilegePrivilegesProcStartupTableValuestrrchr
String ID: 107.163.241.193:6520$123$C:\Users\user\Desktop$C:\Users\user\Desktop\11121541$M107.163.241.193:6520$SeDebugPrivilege$cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s"
API String ID: 2415948166-2841148663
Opcode ID: 018e1f2a6cdc16a32f09860ae9f822d303fb44d8efb97839f19e393dd835906d
Instruction ID: 7ac460b640bc8df6dd4afea00a726a4ab02921dc9a65f5646ed82dd80945aab9
Opcode Fuzzy Hash: 018e1f2a6cdc16a32f09860ae9f822d303fb44d8efb97839f19e393dd835906d
Instruction Fuzzy Hash: 6D518E70B8475476F230EB608C4BF8A7A50DB44F91F204519F7497E1D5DBF0B1548AAB

Function 10007E20 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 168
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 10007ECB
strstr.MSVCRT ref: 10007EEF
strcspn.MSVCRT ref: 10007EFE
strstr.MSVCRT ref: 10007F0A
strcspn.MSVCRT ref: 10007F19
strncpy.MSVCRT ref: 10007F22
strstr.MSVCRT ref: 10007F5F
strcspn.MSVCRT ref: 10007F72
strncpy.MSVCRT ref: 10007F82
strcspn.MSVCRT ref: 10007F92
atoi.MSVCRT(?), ref: 10007F99
WSAStartup.WS2_32(00000202,?), ref: 10007FB3
htons.WS2_32(00000000), ref: 10007FC5
socket.WS2_32(00000002,00000001,00000000), ref: 10007FEA
connect.WS2_32(00000000,?,00000010), ref: 10007FFA
closesocket.WS2_32(00000000), ref: 10008006

Strings

http://, xrefs: 10007EC5

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: strcspnstrstr$strncpy$Startupatoiclosesocketconnecthtonssocket
String ID: http://
API String ID: 2221484516-1121587658
Opcode ID: 44d22dc169835b13d51071f1eb418a582025dad4709cce38a998946081ae1d9a
Instruction ID: bc3784d7d81ef269009f725925b13efc19acb8278c31ba2a6c6e4a5a612b11a5
Opcode Fuzzy Hash: 44d22dc169835b13d51071f1eb418a582025dad4709cce38a998946081ae1d9a
Instruction Fuzzy Hash: 6351C3712043456BE320DB34CC85BEBB7D9FF88350F404A29FA9997281DB79D61886A2

Function 10008030 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 10008093
6D262DD0.MFC42(0007D000), ref: 1000809E

Part of subcall function 100050E0: InternetOpenA.WININET(?,?,?,?,?), ref: 100050F9

Strings

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 100080B5
http://blog.sina.com.cn/u/%s, xrefs: 10008087
title, xrefs: 10008237, 10008248

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262InternetOpenwsprintf
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$http://blog.sina.com.cn/u/%s$title
API String ID: 2627167135-1204782975
Opcode ID: dfd9a203dac871dcf9b230ba8f9e42176b09cbb43efbcb095429f1359e1ec5f6
Instruction ID: 0dc96db265ef937b0d0fa70f15691eb36084b8502b1a1f786cdd5324ccd44853
Opcode Fuzzy Hash: dfd9a203dac871dcf9b230ba8f9e42176b09cbb43efbcb095429f1359e1ec5f6
Instruction Fuzzy Hash: DCD15A76A002446FEB14CFA8CC85BFEBBA5FB44290F10426EF95997681DA729E01C791

Function 10005460 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 145
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,774D0F00,?,?,10005746,00000000,self,?,00000000), ref: 100054BC
strrchr.MSVCRT ref: 100054C9
CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000,?,00000000), ref: 10005522
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000000), ref: 10005538
time.MSVCRT(00000000,?,00000000), ref: 1000553F
_localtime32.MSVCRT(?,?,00000000), ref: 1000554E
strftime.MSVCRT ref: 10005561
vsprintf.MSVCRT ref: 100055B3
sprintf.MSVCRT ref: 100055D3
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 100055FD
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 10005604

Strings

log.txt, xrefs: 100054DD
%s%s, xrefs: 100055CD

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerWrite_localtime32sprintfstrftimestrrchrtimevsprintf
String ID: %s%s$log.txt
API String ID: 2392943451-1489102009
Opcode ID: 52cdcfc05b5e2a2109bc0a018a5dd34bdfef92a37fde07e32da0d56ab52059b9
Instruction ID: b92b12cda10bb2cd97a7de79ac6255796b6fed7ae908d87d16a6086495e58579
Opcode Fuzzy Hash: 52cdcfc05b5e2a2109bc0a018a5dd34bdfef92a37fde07e32da0d56ab52059b9
Instruction Fuzzy Hash: 4241D5B1148344AFE328CB74CC999EB77A9EBC8351F404A2DF75A872D0DBB59908C651

Function 1000B7C0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 189
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B80A
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B819
6D262DD0.MFC42(00080000,XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==,XGRyaXZlcnNcZXRjXGhvc3Rz), ref: 1000B88D
Sleep.KERNEL32(000927C0), ref: 1000B942
wsprintfA.USER32 ref: 1000B9C7
Sleep.KERNEL32(000927C0), ref: 1000B9F5

Strings

XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 1000B81B
cmd.exe /c ipconfig /flushdns, xrefs: 1000B9E4
127.0.0.1, xrefs: 1000B9D5
http://107.163.241.186:12354/login.php, xrefs: 1000B8FB
8.8.8.8, xrefs: 1000B9D0
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000B836

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: DirectorySleepSystem$D262wsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$cmd.exe /c ipconfig /flushdns$http://107.163.241.186:12354/login.php
API String ID: 1478259680-42274971
Opcode ID: 8e9196231dcfb8476761a53707d50ac412fe7b967630b0d11d4226dfc570b8ce
Instruction ID: 5bded651d412340725d0a4c63ae39483ba610a665616dbfa0bfcbea02e9b2bc5
Opcode Fuzzy Hash: 8e9196231dcfb8476761a53707d50ac412fe7b967630b0d11d4226dfc570b8ce
Instruction Fuzzy Hash: 25516E71514A486BE364CA34CCA1BEB3BC6EB953A0F104A3DF786872D5ED71D948C292

Function 10009450 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6D262DD0.MFC42(00001218), ref: 1000945F
WSAStartup.WS2_32(00000202,?), ref: 10009473

Part of subcall function 10005080: CreateMutexA.KERNEL32(?,?,?,10009555), ref: 1000508F

GetLastError.KERNEL32 ref: 1000948C
CloseHandle.KERNEL32(00000000), ref: 100094FE

Part of subcall function 10008030: wsprintfA.USER32 ref: 10008093
Part of subcall function 10008030: 6D262DD0.MFC42(0007D000), ref: 1000809E

Sleep.KERNEL32(0002BF20,00000000,00000000), ref: 100094C0
CreateThread.KERNEL32 ref: 100094DC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 100094E7
CloseHandle.KERNEL32(00000000), ref: 100094EE
Sleep.KERNEL32(0002BF20), ref: 100094F9

Strings

5655029807, xrefs: 100094AA
0x5d65r455f, xrefs: 10009479

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateD262HandleSleep$ErrorLastMutexObjectSingleStartupThreadWaitwsprintf
String ID: 0x5d65r455f$5655029807
API String ID: 3959575285-1179119988
Opcode ID: 578a8b3bfa932a769acf868f9e4ec53adfd9d175f8e518d4df08ae5bf0750ec9
Instruction ID: 5e1dba5c7bc71828a1d61e85a2d88ef44d6a5280b45a2a65baa4fdc2c608d569
Opcode Fuzzy Hash: 578a8b3bfa932a769acf868f9e4ec53adfd9d175f8e518d4df08ae5bf0750ec9
Instruction Fuzzy Hash: C411F5B66402247BF750D7A49C8FFEB3648DB48795F004234FF08991C6DB75992582A7

Function 10007750 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,100199D8), ref: 1000777F
GlobalMemoryStatusEx.KERNEL32(?), ref: 10007839
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,100199D8), ref: 10007892

Part of subcall function 10005360: RegQueryValueExA.KERNEL32(?,?,?,?,?,00000000,100077BC), ref: 1000537E

Part of subcall function 10005350: RegCloseKey.KERNEL32(100199D8,100077C6,?), ref: 10005355

Strings

ProcessorNameString, xrefs: 100077A1
11121541, xrefs: 10007867
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10007762
@, xrefs: 10007830
Find CPU Error, xrefs: 100077F1
http://107.163.241.186:12354/login.php, xrefs: 10007915
%u MB, xrefs: 1000785C

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDefaultGlobalLanguageMemoryOpenQueryStatusSystemValue
String ID: %u MB$11121541$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.163.241.186:12354/login.php
API String ID: 2543995030-3015006635
Opcode ID: fc7d72a152619b582a3fefedd51e004960f2eda1014b792e2f96d369dc7e128d
Instruction ID: c5dd48205e3bca1180acbc7f94ac086bba4f0d0af77615eae8fb4fb729731d8a
Opcode Fuzzy Hash: fc7d72a152619b582a3fefedd51e004960f2eda1014b792e2f96d369dc7e128d
Instruction Fuzzy Hash: 854117766042005BE718CA38CC45BAB77D5FBC8350F944A2CFA59CB2C5EE78EA09C791

Function 1000BA00 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 108
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 1000BA67
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 1000BA9D
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,?), ref: 1000BB0C
StrStrIA.SHLWAPI(00000000,svchsot.exe), ref: 1000BB1E
RegDeleteValueA.ADVAPI32(00000000,00000000), ref: 1000BB35
RegCloseKey.ADVAPI32(00000000), ref: 1000BB4D
Sleep.KERNEL32(000493E0), ref: 1000BB58

Strings

svchsot.exe, xrefs: 1000BB18
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 1000BA5D

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Value$CloseDeleteEnumInfoOpenQuerySleep
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$svchsot.exe
API String ID: 2160694657-2172464104
Opcode ID: 4e27199c7ad9a2771cfa9659ddadbab6851e6264533792b6733e40e2567ba759
Instruction ID: 9cde71c0bbbc315761c064880cf2f3fcda6eb6ddb1b00218362d2001d0698cab
Opcode Fuzzy Hash: 4e27199c7ad9a2771cfa9659ddadbab6851e6264533792b6733e40e2567ba759
Instruction Fuzzy Hash: 9C311E71205341ABE315CF55CD84FABB7E9FBC8B44F404A2DF28596245D770EA05CBA2

Function 1000C340 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Netbios.NETAPI32 ref: 1000C37F
Netbios.NETAPI32(?), ref: 1000C3BB

Strings

%02X%02X%02X%02X%02X%02X, xrefs: 1000C4B8
3, xrefs: 1000C41E
2, xrefs: 1000C3B2

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$2$3
API String ID: 544444789-1505804699
Opcode ID: af20756df40ebd6339beb114ddc91ef19d7f3563555a5a83e0a027d6d8b1a0ce
Instruction ID: ce6d5c193f772186174b1e4aad9d2ff49001eec6116d7ace393251796c525a04
Opcode Fuzzy Hash: af20756df40ebd6339beb114ddc91ef19d7f3563555a5a83e0a027d6d8b1a0ce
Instruction Fuzzy Hash: 1E41B0321187869BD725CA18C8407FBB7D5EFC4350F04487DB5D48B682EAB9E609C793

Function 10009520 Relevance: 10.5, APIs: 7, Instructions: 46
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 10009534

Part of subcall function 10005080: CreateMutexA.KERNEL32(?,?,?,10009555), ref: 1000508F

GetLastError.KERNEL32 ref: 1000955A
CreateThread.KERNEL32(00000000,00000000,100091C0,?,00000000,00000000), ref: 10009580
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10009587
CloseHandle.KERNEL32(00000000), ref: 1000958A
Sleep.KERNEL32(00002710), ref: 10009595
CloseHandle.KERNEL32(00000000), ref: 1000959E

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandle$ErrorLastMutexObjectSingleSleepStartupThreadWait
String ID:
API String ID: 3243752880-0
Opcode ID: 17ecd922373021ccc26ed0776112388b15e0fc03dd09d5e994e296d1f773db05
Instruction ID: f421bb569ff3a6cc1cd0ae4f97cefabef7536e0662718203c2adf22941bcd44e
Opcode Fuzzy Hash: 17ecd922373021ccc26ed0776112388b15e0fc03dd09d5e994e296d1f773db05
Instruction Fuzzy Hash: C0012875244220BBF62197618C4EFDF3B28EB8D791F500220FB18961C2C775A914C3B6

Function 10009C70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128sleepCOMMON

Download Yara Rule

APIs

6D262DD0.MFC42(00080000), ref: 10009C7F
Sleep.KERNEL32(000927C0), ref: 10009D2C
wsprintfA.USER32 ref: 10009DC2
Sleep.KERNEL32(000927C0,10019AF0), ref: 10009DD6

Strings

http://107.163.241.186:12354/login.php, xrefs: 10009CE3

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$D262wsprintf
String ID: http://107.163.241.186:12354/login.php
API String ID: 1791923907-2223919147
Opcode ID: 694391d3b39d992574a20db0da015c0f38dc4f3f9208cd7deb46858057425b11
Instruction ID: 96d5f2fb8650a78ccf418842dd4e97db4fe2b4609ab24aaa4029efad7a9bdec8
Opcode Fuzzy Hash: 694391d3b39d992574a20db0da015c0f38dc4f3f9208cd7deb46858057425b11
Instruction Fuzzy Hash: 07318D319446956BF320CA34CC62BDB37D9EB463D0F114A2DF78587185EA36E848C293

Function 10011181 Relevance: 3.8, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100111AF
_initterm.MSVCRT ref: 100111DA
free.MSVCRT ref: 10011217

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID:
API String ID: 1678931842-0
Opcode ID: 89a88f4e84c4b1e58b0e9ea1bbdff44fa1b2eeffde783faa751c3280ef985327
Instruction ID: a3f3e8324c5b3e50e68b642cab27e3164d803a3a377d102eee1bb53c49589baa
Opcode Fuzzy Hash: 89a88f4e84c4b1e58b0e9ea1bbdff44fa1b2eeffde783faa751c3280ef985327
Instruction Fuzzy Hash: 8E11FA32645226AFF72CCBA8EE94E9977E5EB08391B118019E901CB160E735E8908B54

Function 10002D40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6EBC0000,00000000), ref: 10002D64

Strings

TmV0TG9jYWxHcm91cEVudW0=, xrefs: 10002D50

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0TG9jYWxHcm91cEVudW0=
API String ID: 190572456-980335172
Opcode ID: 3f2d0679c1c961da4bf78d4d4b53a185f0cc3ff58a33cb7d87503068401a1db2
Instruction ID: 426e6b0573956a2a964d800dfb9f5cedc638600491c3979137d1d50aff8110e9
Opcode Fuzzy Hash: 3f2d0679c1c961da4bf78d4d4b53a185f0cc3ff58a33cb7d87503068401a1db2
Instruction Fuzzy Hash: A1C08CF48002205BF641CB648C88B0932A8E30C28AB008010F50DD222AD630E2848721

Function 10002E00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6EBC0000,00000000), ref: 10002E24

Strings

TmV0QXBpQnVmZmVyRnJlZQ==, xrefs: 10002E10

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0QXBpQnVmZmVyRnJlZQ==
API String ID: 190572456-3244026974
Opcode ID: 3fadc47ae94f51a42844ab3558ef58d288ba066830200869926fcfa67396abfa
Instruction ID: 2fae8953d5955be7595a5657c67f85d266c220fedc191ac5fad8892b6c7ec77a
Opcode Fuzzy Hash: 3fadc47ae94f51a42844ab3558ef58d288ba066830200869926fcfa67396abfa
Instruction Fuzzy Hash: 45C08CF88002505BF681CBA0CC88B0632A9E30C28A7008024F849C221BD634E2E48721

Function 1000B700 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000B3C0: lstrcpy.KERNEL32(00000000,?), ref: 1000B3F4
Part of subcall function 1000B3C0: lstrcat.KERNEL32(00000000,10019C10), ref: 1000B40D
Part of subcall function 1000B3C0: lstrcat.KERNEL32(00000000,*.*), ref: 1000B41C
Part of subcall function 1000B3C0: FindFirstFileA.KERNEL32(00000000,?), ref: 1000B42E

Sleep.KERNEL32(0036EE80), ref: 1000B7A6

Strings

C:\Program Files, xrefs: 1000B709

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindFirstSleeplstrcpy
String ID: C:\Program Files
API String ID: 187370985-1387799010
Opcode ID: c210b9063764c7f6096e7048406087fc1d266cba2aab8d6c671f5bab15b8f448
Instruction ID: 34d684334c7274c303d5a2eab8ad17a067ee82296af27424734a78a44ff59643
Opcode Fuzzy Hash: c210b9063764c7f6096e7048406087fc1d266cba2aab8d6c671f5bab15b8f448
Instruction Fuzzy Hash: A2115E789097598BF304DF6998C154BBBE0FB85784F108929F88983316EB71DA498BD2

Function 10005310 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 1000533D

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 797ccceb2a6220eaf1b4da9278694c3052d15d15b886ab40c5ba1907cad651cd
Instruction ID: f0b58f1054efd69a3b3c561961df13c78b53d0028abc68edc269c93d18d29df8
Opcode Fuzzy Hash: 797ccceb2a6220eaf1b4da9278694c3052d15d15b886ab40c5ba1907cad651cd
Instruction Fuzzy Hash: 23E00AB5218601AF9604CF49C994D1BB3F9ABCC700F10CA0CB599C3254D630E806CB62

Function 10005100 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,?,00000000), ref: 1000511E

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 79fb8dd1e416200e2006b02a81ba11ca3d168ec2f8ff613b71efe962d633b550
Instruction ID: b03028c7f8be2f45730d069a64a3eb3b23702ea1336b4465e57dd578e4720c79
Opcode Fuzzy Hash: 79fb8dd1e416200e2006b02a81ba11ca3d168ec2f8ff613b71efe962d633b550
Instruction Fuzzy Hash: 91D0BCB5618342AFD708CF58D994D3BB7E9BBC8600F188D0CB59583254D730E849CB62

Function 10005360 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,?,?,?,?,00000000,100077BC), ref: 1000537E

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9aa5dfaef623244c62c00e6734dd321eea35094b4d860f5643c27326aa40c040
Instruction ID: a74c4bf4350e4793b53797d283791a1897b8d7f4ca6b0b58efb56db84ac5c6a9
Opcode Fuzzy Hash: 9aa5dfaef623244c62c00e6734dd321eea35094b4d860f5643c27326aa40c040
Instruction Fuzzy Hash: 55D0BCB5618352AF9704CF58D994D3BB7E9BBC8600F148D0CB5A583254D770E849CB72

Function 100053B0 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,?,?), ref: 100053CE

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bd36dcca12709300afda0dce087f67a4daa03fa626df9e30e4f30e72f73358e9
Instruction ID: 545330c7644c0352da8339c59963a64c4c0f3ddebddf9092b34a8f3a8fbdc6b4
Opcode Fuzzy Hash: bd36dcca12709300afda0dce087f67a4daa03fa626df9e30e4f30e72f73358e9
Instruction Fuzzy Hash: 51D06CB5208382AF9704CF98C884C3BB3E9BBC8600F048D0CB59583210C730E808CB62

Function 10009ABD Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

6D262DD0.MFC42(00080000), ref: 10009AD7

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262
String ID:
API String ID: 1394008445-0
Opcode ID: c32c3222084e50551be5b3dd1d5fbdfa23b4dfe8b4897024deef5f29e3ecea09
Instruction ID: 587057179f6ea8c11798d24fe955b4de24e5558434809c040a74657806c4aeb1
Opcode Fuzzy Hash: c32c3222084e50551be5b3dd1d5fbdfa23b4dfe8b4897024deef5f29e3ecea09
Instruction Fuzzy Hash: 4FD01278908710EBD190EB59B9921AEB291FF00240F944069FDD45B712E2709A589B67

Function 100050E0 Relevance: 1.5, APIs: 1, Instructions: 12networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,?,?,?), ref: 100050F9

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 879c65d6f26f338801834b9cd5808f4cc1cf4df936376d16fc6ebb1aa6ac17b0
Instruction ID: 044530a7792eeb6987733a37bd1277e0a1591d4b183eda353221cda114360c91
Opcode Fuzzy Hash: 879c65d6f26f338801834b9cd5808f4cc1cf4df936376d16fc6ebb1aa6ac17b0
Instruction Fuzzy Hash: 14D0C5F9218201AFDA08CB58D994C2BB3E9ABC8710F00CA0CB5A983244C630E804CB62

Function 10005390 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,000F003F,00000000,10005862,80000000,00000000,00000000,000F003F,?,QXBwbGljYXRpb25zXFxWTXdhcmVIb3N0T3Blbi5leGU=,?,1000BD12), ref: 100053A9

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b365e116d62356edbac829584962df87571ad8eae1ae707586eda98c8ac89151
Instruction ID: d6aabc516d543bdc87cc0c4a5e1d9a174d5608901055bf3910c018a9f96aa6ad
Opcode Fuzzy Hash: b365e116d62356edbac829584962df87571ad8eae1ae707586eda98c8ac89151
Instruction Fuzzy Hash: 05D0C5B9218201AFAA18CB58D994D2BB3EAABC8710F00C90CB5A983240C634E844CB32

Function 10005080 Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10009555), ref: 1000508F

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: fdb6fa81ec76c1724b80fca2210392765ef5a25415d8d2b79c16f2728e524eba
Instruction ID: 65ecd0d9e123e5c59dbe5454a5e8d83e6f765d425f52b2c6b9e17714dbbc7e55
Opcode Fuzzy Hash: fdb6fa81ec76c1724b80fca2210392765ef5a25415d8d2b79c16f2728e524eba
Instruction Fuzzy Hash: EFC048B8608200BFEA04CB10C988C2BB7A9EBC8620F10C90CB88983210C670FC40DA22

Function 10005260 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 1000526F

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: c1f1c3dc28f6a40e27559f1a23b5eb1c7877f6347995135ce4b953c13975f4ef
Instruction ID: 0c1c8b250da901cb55db93dd3a23e7b623ab8ec60d836218a20953e263ce1084
Opcode Fuzzy Hash: c1f1c3dc28f6a40e27559f1a23b5eb1c7877f6347995135ce4b953c13975f4ef
Instruction Fuzzy Hash: C3C04CB8208200BFEA04CB10C984C2BB7B9EBC8610F00C90CB88942211C634EC40DA11

Function 10005400 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(?,?), ref: 1000540A

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 7da1f6548b6cdf32f07d888ab53a94aa8a28520b62a2054868ec8d135c91c293
Instruction ID: 9d9cdc26d7b2138dada01c5f17ffc5f241ad811d55aab60bc3c65502b5f92e19
Opcode Fuzzy Hash: 7da1f6548b6cdf32f07d888ab53a94aa8a28520b62a2054868ec8d135c91c293
Instruction Fuzzy Hash: CBB092B5204200ABD204DB10CA88C2BB7A8ABD4310B008808B48D82155C634D840CB21

Function 10005420 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,?), ref: 1000542A

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 9645eb27314659e76ee4f0e7963ffa02cae01bc347750a30513afb982d5bd179
Instruction ID: d3ad5189f9af5431b8854f2ef1100ff7cc61f3f67fb8f5bf956713fc7da7eafb
Opcode Fuzzy Hash: 9645eb27314659e76ee4f0e7963ffa02cae01bc347750a30513afb982d5bd179
Instruction Fuzzy Hash: F3B09275104200ABD204DB10C988C2BB7A8BBD5320B008808B48982114C630D840CB21

Function 10001C90 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04603060), ref: 10001CA6

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 349a52fe4ec56f5007f733bfb711c7e24146eda3fe89fc2105d0191a92a3d262
Instruction ID: df90cce034d612537076caa3fd0af17fcb468ffd39476ea18b5eb170f5c43ea3
Opcode Fuzzy Hash: 349a52fe4ec56f5007f733bfb711c7e24146eda3fe89fc2105d0191a92a3d262
Instruction Fuzzy Hash: 07B092B08042218BF7028BB08CC880636F4EB49291390C001F800C3268D630C190AB10

Function 10001CF0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04601050), ref: 10001D06

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f10a7fb5942bbca60558dcd1b8d21a04968260cf0da91b97d87524df02f376b
Instruction ID: f802966c49025ed24f5dfcae2a34028557c535da5cca920b77e83a15a8301d7e
Opcode Fuzzy Hash: 6f10a7fb5942bbca60558dcd1b8d21a04968260cf0da91b97d87524df02f376b
Instruction Fuzzy Hash: C0B092B08041219BE6028F608C8854636B4F30A2927008142F800C3269D734C1409B50

Function 10001D50 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(02E4D020), ref: 10001D66

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7704f734579a44c24fc2d8682553fbb1bb896e7c5fedc15cd7cb79516a391f31
Instruction ID: 60874214be4d57f326dacb7e6344f8791809096cf298a624f2bb173eefc3e03f
Opcode Fuzzy Hash: 7704f734579a44c24fc2d8682553fbb1bb896e7c5fedc15cd7cb79516a391f31
Instruction Fuzzy Hash: 9DB092F48082208BE7118F60CCC840636F8E309241710C042F800C3268D630C1809B60

Function 10001DE0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(02E4A008), ref: 10001DF6

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7415d86445ea757eda86d45ef76e75ba70a3b4dc527e37764ac3ce15c6c6f6b8
Instruction ID: 33e969e0cce234b8e2dc56f93697a814ecb1d2ff4abf69a4308ee9ff2ee69fd3
Opcode Fuzzy Hash: 7415d86445ea757eda86d45ef76e75ba70a3b4dc527e37764ac3ce15c6c6f6b8
Instruction Fuzzy Hash: EEB092B0804221AFE6018FA48C8844A36F4E309241300C016F811C3266D630C2809F10

Function 10001ED0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(02E44FE0), ref: 10001EE6

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a1cf710aa06efddbf5582b16c7a08f845a8a09f0093749ab9bf0b6c54297a50b
Instruction ID: 5cc36d7040b06f7588df96cbbe99990be96b5a8160bdef7ffb22b6720cd30e56
Opcode Fuzzy Hash: a1cf710aa06efddbf5582b16c7a08f845a8a09f0093749ab9bf0b6c54297a50b
Instruction Fuzzy Hash: 5EB092F4900220CBE702CFA0CCC840A37F4E309281310C002F800C3224DA30C084DB10

Function 10005050 Relevance: 1.5, APIs: 1, Instructions: 4networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(100199D8), ref: 10005055

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 5fd300ce534cf0c8e4c88e819e590fe2992713f024bae53166e521b5d0b5ec67
Instruction ID: 4d598b9766fe6ceed8e3f718e2d75ee1a402bc02d4500a7f172e39c4eafe6b48
Opcode Fuzzy Hash: 5fd300ce534cf0c8e4c88e819e590fe2992713f024bae53166e521b5d0b5ec67
Instruction Fuzzy Hash: E7A002B5A04210ABEE01DBA5CB8C90B77E8AB85705B008848F15DC2011C678D940DB11

Function 10005180 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(774C8A60,100075DB,?,?,%s\lang.ini,C:\Users\user\Desktop), ref: 10005185

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: f971ba6882d4ca19cd20fd8b60212cd3edd8a8fe937c18e82f44fbfb101f1016
Instruction ID: 118c78c0c9695d8a551b4ba886d12ad375b1458bb0a4dea99dd650c7c563ecf2
Opcode Fuzzy Hash: f971ba6882d4ca19cd20fd8b60212cd3edd8a8fe937c18e82f44fbfb101f1016
Instruction Fuzzy Hash: 51A002B5A04210ABDE10DBA5CB8C80A77E8AB95701B048844F149C2011C678D880DB11

Function 10005280 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(10019C34,1000B786,10019C34), ref: 10005285

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 87301e1af61e2e41f1f6383ad11ae2e1a279f747f4b669202c44d7fdfc61eaef
Instruction ID: a0a788f3a0a4ab41634461f5791a3083b2ff699e0ce9ca5fdf73c56e4fc6de61
Opcode Fuzzy Hash: 87301e1af61e2e41f1f6383ad11ae2e1a279f747f4b669202c44d7fdfc61eaef
Instruction Fuzzy Hash: C0A00275D08610ABDF00DBF4CA8C81A77F9AB89741B40C844F155D2110C634D840DF11

Function 10005350 Relevance: 1.5, APIs: 1, Instructions: 4registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(100199D8,100077C6,?), ref: 10005355

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 789b69af8a6c9098e4647c1b3afcf07e56411a0a888967a2e99320c4219e37c5
Instruction ID: 9a5c7de402fddbdbfe160585b93185f668ef75bcfd4763a99ab0458e81967846
Opcode Fuzzy Hash: 789b69af8a6c9098e4647c1b3afcf07e56411a0a888967a2e99320c4219e37c5
Instruction Fuzzy Hash: 02A002B5A08610AFDF00DBA5CB8C80A7BF9AB85701B008844F149C2011C678D840DB11

Non-executed Functions

Function 10006240 Relevance: 63.5, APIs: 24, Strings: 12, Instructions: 473memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 1000627D
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 1000628E
CoCreateInstance.COMBASE(Function_000141D0,00000000,00000001,10014100,10019B34), ref: 100062AE
6D262DD0.MFC42(0000000C), ref: 100062BA
SysAllocString.OLEAUT32(?), ref: 100062E1
CoSetProxyBlanket.COMBASE(6C0BC1CB,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 10006368
wcscat.MSVCRT ref: 100063A3
6D262DD0.MFC42(0000000C), ref: 100063AB
SysAllocString.OLEAUT32(iguration.Index=), ref: 100063D3
6D262DD0.MFC42(0000000C), ref: 1000642F
VariantInit.OLEAUT32(ultIPGateway), ref: 10006512
VariantInit.OLEAUT32(SetGateways), ref: 10006519
VariantInit.OLEAUT32(tworkAdapterConfiguration.Index=), ref: 10006520
6D262DD0.MFC42(0000000C), ref: 10006596
SysAllocString.OLEAUT32(79617765), ref: 100065BE
InterlockedDecrement.KERNEL32(00000008), ref: 10006668
_strcmpi.MSVCRT ref: 10006685
6D262DD0.MFC42(0000000C), ref: 100066B4
SysAllocString.OLEAUT32(654E5F32), ref: 100066DC
InterlockedDecrement.KERNEL32(00000008), ref: 10006789
StrStrIA.SHLWAPI(1001A364,svchost.exe -k NetworkService), ref: 100067A9
VariantClear.OLEAUT32(ultIPGateway), ref: 100067D2
VariantClear.OLEAUT32(SetGateways), ref: 100067D9
CoUninitialize.OLE32 ref: 10006803

Strings

svchost.exe, xrefs: 1000667F
WQL, xrefs: 10006449, 1000645F
wayCostMetric, xrefs: 100064F1
flushdns, xrefs: 1000626E
SetGateways, xrefs: 10006518, 10006549, 100067D8
svchost.exe -k NetworkService, xrefs: 100067A3
SELECT * FROM , xrefs: 10006373
Name, xrefs: 10006534
CommandLine, xrefs: 1000654B
ultIPGateway, xrefs: 10006511, 1000652C, 100067D1
tworkAdapterConfiguration.Index=, xrefs: 1000651F, 10006560
ProcessID, xrefs: 10006562

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262Variant$AllocString$Init$ClearDecrementInitializeInterlocked$BlanketCreateInstanceProxySecurityUninitialize_strcmpiwcscat
String ID: CommandLine$Name$ProcessID$SELECT * FROM $SetGateways$WQL$flushdns$svchost.exe$svchost.exe -k NetworkService$tworkAdapterConfiguration.Index=$ultIPGateway$wayCostMetric
API String ID: 2874424801-756481962
Opcode ID: 1bb00c3f93f4a7b639d82edecc7658e22878ec0fd9d7bca1c454a458c29ec668
Instruction ID: 1f835a4d0faa9fc020e65b56cf2e9a4dfb5885ebfc35db84a98710ed097cd709
Opcode Fuzzy Hash: 1bb00c3f93f4a7b639d82edecc7658e22878ec0fd9d7bca1c454a458c29ec668
Instruction Fuzzy Hash: 8D02A2B1504345AFE720DF64CC80A9EB7E9FB88394F108A2DF5999B280DB71DD44CB92

Function 10008880 Relevance: 58.0, APIs: 24, Strings: 9, Instructions: 270serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,772EC650,00000000), ref: 10008927
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 10008966
GetLastError.KERNEL32 ref: 10008970
OpenServiceA.ADVAPI32(00000000,?,000F01FF), ref: 10008984

Strings

SYSTEM\CurrentControlSet\Services\%s, xrefs: 100089B7
%SystemRoot%\System32\svchost.exe -k , xrefs: 100088C5
RegSetValueEx(ServiceDll), xrefs: 10008A7F
RegSetValueEx(Svchost\krnlsrvc), xrefs: 10008B31
RegOpenKeyEx(Svchost), xrefs: 10008AF4
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 10008AAA
Description, xrefs: 100089EB
ServiceDll, xrefs: 10008A5D
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 10008A0D

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: OpenService$CreateErrorLastManager
String ID: %SystemRoot%\System32\svchost.exe -k $Description$RegOpenKeyEx(Svchost)$RegSetValueEx(ServiceDll)$RegSetValueEx(Svchost\krnlsrvc)$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 2857751478-660433390
Opcode ID: 7bee34f355b2868c88db09174060a769cc1a21acf3b1f20f2e0e65ce036f74e8
Instruction ID: 80a349a1c7f2a3681a728849bd2a1506b88036c9e14b74da46397a96899aa474
Opcode Fuzzy Hash: 7bee34f355b2868c88db09174060a769cc1a21acf3b1f20f2e0e65ce036f74e8
Instruction Fuzzy Hash: 4E9193B1A00218ABEB15DB64CC45BEE77A9FB88750F118259FA05E72C0DBB4DE40CB61

Function 100068C0 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 94stringCOMMON

Download Yara Rule

APIs

6D262DD0.MFC42(00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000,00000000,00000000), ref: 100068FA
6D262DD0.MFC42(000000FF,00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000,00000000), ref: 10006913
6D262DD0.MFC42(00000000,000000FF,00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000), ref: 1000692D
strrchr.MSVCRT ref: 1000693E
strncpy.MSVCRT ref: 10006955
strncpy.MSVCRT ref: 1000695F
GetSystemInfo.KERNEL32(GatewayCostMetric,?,?,?,?,?,?,00000000,10009DD0), ref: 10006969
GetCurrentProcess.KERNEL32(00000020,chOrder,?,?,?,?,?,?,00000000,10009DD0), ref: 1000698A
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,00000000,10009DD0), ref: 10006991
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,10009DD0), ref: 100069A2
AdjustTokenPrivileges.ADVAPI32(00000000,00000000), ref: 100069D7
CloseHandle.KERNEL32(44746553), ref: 100069E2
sscanf.MSVCRT ref: 10006A0D

Strings

C:\Users\user\Desktop, xrefs: 10006934
etc\hosts, xrefs: 100069E8, 10006A08
SeDebugPrivilege, xrefs: 1000699C
chOrder, xrefs: 10006981
GatewayCostMetric, xrefs: 10006968
%[^, xrefs: 10006A03

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262$ProcessTokenstrncpy$AdjustCloseCurrentHandleInfoLookupOpenPrivilegePrivilegesSystemValuesscanfstrrchr
String ID: %[^$C:\Users\user\Desktop$GatewayCostMetric$SeDebugPrivilege$chOrder$etc\hosts
API String ID: 1467661837-3828570706
Opcode ID: c6ea22cdf2f45c65aded0bf148d4135de5c60637ac9b3aef5171a31b4b18fe73
Instruction ID: 8e8dcdebdd68835a8d22dd71999f00dbe430d832e2cb33c79149909b2ad15fb4
Opcode Fuzzy Hash: c6ea22cdf2f45c65aded0bf148d4135de5c60637ac9b3aef5171a31b4b18fe73
Instruction Fuzzy Hash: A1313BB4905321AFE310DF69CDC9A567BE8FB8E310F00851EFA4987261D7B9D485CB21

Function 100103B0 Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 619COMMON

Download Yara Rule

Strings

/, xrefs: 10010488
U, xrefs: 100106E4
T, xrefs: 100106E9

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: /$T$U
API String ID: 0-733984016
Opcode ID: 26c6bb479a735e41787d1c855f490b5051d387b0f4123a6ad5da299e4ffc3d58
Instruction ID: 0af6b09eb13da6613914ca18b4293f2e930e745bf8d0b97389fd89aabda86cff
Opcode Fuzzy Hash: 26c6bb479a735e41787d1c855f490b5051d387b0f4123a6ad5da299e4ffc3d58
Instruction Fuzzy Hash: BC22DF357083858BD714CE2898906AFBBE1EFC5350F14492EF9C58B382DAB5D989C792

Function 10005A50 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 136fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10005AE3
wsprintfA.USER32 ref: 10005B25
FindNextFileA.KERNEL32(?,?,?,?,?,00000000,?,?,00000000), ref: 10005BCA
FindClose.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 10005BDD

Strings

\*.*, xrefs: 10005AAB
., xrefs: 10005B49
%s\%s, xrefs: 10005B1F

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$.$\*.*
API String ID: 180737720-2210278135
Opcode ID: fd0c06f5e656c0ca6a1207c5c9b4d901a9358243d8fd2179b47a31ede6763e51
Instruction ID: 41b8f4281efce6065b0411dfc6bcae962f58c9dcddea6dda85180880c775b3fd
Opcode Fuzzy Hash: fd0c06f5e656c0ca6a1207c5c9b4d901a9358243d8fd2179b47a31ede6763e51
Instruction Fuzzy Hash: BA41E5721083446BD329CA78DC44AABB7D9FBC8350F444F1DF59A93281DBB5EA08CB52

Function 10007420 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 10007462
sprintf.MSVCRT ref: 10007586

Strings

Vista, xrefs: 10007502
Win %s SP%d, xrefs: 10007580
2003, xrefs: 100074EB
2008, xrefs: 1000752F
2000, xrefs: 100074BA

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Versionsprintf
String ID: 2000$2003$2008$Vista$Win %s SP%d
API String ID: 1728264858-2264339393
Opcode ID: 4f04bac56193650fc19eb336d9672af16f67b333fc106226f85362a7a82feba5
Instruction ID: 8d9624ca7b0e334ee449c93b415b4ae454ddf9d58a1d32c6b67a005c4f57db36
Opcode Fuzzy Hash: 4f04bac56193650fc19eb336d9672af16f67b333fc106226f85362a7a82feba5
Instruction Fuzzy Hash: D531D531A047445BE724C524C891A9BB7D6F7C4360F918A2DEE5AC7385DAB8DD098642

Function 10010050 Relevance: 3.1, APIs: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 10010085
SystemTimeToFileTime.KERNEL32(?,?), ref: 10010095

Part of subcall function 1000F760: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?), ref: 1000F76D

Part of subcall function 1000F730: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000F74C

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: ed7d6a687863316638af9b4b05be9f9b42821b15d02c911e347a352490ce8edc
Instruction ID: df2849aa1dc12c0f5487544b9b495675c1762f2cfe66b261c015e5e036936da4
Opcode Fuzzy Hash: ed7d6a687863316638af9b4b05be9f9b42821b15d02c911e347a352490ce8edc
Instruction Fuzzy Hash: 0821B2B5914B419FD364CF69C881A67BBE4FB88604F008E2EE5DAC3611E774E509CB52

Function 1000EED0 Relevance: 2.9, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

K, xrefs: 1000EEF3
P, xrefs: 1000EEE4

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction ID: 98d1436c1d12383d330a33e8837fd7373f2bd8dcf5064c5ac92bb59d1160ce8b
Opcode Fuzzy Hash: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction Fuzzy Hash: 8AD18D30119381AFD621CB698CC0EABFBF9AFDAB00F444D0DF6D583291D6A1E5498762

Function 1000EAE0 Relevance: 2.8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

PTU, xrefs: 1000EAFB, 1000EB01
K, xrefs: 1000EB03

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$PTU
API String ID: 0-3860820754
Opcode ID: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction ID: b75c2c7393efce8f34ebcfbcfaf34b01291ef2e5bdad3d1dcf9c2601cb2aebd7
Opcode Fuzzy Hash: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction Fuzzy Hash: C791913011A3856EDB04DB688CC0E9BFBED9FD6704F04494EFA809B296D5E1D549CBB2

Function 100052E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,00000000,100079BE), ref: 100052FE

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: d54e74ece54ee20424641922b2b5810720bfc680afc0c90e10e7fcf085b7feb0
Instruction ID: 7c1a2bbd7757006d5c946c3e80e0d766e9fd4947b997df4eed36b7743c05efd3
Opcode Fuzzy Hash: d54e74ece54ee20424641922b2b5810720bfc680afc0c90e10e7fcf085b7feb0
Instruction Fuzzy Hash: 87D0BCB5618742AF9704CF58D994C3BB7EABBCC600F148D0CB59583254D730E849CB62

Function 10005160 Relevance: 1.5, APIs: 1, Instructions: 6shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(?,00000000), ref: 1000516A

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: f32a497f43df2c1907ad6a4c0e45c824a67bd738c1fb00097a1c7dc51b4314dc
Instruction ID: 3d1d98dc7dfc941cc0ac06cd550d9a2c3aa2a9b641fa0ba9a55bbc5b6fa54b5c
Opcode Fuzzy Hash: f32a497f43df2c1907ad6a4c0e45c824a67bd738c1fb00097a1c7dc51b4314dc
Instruction Fuzzy Hash: 3BB012B4204300BFDE04CB10CA88C2B77ECEBC4300F00880CF48A82110C638DC40CB11

Function 1000DAF0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

bad d_code, xrefs: 1000DBEE

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: bad d_code
API String ID: 0-2582332627
Opcode ID: fc44b8c4038ebeeeda07eb89f8e529569e6f123d0d3217017c0b5f9ecc597cae
Instruction ID: 665bd046f07fd8db9b7779670f0409ca2859fa848a28491a6d1a111cb4859fc9
Opcode Fuzzy Hash: fc44b8c4038ebeeeda07eb89f8e529569e6f123d0d3217017c0b5f9ecc597cae
Instruction Fuzzy Hash: 7141E0751082429FE314EF69D841AFFB7E5EFC8244F45846EF9858B205EB30E906C7A2

Function 1000F460 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8bfaf921686b3efd01c1dd03c9d08ec0da7e696f39a6730f007d051e803caa
Instruction ID: 4a2e9bce1860761ec30e66eaab1871a96e7508891839d0c178a78bfd6cadc41c
Opcode Fuzzy Hash: 7e8bfaf921686b3efd01c1dd03c9d08ec0da7e696f39a6730f007d051e803caa
Instruction Fuzzy Hash: 6F3192227AA0A207E344CEBD9CC4237BBD3DBCA286B6DC67CD584D7A0ED439D8074250

Function 10022EE7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f099c7322ba76fb5435672a37167c125e68f3adee88f7279b6dfaf27b937c7b
Instruction ID: 008e985e2b74be79368dc7b4926150b44706faffcaa7039d4d8544b292557155
Opcode Fuzzy Hash: 1f099c7322ba76fb5435672a37167c125e68f3adee88f7279b6dfaf27b937c7b
Instruction Fuzzy Hash: 90F0283440C6539B8B11DF3898905EEBB92EE61360FC4830DA6F4132D9CB33252A9A82

Function 10006B60 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 211filesleepinjectionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006BF2
wsprintfA.USER32 ref: 10006C64
wsprintfA.USER32 ref: 10006C7D
CreateDirectoryA.KERNEL32(?,00000000), ref: 10006C8C
WriteProcessMemory.KERNEL32(00000000,?,?,00000009,00000000), ref: 10006CCA
time.MSVCRT(00000000), ref: 10006CE7
srand.MSVCRT ref: 10006CEE
rand.MSVCRT ref: 10006CF7
rand.MSVCRT ref: 10006D05
rand.MSVCRT ref: 10006D13
rand.MSVCRT ref: 10006D21
rand.MSVCRT ref: 10006D2F
rand.MSVCRT ref: 10006D3D
wsprintfA.USER32 ref: 10006D55
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 10006D6E
CloseHandle.KERNEL32(00000000), ref: 10006D75
Sleep.KERNEL32(000003E8), ref: 10006D80
DeleteFileA.KERNEL32(?), ref: 10006D8B

Strings

%s\%s, xrefs: 10006BEB
c:\windows\system32\drivers\%s, xrefs: 10006C5E
c:\windows\system32\drivers\etc\%c%c%c.%c%c%c, xrefs: 10006D4F
c:\windows\system32\drivers\%s\%s, xrefs: 10006C77

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$CreateFile$CloseDeleteDirectoryHandleMemoryProcessSleepWritesrandtime
String ID: %s\%s$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$c:\windows\system32\drivers\etc\%c%c%c.%c%c%c
API String ID: 3377497938-1917988604
Opcode ID: 59290b8ce7203b782a4386cc549f0c40f57852888d8e583e61626c5b0e8d8cdc
Instruction ID: f6abbdca6701fb3ef1abd676031fbe2b893677713a754b01e1bb176cbb5a4cb9
Opcode Fuzzy Hash: 59290b8ce7203b782a4386cc549f0c40f57852888d8e583e61626c5b0e8d8cdc
Instruction Fuzzy Hash: 8361F3B1204345AFE724CB78CC85BDAB7E6FBCC700F04892CF64597291DB79E6498662

Function 10007280 Relevance: 36.8, APIs: 8, Strings: 13, Instructions: 97stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100072AE
GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\rundll32.exe,00000104), ref: 100072C5
GetModuleFileNameA.KERNEL32(10000000,C:\Users\user\Desktop\NaRZIOq3O8.dll,00000104), ref: 100072D7
strrchr.MSVCRT ref: 10007305
wsprintfA.USER32 ref: 10007322
wsprintfA.USER32 ref: 10007333
wsprintfA.USER32 ref: 10007344
6D262DD0.MFC42(00000084), ref: 1000734B

Strings

C:\Users\user\Desktop\version.txt, xrefs: 1000732E
%s\version.txt, xrefs: 10007329
11121541, xrefs: 1000729F, 1000730B
107.163.241.193:6520, xrefs: 10007335
%s\%s, xrefs: 10007315
C:\Users\user\Desktop\NaRZIOq3O8.dll, xrefs: 100072D1, 100072D9
M107.163.241.193:6520, xrefs: 1000733F
C:\Users\user\Desktop, xrefs: 100072EB, 100072F4, 10007310, 10007324
ECF4BB45F69E, xrefs: 1000738A
C:\Windows\SysWOW64\rundll32.exe, xrefs: 100072BE
M%s, xrefs: 1000733A
C:\Users\user\Desktop\11121541, xrefs: 1000731A
11121541, xrefs: 100072A9

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FileModuleName$D262strrchr
String ID: %s\%s$%s\version.txt$107.163.241.193:6520$11121541$11121541$C:\Users\user\Desktop$C:\Users\user\Desktop\11121541$C:\Users\user\Desktop\NaRZIOq3O8.dll$C:\Users\user\Desktop\version.txt$C:\Windows\SysWOW64\rundll32.exe$ECF4BB45F69E$M%s$M107.163.241.193:6520
API String ID: 2695514821-652825888
Opcode ID: bc271560cedb00765316920da8e4c5159c95b6d1d661ac521e8f3be94e90d187
Instruction ID: b9efe17b6784d2d669a78e19c4a9e9dd53e4a6d02ea8afa0a3925ee485c6705f
Opcode Fuzzy Hash: bc271560cedb00765316920da8e4c5159c95b6d1d661ac521e8f3be94e90d187
Instruction Fuzzy Hash: DC210671A40A016FE708D7798C42FAA7AD1FB89720F444228F7169F2C1CBB8DDC1C255

Function 100056F0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(?,cmd.exe,774D0F00,?,00000000), ref: 10005706
GetCurrentProcessId.KERNEL32(?,00000000), ref: 10005729

Part of subcall function 10005460: CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000,?,00000000), ref: 10005522
Part of subcall function 10005460: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000000), ref: 10005538
Part of subcall function 10005460: time.MSVCRT(00000000,?,00000000), ref: 1000553F
Part of subcall function 10005460: _localtime32.MSVCRT(?,?,00000000), ref: 1000554E
Part of subcall function 10005460: strftime.MSVCRT ref: 10005561
Part of subcall function 10005460: vsprintf.MSVCRT ref: 100055B3
Part of subcall function 10005460: sprintf.MSVCRT ref: 100055D3

Strings

C:\Windows\6C4DA6FB\svchsot.exe, xrefs: 10005770, 10005784
self, xrefs: 1000573A
%s.%d, xrefs: 100057C2
C:\Windows\6C4DA6FB\svchsot.vir, xrefs: 1000577F
cmd.exe, xrefs: 10005700, 10005710

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrentPointerProcess_localtime32sprintfstrftimetimevsprintf
String ID: %s.%d$C:\Windows\6C4DA6FB\svchsot.exe$C:\Windows\6C4DA6FB\svchsot.vir$cmd.exe$self
API String ID: 3192119092-4191049792
Opcode ID: 854f7dac5efd665048c87d9b8970cb6dfe7fba4e3b9b490a123ec12e76592f85
Instruction ID: 532484bbb70a1c206dc26850c65d6d62aa1aacd866b304218ca9e6828c5413fb
Opcode Fuzzy Hash: 854f7dac5efd665048c87d9b8970cb6dfe7fba4e3b9b490a123ec12e76592f85
Instruction Fuzzy Hash: AC1127B62441187BF310A764ECC9FEF3358EF84356F404120FB0896181DA76E6A8C6B7

Function 1000F650 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 1000F68E
_mbsicmp.MSVCRT ref: 1000F6A2
_mbsicmp.MSVCRT ref: 1000F6B6
_mbsicmp.MSVCRT ref: 1000F6CA

Strings

.lzh, xrefs: 1000F6D8
.arj, xrefs: 1000F6EC
.tgz, xrefs: 1000F714
.gz, xrefs: 1000F700
.arc, xrefs: 1000F6C4
.zip, xrefs: 1000F69C
.zoo, xrefs: 1000F6B0

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: _mbsicmp
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1961004622-51310709
Opcode ID: eb51e47cdfb029e0c5bba4cf766f21bdc37fe0109f550dcf1e1b313aa7a9cdda
Instruction ID: d0b6b29593ca128e0c780a1992337e20478c242a31cab124731502bf7dc4c56e
Opcode Fuzzy Hash: eb51e47cdfb029e0c5bba4cf766f21bdc37fe0109f550dcf1e1b313aa7a9cdda
Instruction Fuzzy Hash: 8D21273660416221A711F42D7C006DE93C8CFE21F6B07413BED54CA928E7569DC774EA

Function 10006F40 Relevance: 26.3, APIs: 6, Strings: 9, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Part of subcall function 100068C0: 6D262DD0.MFC42(00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000,00000000,00000000), ref: 100068FA
Part of subcall function 100068C0: 6D262DD0.MFC42(000000FF,00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000,00000000), ref: 10006913
Part of subcall function 100068C0: 6D262DD0.MFC42(00000000,000000FF,00000004,00000000,00000000,00000000,?,?,?,?,?,?,?,?,10006F52,00000000), ref: 1000692D
Part of subcall function 100068C0: strrchr.MSVCRT ref: 1000693E
Part of subcall function 100068C0: strncpy.MSVCRT ref: 10006955
Part of subcall function 100068C0: strncpy.MSVCRT ref: 1000695F
Part of subcall function 100068C0: GetSystemInfo.KERNEL32(GatewayCostMetric,?,?,?,?,?,?,00000000,10009DD0), ref: 10006969
Part of subcall function 100068C0: GetCurrentProcess.KERNEL32(00000020,chOrder,?,?,?,?,?,?,00000000,10009DD0), ref: 1000698A
Part of subcall function 100068C0: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,00000000,10009DD0), ref: 10006991
Part of subcall function 100068C0: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,10009DD0), ref: 100069A2
Part of subcall function 100068C0: AdjustTokenPrivileges.ADVAPI32(00000000,00000000), ref: 100069D7
Part of subcall function 100068C0: CloseHandle.KERNEL32(44746553), ref: 100069E2
Part of subcall function 100068C0: sscanf.MSVCRT ref: 10006A0D

wsprintfA.USER32 ref: 10006F82

Part of subcall function 10006A20: strchr.MSVCRT ref: 10006A76

wsprintfA.USER32 ref: 10006FE8
wsprintfA.USER32 ref: 10007001
CreateDirectoryA.KERNEL32(PGateway,00000000), ref: 1000700C

Part of subcall function 100057F0: CreateFileA.KERNEL32(72656472,40000000,00000000,00000000,00000002,00000080,00000000,flushdns,77068400,10007027,file error,/flushdns), ref: 10005809
Part of subcall function 100057F0: WriteFile.KERNEL32(00000000,72657672,10019B1F,SearchOrder,00000000), ref: 1000582B
Part of subcall function 100057F0: CloseHandle.KERNEL32(00000000), ref: 10005832

Part of subcall function 10006240: CoInitializeEx.COMBASE(00000000,00000000), ref: 1000627D
Part of subcall function 10006240: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 1000628E
Part of subcall function 10006240: CoCreateInstance.COMBASE(Function_000141D0,00000000,00000001,10014100,10019B34), ref: 100062AE
Part of subcall function 10006240: 6D262DD0.MFC42(0000000C), ref: 100062BA
Part of subcall function 10006240: SysAllocString.OLEAUT32(?), ref: 100062E1

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 1000704A
CreateThread.KERNEL32(00000000,00000000,10006E10,00000000,00000000,00000000), ref: 10007071

Strings

sot.exe, xrefs: 10007000
%s\%s, xrefs: 10006F7C
Win32_process, xrefs: 10007027
c:\windows\system32\drivers\%s, xrefs: 10006FE1
file error, xrefs: 10006FA4, 10007021
/flushdns, xrefs: 10007020
ROOT\CIMv2, xrefs: 1000702C
PGateway, xrefs: 10006FE6, 1000700B
c:\windows\system32\drivers\%s\%s, xrefs: 10006FFB

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CreateD262$Processwsprintf$CloseFileHandleInitializeOpenTokenstrncpy$AdjustAllocCurrentDirectoryInfoInstanceLookupPrivilegePrivilegesSecurityStringSystemThreadValueWritesscanfstrchrstrrchr
String ID: %s\%s$/flushdns$PGateway$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$file error$sot.exe
API String ID: 4196162878-306053807
Opcode ID: 7f170ee2cb499793e24e968edf43b8bfd61a76d96f23d218329356d6fff09fe1
Instruction ID: 41850797e00835fd19c5dc62bd8ec1641ec243eb83e2333570ca87f476b8e30c
Opcode Fuzzy Hash: 7f170ee2cb499793e24e968edf43b8bfd61a76d96f23d218329356d6fff09fe1
Instruction Fuzzy Hash: 0231B1B1508341BFE310DB68CC959EB7BD9EB89340F408929F34597252DB39E989CB62

Function 10008660 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 99registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 100086CB
_CxxThrowException.MSVCRT(?,10014468), ref: 100086E5
RegQueryValueExA.ADVAPI32(?,DLLPath,00000000,00000002,?,00000080), ref: 10008703
_CxxThrowException.MSVCRT(?,10014468), ref: 1000871D
StrStrIA.SHLWAPI(?,mp3), ref: 10008734
lstrlen.KERNEL32(?,00000000), ref: 10008743
RegCloseKey.ADVAPI32(?), ref: 10008782

Strings

sc config RemoteAccess start= auto, xrefs: 1000876F
mp3, xrefs: 1000872E
DLLPath, xrefs: 100086FD, 1000874D
net start RemoteAccess, xrefs: 10008777
sc stop RemoteAccess, xrefs: 10008767
U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==, xrefs: 10008686

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$CloseOpenQueryValuelstrlen
String ID: DLLPath$U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==$mp3$net start RemoteAccess$sc config RemoteAccess start= auto$sc stop RemoteAccess
API String ID: 1704467221-2251003411
Opcode ID: 5672b8f5415b280e889738a2cdecbb7482f37a150f7c0c73b0736cba258cb4d4
Instruction ID: 98638fa1fcb9202145d598dc851610221c132621e911f98ed3a9eff087df0439
Opcode Fuzzy Hash: 5672b8f5415b280e889738a2cdecbb7482f37a150f7c0c73b0736cba258cb4d4
Instruction Fuzzy Hash: 1E318DB5900259AFEB10DF94CC85FEFBBB8FB49690F104168F608A6241D7759E44CBB2

Function 100091C0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 187networkCOMMON

Download Yara Rule

APIs

Part of subcall function 10007E20: strstr.MSVCRT ref: 10007ECB
Part of subcall function 10007E20: strstr.MSVCRT ref: 10007EEF
Part of subcall function 10007E20: strcspn.MSVCRT ref: 10007EFE
Part of subcall function 10007E20: strstr.MSVCRT ref: 10007F0A
Part of subcall function 10007E20: strcspn.MSVCRT ref: 10007F19
Part of subcall function 10007E20: strncpy.MSVCRT ref: 10007F22
Part of subcall function 10007E20: strstr.MSVCRT ref: 10007F5F
Part of subcall function 10007E20: strcspn.MSVCRT ref: 10007F72

Part of subcall function 100073C0: setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 100073D7
Part of subcall function 100073C0: WSAIoctl.WS2_32 ref: 1000740F

Part of subcall function 10007750: RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,100199D8), ref: 1000777F
Part of subcall function 10007750: GlobalMemoryStatusEx.KERNEL32(?), ref: 10007839
Part of subcall function 10007750: GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,100199D8), ref: 10007892

send.WS2_32(00000000,?,00000128,00000000), ref: 1000923A
closesocket.WS2_32(00000000), ref: 10009246
select.WS2_32 ref: 1000929C
__WSAFDIsSet.WS2_32(00000000,?), ref: 100092B8
recv.WS2_32(00000000,?,000000BC,00000000), ref: 100092DA
closesocket.WS2_32(00000000), ref: 1000938E
InterlockedExchange.KERNEL32(1001ADF8,00000001), ref: 1000939F

Strings

SeShutdownPrivilege, xrefs: 10009322, 1000933E
zip, xrefs: 100093E0

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: strstr$strcspn$closesocket$DefaultExchangeGlobalInterlockedIoctlLanguageMemoryOpenStatusSystemrecvselectsendsetsockoptstrncpy
String ID: SeShutdownPrivilege$zip
API String ID: 742242273-4289258210
Opcode ID: 245d204ab469e926d276d174df330e3e0c904efc8300d646043186f114eb481e
Instruction ID: 5b97793b30091e66d166c84626b7f7f8b724b7c0c757a19da8836300145a5849
Opcode Fuzzy Hash: 245d204ab469e926d276d174df330e3e0c904efc8300d646043186f114eb481e
Instruction Fuzzy Hash: BA51E271548305BAF320EB248C85FEF76D8EB84390F004A29FA59D60D5DB74EA59C662

Function 100087A0 Relevance: 18.1, APIs: 12, Instructions: 87servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,?,?,?,?,10008B65,?), ref: 100087AF
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,10008B65,?), ref: 100087CA
ChangeServiceConfigA.ADVAPI32(00000000,000000FF,00000002,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,10008B65), ref: 100087EF
StartServiceA.ADVAPI32(00000000,00000000,00000000,?,?,?,?,10008B65,?), ref: 100087FA
GetLastError.KERNEL32(?,?,?,?,10008B65,?), ref: 10008804
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10008B65,?), ref: 10008818
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10008B65,?), ref: 1000881B
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,10008B65,?), ref: 10008836
Sleep.KERNEL32(00000064), ref: 1000884B
QueryServiceStatus.ADVAPI32(00000000,?), ref: 10008853
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10008B65,?), ref: 1000885A
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,10008B65,?), ref: 10008862

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Service$CloseHandle$OpenQueryStatus$ChangeConfigErrorLastManagerSleepStart
String ID:
API String ID: 1627767825-0
Opcode ID: 2fac1673197cf2ff6dfddec042db3646b6b08e22be202311ec5adbe7e690b690
Instruction ID: 47210d8320cb616e9ac874a10e60074c413c5e83760351a3661c9edf4b7b5ba8
Opcode Fuzzy Hash: 2fac1673197cf2ff6dfddec042db3646b6b08e22be202311ec5adbe7e690b690
Instruction Fuzzy Hash: BB115972600226ABF212EB589C48FAB3798FB887B1F808215F604D10D6DB70DB15C7B5

Function 10007A80 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000001,00000001,100199D8), ref: 10007A97
LoadLibraryA.KERNEL32(wininet.dll), ref: 10007AA0
GetProcAddress.KERNEL32(00000000,URLDownloadToCacheFileA), ref: 10007AC9
GetProcAddress.KERNEL32(00000000,GetUrlCacheEntryInfoA), ref: 10007AD4
6D262DD0.MFC42(00000050), ref: 10007AD8

Strings

WinSta0\Default, xrefs: 10007BD2
wininet.dll, xrefs: 10007A99
GetUrlCacheEntryInfoA, xrefs: 10007ACB
URLDownloadToCacheFileA, xrefs: 10007AB8
urlmon.dll, xrefs: 10007A92

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc$D262
String ID: GetUrlCacheEntryInfoA$URLDownloadToCacheFileA$WinSta0\Default$urlmon.dll$wininet.dll
API String ID: 1173762060-1569318151
Opcode ID: 709742a31d0fadea7edc8af64177e44467c470bc28e1ea771c10d62153978372
Instruction ID: 0ba0445337995a34d0d020c410f7d090e2bbd8e81f04aadd91c8ed6f97ba3bbd
Opcode Fuzzy Hash: 709742a31d0fadea7edc8af64177e44467c470bc28e1ea771c10d62153978372
Instruction Fuzzy Hash: B441FE32A0091C6BDB15CAB88C55BEF7A66FB88310F540369F716AB2C1DEF15E45CB44

Function 1000B000 Relevance: 16.7, APIs: 11, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,?), ref: 1000B037
SafeArrayAccessData.OLEAUT32(?,?), ref: 1000B04F
6D262DD0.MFC42(0000000C), ref: 1000B07D
SysAllocString.OLEAUT32(?), ref: 1000B09F
6D262DD0.MFC42(0000000C), ref: 1000B0DA
InterlockedDecrement.KERNEL32(?), ref: 1000B114
InterlockedDecrement.KERNEL32(?), ref: 1000B148
SafeArrayUnaccessData.OLEAUT32(?), ref: 1000B17C
InterlockedIncrement.KERNEL32(?), ref: 1000B195
InterlockedDecrement.KERNEL32(?), ref: 1000B1A7
SysFreeString.OLEAUT32(00000000), ref: 1000B1BC

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked$ArrayDecrementSafe$D262DataString$AccessAllocFreeIncrementUnaccessVartype
String ID:
API String ID: 3796710767-0
Opcode ID: 05ab98cb6835f449d3afe92a0ec598aecaf92792fb8f31b2b9e620e5b1815253
Instruction ID: 2f4c7833868a6a642660d5ddbd74aa3eac225ba51bae9dcfe10431cb2488e8f4
Opcode Fuzzy Hash: 05ab98cb6835f449d3afe92a0ec598aecaf92792fb8f31b2b9e620e5b1815253
Instruction Fuzzy Hash: A751CFB29047929BE710DF6588C5A5FF7E4FB84680F814A2CF885D3215E734ED85CB92

Function 1000AC40 Relevance: 15.2, APIs: 10, Instructions: 188COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 1000AC98
6D262DD0.MFC42 ref: 1000ACA1
6D262DD0.MFC42(0000000C), ref: 1000AD4A
VariantClear.OLEAUT32(?), ref: 1000AE0B
VariantClear.OLEAUT32(?), ref: 1000AE17
InterlockedIncrement.KERNEL32(-00000008), ref: 1000AE36
InterlockedDecrement.KERNEL32(?), ref: 1000AE4A

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Variant$ClearD262Interlocked$DecrementIncrementInit
String ID:
API String ID: 4080713044-0
Opcode ID: 30582efdfb73e3a1e08f54b0a8ea1c393c0aa53144726bcbb2eaf70a4ecd28c6
Instruction ID: 79ffa18ca43941fce37d839cf4afa098f59e3dcefab3dc036024d3061b98d5c3
Opcode Fuzzy Hash: 30582efdfb73e3a1e08f54b0a8ea1c393c0aa53144726bcbb2eaf70a4ecd28c6
Instruction Fuzzy Hash: C0619271A083829BE714CF24C845B1FB7E4EF9A794F014B1DF98197245DBB5E884CBA2

Function 10009850 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 10009875
6D262DD0.MFC42(00000084), ref: 1000988B

Strings

%s/joy.asp?sid=%s, xrefs: 10009960
http://107.163.241.185:16300/, xrefs: 10009870, 10009954
ECF4BB45F69E, xrefs: 100098CE, 1000992F
11121541, xrefs: 10009928
http://, xrefs: 1000986B
%s|NULL|%s|%s, xrefs: 1000993B

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262strstr
String ID: %s/joy.asp?sid=%s$%s|NULL|%s|%s$11121541$ECF4BB45F69E$http://$http://107.163.241.185:16300/
API String ID: 3951026917-2965986427
Opcode ID: 6a389dea83708a48e9eaed4108e65dda5b376556a2b6c1b95fe17ab307e458e2
Instruction ID: b13f840aca1df8f0e8e04d5b101a117d0290481ec4a8539e160a7b991a9b7fb1
Opcode Fuzzy Hash: 6a389dea83708a48e9eaed4108e65dda5b376556a2b6c1b95fe17ab307e458e2
Instruction Fuzzy Hash: A931B475604740ABE724CB74CC01BEB76D5EBC8340F44892CB64A8B285DF78D544C752

Function 10008B90 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10005620: GetCurrentProcess.KERNEL32(00000028,00000000), ref: 1000562A
Part of subcall function 10005620: OpenProcessToken.ADVAPI32(00000000), ref: 10005631
Part of subcall function 10005620: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10005647
Part of subcall function 10005620: AdjustTokenPrivileges.KERNELBASE ref: 1000568A
Part of subcall function 10005620: CloseHandle.KERNEL32 ref: 10005695

CreateMutexA.KERNEL32(00000000,00000001,Global\98012trt8-d8dfsf,?,10008C0C), ref: 10008BAB
GetLastError.KERNEL32(?,10008C0C), ref: 10008BB3
ReleaseMutex.KERNEL32(00000000,?,?,?,10008C0C), ref: 10008BDD
CloseHandle.KERNEL32(00000000,?,?,?,10008C0C), ref: 10008BE4

Strings

c:\11.txt, xrefs: 10008BCA
ERROR_ALREADY_EXISTS, xrefs: 10008BC5
SeDebugPrivilege, xrefs: 10008B94
Global\98012trt8-d8dfsf, xrefs: 10008BA3

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMutexProcessToken$AdjustCreateCurrentErrorLastLookupOpenPrivilegePrivilegesReleaseValue
String ID: ERROR_ALREADY_EXISTS$Global\98012trt8-d8dfsf$SeDebugPrivilege$c:\11.txt
API String ID: 3631164735-4205529783
Opcode ID: f7fd6434f81f715ccf36bb5118b931db28033082902ce0681c6efb333c9d0bf3
Instruction ID: 5584062bcfe8fe443fc193796f50a74a123afcaee35dc86c6677604280257fb5
Opcode Fuzzy Hash: f7fd6434f81f715ccf36bb5118b931db28033082902ce0681c6efb333c9d0bf3
Instruction Fuzzy Hash: 19E09276910020B3FA20E3606C8DEDF3D62E7967AAF550020F70AA6191DB36C9D182A2

Function 1000A840 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

6D262DD0.MFC42(0000000C,Win32_NetworkAdapterConfiguration,00000000,00000000,00000000,?,?,ROOT\CIMV2), ref: 1000A864
SysStringLen.OLEAUT32(?), ref: 1000A89E
SysStringLen.OLEAUT32(?), ref: 1000A8BB
SysAllocStringByteLen.OLEAUT32(00000000), ref: 1000A8CF
InterlockedDecrement.KERNEL32(00000008), ref: 1000A95B
SysFreeString.OLEAUT32(00000000), ref: 1000A970

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A85B

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: String$AllocByteD262DecrementFreeInterlocked
String ID: Win32_NetworkAdapterConfiguration
API String ID: 959857571-4052814535
Opcode ID: 696aefe1056031e8381074ea8d5f724c3fb411b7b74b26e6d566fbb943f84d1b
Instruction ID: 7af6534ef6524c84e344720a7089e89789d2c6adbb66ef60a0126f8e7add14fe
Opcode Fuzzy Hash: 696aefe1056031e8381074ea8d5f724c3fb411b7b74b26e6d566fbb943f84d1b
Instruction Fuzzy Hash: EB41D471B006159FE710DF18C88095EF7E5FB86684F258B29F885DB208E775ED86CB81

Function 1000F7D0 Relevance: 12.2, APIs: 8, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FE77,?), ref: 1000F7DE
GetFileSize.KERNEL32(?,00000000,?,00000000,?), ref: 1000F84B
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FE77), ref: 1000F86B
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 1000F882
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FE77), ref: 1000F88B
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F89C
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 1000F8BC
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F8CD

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: d88dd7143e5a55282583a39c7f48a16c409f497c41c0cca4329b838faa6cc43a
Instruction ID: 405fe81f1d8ab72a7605b9501efea937567496558c0defe8bd6331aae6a0450c
Opcode Fuzzy Hash: d88dd7143e5a55282583a39c7f48a16c409f497c41c0cca4329b838faa6cc43a
Instruction Fuzzy Hash: 9D51C1B1A04312AFF314CE54CC81FBBB7E8EF84784F10891CF68597694EA70E9059B56

Function 100084D0 Relevance: 12.1, APIs: 8, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000002,?,00000000,00000000,00000000,000F003F,00000000,?,?,?,00000000,00000000,80000002,00000000,DLLPath,00000002), ref: 10008527
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,0002001F,?), ref: 10008547
RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 1000857D
RegSetValueExA.ADVAPI32(?,?,00000000,?,?), ref: 100085AA
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?,?,?,?,?,?,?,?,?,?,10008E45,?), ref: 100085C8
RegDeleteKeyA.ADVAPI32(?,?), ref: 100085DA
RegOpenKeyExA.ADVAPI32(?,?,00000000,0002001F,?,?,?,?,?,?,?,?,?,?,10008E45,?), ref: 100085F8
RegDeleteValueA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,10008E45,?), ref: 1000860A

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: OpenValue$Delete$Create
String ID:
API String ID: 2295199933-0
Opcode ID: 456ad6509b8fb058ab17bc1d6503d03c4a478f654bf904014c631ecf16233c95
Instruction ID: b68374bf711ffe28daf24b35b567a8d817eee2586d1f4d5131a9a979ce9dc9dd
Opcode Fuzzy Hash: 456ad6509b8fb058ab17bc1d6503d03c4a478f654bf904014c631ecf16233c95
Instruction Fuzzy Hash: 0E413AB1600249ABEB10CFA5CD88EAF77BDFB4C690B158618FA55D3256D635EE008B70

Function 100057F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(72656472,40000000,00000000,00000000,00000002,00000080,00000000,flushdns,77068400,10007027,file error,/flushdns), ref: 10005809
WriteFile.KERNEL32(00000000,72657672,10019B1F,SearchOrder,00000000), ref: 1000582B
CloseHandle.KERNEL32(00000000), ref: 10005832

Strings

SearchOrder, xrefs: 1000581B
flushdns, xrefs: 100057F5

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: SearchOrder$flushdns
API String ID: 1065093856-3551094870
Opcode ID: 95aecc5bbb7728e2d3004c277a4a6589035de193547edee27a9b936397a63fcc
Instruction ID: ef37b5df3fd9416dab6416b978454a5d0d7b8f3b63e71bbe0519d8d63ca187da
Opcode Fuzzy Hash: 95aecc5bbb7728e2d3004c277a4a6589035de193547edee27a9b936397a63fcc
Instruction Fuzzy Hash: 69E06D712402207BF22487249C4EFAB3A58EBC8721F108608F31A961D1CBB0AC058668

Function 1000F9A0 Relevance: 7.6, APIs: 5, Instructions: 138fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000001,00000000,10010D09), ref: 1000F9F5
CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,00000001,00000000,10010D09), ref: 1000FA36

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: 6675c2e020021266492d22b367d027f32c71b801bb070b6a2fb72d1fa451fff9
Instruction ID: 82c05d4eb222960227533bad6493fa4047be9ed8a2b8e5bde8ae66ca70aabe6a
Opcode Fuzzy Hash: 6675c2e020021266492d22b367d027f32c71b801bb070b6a2fb72d1fa451fff9
Instruction Fuzzy Hash: 7D41A0B26013418FE320CF6998C4B5BB7D8F7953A9F208A3FF199C6940C370D8999B21

Function 10006A20 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 124stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10006A76
strchr.MSVCRT ref: 10006B40

Strings

, xrefs: 10006AC4
file error, xrefs: 10006A68
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.ki|www.knbank.co.kr.ki|openbank.cu.co.kr.ki|www.busanbank.co.kr.ki|www.nonghyup.com.ki|www.shinhan.com.ki|www.wooribank.com.ki|www.hanabank.com.ki|www.epostbank.go.kr.ki|www.ibk.co.kr.ki|www.idk.c, xrefs: 10006A41

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: strchr
String ID: $file error$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.ki|www.knbank.co.kr.ki|openbank.cu.co.kr.ki|www.busanbank.co.kr.ki|www.nonghyup.com.ki|www.shinhan.com.ki|www.wooribank.com.ki|www.hanabank.com.ki|www.epostbank.go.kr.ki|www.ibk.co.kr.ki|www.idk.c
API String ID: 2830005266-2540400106
Opcode ID: 23491e53ffd28ee1f1fb228301a5196be38e344967e44dbb00a2e60f8e0de54f
Instruction ID: cf09df00d589f54944db86fe8f12c4b48108bc34a5b538311976df3d68cdb4a6
Opcode Fuzzy Hash: 23491e53ffd28ee1f1fb228301a5196be38e344967e44dbb00a2e60f8e0de54f
Instruction Fuzzy Hash: E031D4366049081BD72CC878981566B76C3FBC5270FA5473DBA6B876C0DEF59E48C241

Function 10006E10 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

6D262DD0.MFC42(00000001), ref: 10006E46
VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 10006E6D
6D262DD0.MFC42(00001000,00000000), ref: 10006EAA
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,00000000), ref: 10006EC7
CloseHandle.KERNEL32(00000000), ref: 10006F21

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: D262$CloseHandleMemoryProcessQueryReadVirtual
String ID:
API String ID: 4133444876-0
Opcode ID: b4b864220a103b4f9d22497cecf06cd65cc241568f318f34bc9304c6b1666796
Instruction ID: 2f216d3c92ef82be60180469efd54965c0b310b1021fef6d999fa98d0b99ce03
Opcode Fuzzy Hash: b4b864220a103b4f9d22497cecf06cd65cc241568f318f34bc9304c6b1666796
Instruction Fuzzy Hash: A631AD717043429BE710CF18CC81A6BB3EAEBC9784F10452CFE8897245DB75EC468BA2

Function 10005960 Relevance: 7.6, APIs: 5, Instructions: 80fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,10005B8D), ref: 1000599B
GetFileSize.KERNEL32(00000000,00000000,?,?), ref: 100059B8
6D262DD0.MFC42(00000000), ref: 100059BF
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 100059FD
CloseHandle.KERNEL32(00000000), ref: 10005A37

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateD262HandleReadSize
String ID:
API String ID: 2959762680-0
Opcode ID: f27e6052ed72f7358379c96a1137fe1580c797e8f6c6e2a160a5064b2e3a8428
Instruction ID: d343087bb03fad32f03e5ae059147a2c5f7908d67b4ab7f6cbcfc06277a3a212
Opcode Fuzzy Hash: f27e6052ed72f7358379c96a1137fe1580c797e8f6c6e2a160a5064b2e3a8428
Instruction Fuzzy Hash: 4E21F571304345AFE720CB28DC85BEBB3D9FB88710F404928FB86D7280D6B5B944CA66

Function 10011395 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 100113A8
6D262DD0.MFC42(00000002,72657672,1001A365,654E5F32,00000000,00000000,10006735,00000000), ref: 100113B2
WideCharToMultiByte.KERNEL32(00000000,00000000,72657672,000000FF,00000000,00000002,00000000,00000000,1001A365,654E5F32,00000000,00000000,10006735,00000000), ref: 100113D4
GetLastError.KERNEL32 ref: 100113E4
GetLastError.KERNEL32 ref: 100113EA

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharD262MultiWidewcslen
String ID:
API String ID: 893356176-0
Opcode ID: afd18ee60ff2b0ce0bcd15a358cca37ac97d015ba3010c487c48ccea99233302
Instruction ID: 23fc2d8bcf316ea6a60e3ca9b5905811bbe2b2d5fdf9053c8a10922eaeb712a0
Opcode Fuzzy Hash: afd18ee60ff2b0ce0bcd15a358cca37ac97d015ba3010c487c48ccea99233302
Instruction Fuzzy Hash: C8F0C862204156BED214E6764C84DEB768CDB856F97124239F564DE441E935DC8181B1

Function 10011320 Relevance: 7.5, APIs: 5, Instructions: 45memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,00000000,00000000,1000A74F,?,Win32_NetworkAdapterConfiguration), ref: 10011332
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001), ref: 10011359
GetLastError.KERNEL32(?,00000001), ref: 10011369
GetLastError.KERNEL32(?,00000001), ref: 1001136F
SysAllocString.OLEAUT32 ref: 10011386

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$AllocByteCharMultiStringWidelstrlen
String ID:
API String ID: 4196186757-0
Opcode ID: 5bddbd93c25bf412b4bb809baaa78ed8b84148b2e51b7ba0785a3fcadd1d5036
Instruction ID: 1697f759eb40de09af1bc61be908fb19387247674bfb87126e23a115f11a360f
Opcode Fuzzy Hash: 5bddbd93c25bf412b4bb809baaa78ed8b84148b2e51b7ba0785a3fcadd1d5036
Instruction Fuzzy Hash: 5801F472500126F7D710DB60CC05BDE3FA8EF413A1F204130FD54DA0A4E734D6A186E1

Function 10005BF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136stringCOMMON

Download Yara Rule

APIs

PathIsDirectoryA.SHLWAPI(?), ref: 10005C00
strrchr.MSVCRT ref: 10005C51
strrchr.MSVCRT ref: 10005CBC

Strings

123, xrefs: 10005C67

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: strrchr$DirectoryPath
String ID: 123
API String ID: 307107200-2286445522
Opcode ID: 50724f86c3f4088a4114f505fbd4048a7a26bc2a5139918f545a1dec1e3d9f9d
Instruction ID: 52565608425bb8163d1a49b4138d7fd17ec815c5c5898e6c317b6dd2e097079f
Opcode Fuzzy Hash: 50724f86c3f4088a4114f505fbd4048a7a26bc2a5139918f545a1dec1e3d9f9d
Instruction Fuzzy Hash: C63149756043482FF350D234AC46B7B37C8DB81261F400629FD96872C2EE7BE9498252

Function 1000FE10 Relevance: 6.1, APIs: 4, Instructions: 114timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,00000000), ref: 1000FE59
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1000FE86
GetLocalTime.KERNEL32(?), ref: 1000FEC0
SystemTimeToFileTime.KERNEL32(?,?), ref: 1000FED0

Part of subcall function 1000F7D0: GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FE77,?), ref: 1000F7DE

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: 61a0087d423c09f97422bc83c9848e8916b95916cdb9e4ba8520c2658471a079
Instruction ID: 17b5fe91996c6261312ccb9e4e6132c54d30cb61b07fd2e13d415d5cbc7ebe71
Opcode Fuzzy Hash: 61a0087d423c09f97422bc83c9848e8916b95916cdb9e4ba8520c2658471a079
Instruction Fuzzy Hash: D04151B1504B459FE320DF29C88096BF7E8FF89354F408A2EF59A83A51D371E909CB61

Function 1000AE80 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000AEA4
SysFreeString.OLEAUT32(00000000), ref: 1000AEB9
6D262DD0.MFC42(0000000C,761DE610,00000000,?,00000000,1001182B,000000FF,1000ADF0,?,00000008,?), ref: 1000AEE0
SysAllocString.OLEAUT32(?), ref: 1000AF0E

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: String$AllocD262DecrementFreeInterlocked
String ID:
API String ID: 2797009911-0
Opcode ID: 2d8dce3105b6f9f3431049397acffbae998695e77875ebfd0e65080e84b591e4
Instruction ID: 467ef8a558da28dbcad68d4755d69a1ff26c6b184be9d6db0a0de4f2a60c8ced
Opcode Fuzzy Hash: 2d8dce3105b6f9f3431049397acffbae998695e77875ebfd0e65080e84b591e4
Instruction Fuzzy Hash: 3521AEB6A006529BE350CF19C845B57B7E8FB48B90F00863DF949D7244E778E884C7A1

Function 100056B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,00000000,?,1000575A,?,?,?,00000000), ref: 100056BD
TerminateProcess.KERNEL32(00000000,00000000,?,?,00000000), ref: 100056CC
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 100056D7
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 100056E4

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction ID: f7b4e055ffd599d9e0c47c3f774a3c979061384f2bf10b9864beb156a07e91a2
Opcode Fuzzy Hash: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction Fuzzy Hash: 37E0C2752022306FF6626774AC4DBAB3694EF0CB52F024200F906D6186C631CC91C6A1

Function 1000A7A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

6D262DD0.MFC42(0000000C,00000000,00000000,?,00000000,1001178B,000000FF,10009E98,ROOT\CIMV2), ref: 1000A7BC
SysAllocString.OLEAUT32(?), ref: 1000A7EA

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A7D6

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: AllocD262String
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3327814304-4052814535
Opcode ID: dcc9387750b85e72be689dce455b3cb1c3cd05c30fd87c59f8a4494969a60326
Instruction ID: 5be8eb74ec117bd519112317e2f5b517d8065636beee4e0cb4edc012c64f21ac
Opcode Fuzzy Hash: dcc9387750b85e72be689dce455b3cb1c3cd05c30fd87c59f8a4494969a60326
Instruction Fuzzy Hash: 2501B572500651DBE310CF58C845B56B6E4FB45FA4F20872DF9549B390D7B8D885C7D2

Function 1000A9D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000A9DE
SysFreeString.OLEAUT32(00000000), ref: 1000A9F3

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A9D1

Memory Dump Source

Source File: 00000003.00000002.3770418235.0000000010001000.00000040.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3770357167.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010021000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770418235.0000000010032000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770573661.0000000010034000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3770592041.0000000010035000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementFreeInterlockedString
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3298718523-4052814535
Opcode ID: 21f08bbe9eaea59fddc26aeedd3f048849ab0ef83c9e535bffb6afc4ff47bb10
Instruction ID: a533a0eff511bb94dcfba7d21632d8268cd47a76a31a49f1588e4cd0f422ce33
Opcode Fuzzy Hash: 21f08bbe9eaea59fddc26aeedd3f048849ab0ef83c9e535bffb6afc4ff47bb10
Instruction Fuzzy Hash: 8AF0A0B6B0122257E660DA25A904B4773DCEF02A80B020538FC45E7249E734EC81C691

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NaRZIOq3O8.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
NaRZIOq3O8.dll

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre