Edit tour
Windows
Analysis Report
Call 0f Duty A1 Launcher.exe
Overview
General Information
| Sample name: | Call 0f Duty A1 Launcher.exe |
| Analysis ID: | 1561495 |
| MD5: | fad119b9db79ccbfe3a65a13f0822b22 |
| SHA1: | db0992d62adb36a46b493063dd5192bb27422bb9 |
| SHA256: | 27550a73b832d92b6a6a3869f0dedbb826c7c97348587342fe02c8c7cf98e0b9 |
| Tags: | exeuser-4k95m |
| Infos: |  |
 | |
Detection
LummaC Stealer
| Score: | 92 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Classification
- System is w10x64
Call 0f Duty A1 Launcher.exe (PID: 7272 cmdline: "C:\Users\ user\Deskt op\Call 0f Duty A1 L auncher.ex e" MD5: FAD119B9DB79CCBFE3A65A13F0822B22) 
conhost.exe (PID: 7280 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - Call 0f Duty A1 Launcher.exe (PID: 7328 cmdline:
"C:\Users\ user\Deskt op\Call 0f Duty A1 L auncher.ex e" MD5: FAD119B9DB79CCBFE3A65A13F0822B22)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security | ||
| JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
| Click to see the 1 entries | ||||
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:05:59.751154+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:01.704643+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:04.285115+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49732 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:06.513365+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49733 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:08.727761+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49734 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:11.203989+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49735 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:13.720808+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49736 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:17.766046+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.4 | 49738 | 104.21.33.116 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:06:00.435968+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:02.409509+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:18.463443+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.4 | 49738 | 104.21.33.116 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:06:00.435968+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:06:02.409509+0100 | 2049812 | 1 | A Network Trojan was detected | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:06:11.941657+0100 | 2048094 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49735 | 104.21.33.116 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Directory queried: | ||
| Source: | Code function: | 0_2_006CC7DB | |
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_006BF4D0 | |
| Source: | Code function: | 0_2_006C34D0 | |
| Source: | Code function: | 0_2_006C15A0 | |
| Source: | Code function: | 0_2_006BF980 | |
| Source: | Code function: | 0_2_006BCE70 | |
| Source: | Code function: | 0_2_006B86C0 | |
| Source: | Code function: | 0_2_006BD7F0 | |
| Source: | Code function: | 0_2_006D1FD2 | |
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_006C4BD8 | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_03603593 | |
| Source: | Code function: | 2_3_035FDA2A | |
| Source: | Code function: | 2_3_035FDA2A | |
| Source: | Code function: | 2_3_035FDA2A | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_036035AB | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 2_3_0360247B | |
| Source: | Code function: | 0_2_006C4CA2 | |
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Registry key monitored for changes: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | System information queried: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Code function: | 0_2_006CC7DB | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_006C5444 | |
| Source: | Code function: | 0_2_006BCD10 | |
| Source: | Code function: | 0_2_006DB18D | |
| Source: | Code function: | 0_2_006BBD50 | |
| Source: | Code function: | 0_2_006C9F90 | |
| Source: | Code function: | 0_2_006C5444 | |
| Source: | Code function: | 0_2_006C5438 | |
| Source: | Code function: | 0_2_006C7DCA | |
| Source: | Code function: | 0_2_006C4AD9 | |
HIPS / PFW / Operating System Protection Evasion | |
|---|
| Source: | Code function: | 0_2_006DB18D | |
| Source: | Memory written: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_006C5200 | |
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 0_2_006C58C5 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | WMI Queries: | ||
Stealing of Sensitive Information | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | Jump to behavior | ||
| Source: | Directory queried: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | File source: | ||
Remote Access Functionality | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 2 Windows Management Instrumentation | 1 DLL Side-Loading | 211 Process Injection | 11 Virtualization/Sandbox Evasion | 1 OS Credential Dumping | 1 System Time Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 211 Process Injection | LSASS Memory | 1 Query Registry | Remote Desktop Protocol | 31 Data from Local System | 1 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 1 Deobfuscate/Decode Files or Information | Security Account Manager | 141 Security Software Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 2 Obfuscated Files or Information | NTDS | 11 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Software Packing | LSA Secrets | 1 Process Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 21 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 33 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 100% | Joe Sandbox ML |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| property-imper.sbs | 104.21.33.116 | true | false | high |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.21.33.116 | property-imper.sbs | United States | 13335 | CLOUDFLARENETUS | false | |
| 147.45.47.81 | unknown | Russian Federation | 2895 | FREE-NET-ASFREEnetEU | false |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1561495 |
| Start date and time: | 2024-11-23 15:05:07 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 55s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | Call 0f Duty A1 Launcher.exe |
| Detection: | MAL |
| Classification: | mal92.troj.spyw.evad.winEXE@4/0@1/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target Call 0f Duty A1 Launcher.exe, PID 7328 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenFile calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryDirectoryFile calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
- Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
- VT rate limit hit for: Call 0f Duty A1 Launcher.exe
| Time | Type | Description |
|---|---|---|
| 09:05:59 | API Interceptor |
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 104.21.33.116 | Get hash | malicious | Unknown | Browse | ||
| Get hash | malicious | LummaC Stealer | Browse | |||
| Get hash | malicious | LummaC Stealer | Browse | |||
| Get hash | malicious | Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | LummaC Stealer | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | LummaC Stealer | Browse | |||
| Get hash | malicious | LummaC Stealer | Browse | |||
| 147.45.47.81 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC, Xmrig | Browse |
| ||
| Get hash | malicious | LummaC, Xmrig | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | RedLine, Xmrig | Browse |
| ||
| Get hash | malicious | PureLog Stealer, RedLine, Xmrig | Browse |
| ||
| Get hash | malicious | RedLine, Xmrig | Browse |
| ||
| Get hash | malicious | RedLine, Xmrig | Browse |
| ||
| Get hash | malicious | Xmrig | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| property-imper.sbs | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | CredGrabber, Meduza Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| FREE-NET-ASFREEnetEU | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | HTMLPhisher | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | RedLine | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| a0e9f5d64349fb13191bc781f81f42e1 | Get hash | malicious | LummaC Stealer | Browse |
| |
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
| ||
| Get hash | malicious | LummaC Stealer | Browse |
|
⊘No context
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 7.728754242194129 |
| TrID: |
|
| File name: | Call 0f Duty A1 Launcher.exe |
| File size: | 495'616 bytes |
| MD5: | fad119b9db79ccbfe3a65a13f0822b22 |
| SHA1: | db0992d62adb36a46b493063dd5192bb27422bb9 |
| SHA256: | 27550a73b832d92b6a6a3869f0dedbb826c7c97348587342fe02c8c7cf98e0b9 |
| SHA512: | 41c629c773500fc55b3da2b726045ce88d1f5ae7f35800666c4465bb1d7b8fd3e8aa71e7a99f8c607f64d77916a704e9da7bf0ed2d06844864ad138fe5a2df2f |
| SSDEEP: | 12288:SJB+nneDgkXFEIs2Gvih6W8Rd70dDufr3/:2AoR24BhL4r3/ |
| TLSH: | 60B4F06E3393A0A3E5A3183141D89EB5456E7E300F34A4FB57605BB92F3A6D2C532E17 |
| File Content Preview: | MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................................@.................................T...<.. |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x415870 |
| Entrypoint Section: | .text |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows cui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 6 |
| OS Version Minor: | 0 |
| File Version Major: | 6 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 6 |
| Subsystem Version Minor: | 0 |
| Import Hash: | 887797384d81c493a9d8ee55dad3b2e1 |
| Instruction |
|---|
| call 00007F794D5A4ABAh |
| jmp 00007F794D5A491Dh |
| mov ecx, dword ptr [0042B5F0h] |
| push esi |
| push edi |
| mov edi, BB40E64Eh |
| mov esi, FFFF0000h |
| cmp ecx, edi |
| je 00007F794D5A4AB6h |
| test esi, ecx |
| jne 00007F794D5A4AD8h |
| call 00007F794D5A4AE1h |
| mov ecx, eax |
| cmp ecx, edi |
| jne 00007F794D5A4AB9h |
| mov ecx, BB40E64Fh |
| jmp 00007F794D5A4AC0h |
| test esi, ecx |
| jne 00007F794D5A4ABCh |
| or eax, 00004711h |
| shl eax, 10h |
| or ecx, eax |
| mov dword ptr [0042B5F0h], ecx |
| not ecx |
| pop edi |
| mov dword ptr [0042B5ECh], ecx |
| pop esi |
| ret |
| push ebp |
| mov ebp, esp |
| sub esp, 14h |
| and dword ptr [ebp-0Ch], 00000000h |
| lea eax, dword ptr [ebp-0Ch] |
| and dword ptr [ebp-08h], 00000000h |
| push eax |
| call dword ptr [0042946Ch] |
| mov eax, dword ptr [ebp-08h] |
| xor eax, dword ptr [ebp-0Ch] |
| mov dword ptr [ebp-04h], eax |
| call dword ptr [00429430h] |
| xor dword ptr [ebp-04h], eax |
| call dword ptr [0042942Ch] |
| xor dword ptr [ebp-04h], eax |
| lea eax, dword ptr [ebp-14h] |
| push eax |
| call dword ptr [004294A8h] |
| mov eax, dword ptr [ebp-10h] |
| lea ecx, dword ptr [ebp-04h] |
| xor eax, dword ptr [ebp-14h] |
| xor eax, dword ptr [ebp-04h] |
| xor eax, ecx |
| leave |
| ret |
| mov eax, 00004000h |
| ret |
| push 0042C970h |
| call dword ptr [00429488h] |
| ret |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| int3 |
| mov al, 01h |
| ret |
| push 00030000h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x29254 | 0x3c | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x2f000 | 0x1400 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x237c0 | 0xc0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x293c8 | 0x138 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2169a | 0x21800 | 02aff72e65eaf052f891170e28598361 | False | 0.550606343283582 | data | 6.737058354414408 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x23000 | 0x7264 | 0x7400 | 91e5fdecc510d2c4e72b1b50db3c2501 | False | 0.40641837284482757 | data | 4.769873714467996 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x2b000 | 0x2068 | 0x1000 | f9b2b4b1f63578440eedd0ace5ac94f1 | False | 0.484375 | OpenPGP Secret Key | 5.090094544660231 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .00cfg | 0x2e000 | 0x8 | 0x200 | 160c8b290b62e5e566d05ce3bec76423 | False | 0.03125 | data | 0.06116285224115448 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x2f000 | 0x1400 | 0x1400 | 29fb367912ce622b91120c5cffd84495 | False | 0.81953125 | data | 6.557860970753822 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| .coS | 0x31000 | 0x4d800 | 0x4d800 | dadefaca19565602088c9505a810b233 | False | 1.0003339213709677 | data | 7.999391001565712 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| DLL | Import |
|---|---|
| KERNEL32.dll | CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile |
| GDI32.dll | CreateEllipticRgn |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-11-23T15:05:59.751154+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:00.435968+0100 | 2049836 | ET MALWARE Lumma Stealer Related Activity | 1 | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:00.435968+0100 | 2054653 | ET MALWARE Lumma Stealer CnC Host Checkin | 1 | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:01.704643+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:02.409509+0100 | 2049812 | ET MALWARE Lumma Stealer Related Activity M2 | 1 | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:02.409509+0100 | 2054653 | ET MALWARE Lumma Stealer CnC Host Checkin | 1 | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:04.285115+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49732 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:06.513365+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49733 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:08.727761+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49734 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:11.203989+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49735 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:11.941657+0100 | 2048094 | ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration | 1 | 192.168.2.4 | 49735 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:13.720808+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49736 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:17.766046+0100 | 2028371 | ET JA3 Hash - Possible Malware - Fake Firefox Font Update | 3 | 192.168.2.4 | 49738 | 104.21.33.116 | 443 | TCP |
| 2024-11-23T15:06:18.463443+0100 | 2054653 | ET MALWARE Lumma Stealer CnC Host Checkin | 1 | 192.168.2.4 | 49738 | 104.21.33.116 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 23, 2024 15:05:58.375926018 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:58.375977993 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:05:58.376075983 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:58.379306078 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:58.379323006 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:05:59.751030922 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:05:59.751153946 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:59.753099918 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:59.753110886 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:05:59.753523111 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:05:59.793725967 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:59.823849916 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:59.823874950 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:05:59.823987007 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:00.435988903 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:00.436116934 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:00.436193943 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:00.439770937 CET | 49730 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:00.439795971 CET | 443 | 49730 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:00.483357906 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:00.483455896 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:00.483558893 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:00.483810902 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:00.483848095 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:01.704385996 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:01.704643011 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:01.705905914 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:01.705919027 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:01.706317902 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:01.707701921 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:01.707731962 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:01.707802057 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409524918 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409586906 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409627914 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409663916 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.409670115 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409698963 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409723997 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.409746885 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.409782887 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.409790039 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.415693998 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.415760994 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.415770054 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.432634115 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.432683945 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.432693958 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.481215954 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.529750109 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.574951887 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.574975967 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.600833893 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.600927114 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.600944996 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.600977898 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.601027012 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.634746075 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.634776115 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:02.634790897 CET | 49731 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:02.634798050 CET | 443 | 49731 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:03.069087029 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:03.069154024 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:03.069224119 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:03.069647074 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:03.069660902 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:04.284770012 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:04.285115004 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:04.286215067 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:04.286228895 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:04.287175894 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:04.288364887 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:04.288521051 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:04.288563013 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:04.288641930 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:04.288657904 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:05.094767094 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:05.095021009 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:05.095046043 CET | 443 | 49732 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:05.095099926 CET | 49732 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:05.164247036 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:05.164288044 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:05.164352894 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:05.164733887 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:05.164747000 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:06.513289928 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:06.513365030 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:06.514499903 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:06.514513016 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:06.515393019 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:06.516498089 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:06.516594887 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:06.516625881 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:07.265903950 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:07.266187906 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:07.266307116 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:07.266485929 CET | 49733 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:07.266511917 CET | 443 | 49733 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:07.465239048 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:07.465316057 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:07.465414047 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:07.465828896 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:07.465842962 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:08.727663040 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:08.727761030 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:08.729060888 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:08.729070902 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:08.729381084 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:08.730477095 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:08.730626106 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:08.730658054 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:08.730716944 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:08.730726004 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:09.625839949 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:09.626087904 CET | 443 | 49734 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:09.626249075 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:09.626249075 CET | 49734 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:09.929033041 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:09.929081917 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:09.929162025 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:09.929461956 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:09.929475069 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.203865051 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.203989029 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.205755949 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.205769062 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.206197977 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.207724094 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.207822084 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.207832098 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.941689014 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.941827059 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:11.941927910 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.942109108 CET | 49735 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:11.942132950 CET | 443 | 49735 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:12.459300995 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:12.459367037 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:12.459542036 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:12.459822893 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:12.459836960 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.720710039 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.720808029 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.728995085 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.729016066 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.729512930 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.741194010 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.745125055 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.745193005 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.745399952 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.745456934 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.745568991 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.745824099 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.745945930 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.745986938 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746134043 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746182919 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746323109 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746354103 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746366978 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746381044 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746486902 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746526003 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746541023 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746649981 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.746678114 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746716022 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.746737957 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.791352034 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:13.791510105 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.791562080 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.791588068 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:13.839345932 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:14.202658892 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:16.525747061 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:16.525881052 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:16.525979996 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:16.528615952 CET | 49736 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:16.528642893 CET | 443 | 49736 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:16.546622992 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:16.546662092 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:16.546753883 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:16.547245979 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:16.547257900 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:17.765976906 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:17.766046047 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:17.788995028 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:17.789015055 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:17.790041924 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:17.811683893 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:17.811713934 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:17.811861992 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.463454008 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.463568926 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.463685989 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:18.463885069 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:18.463937044 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.463970900 CET | 49738 | 443 | 192.168.2.4 | 104.21.33.116 |
| Nov 23, 2024 15:06:18.463988066 CET | 443 | 49738 | 104.21.33.116 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.465718985 CET | 49740 | 80 | 192.168.2.4 | 147.45.47.81 |
| Nov 23, 2024 15:06:18.585251093 CET | 80 | 49740 | 147.45.47.81 | 192.168.2.4 |
| Nov 23, 2024 15:06:18.585339069 CET | 49740 | 80 | 192.168.2.4 | 147.45.47.81 |
| Nov 23, 2024 15:06:18.585519075 CET | 49740 | 80 | 192.168.2.4 | 147.45.47.81 |
| Nov 23, 2024 15:06:18.705142021 CET | 80 | 49740 | 147.45.47.81 | 192.168.2.4 |
| Nov 23, 2024 15:06:40.569561958 CET | 80 | 49740 | 147.45.47.81 | 192.168.2.4 |
| Nov 23, 2024 15:06:40.569842100 CET | 49740 | 80 | 192.168.2.4 | 147.45.47.81 |
| Nov 23, 2024 15:06:40.570014954 CET | 49740 | 80 | 192.168.2.4 | 147.45.47.81 |
| Nov 23, 2024 15:06:40.689415932 CET | 80 | 49740 | 147.45.47.81 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Nov 23, 2024 15:05:58.017680883 CET | 63896 | 53 | 192.168.2.4 | 1.1.1.1 |
| Nov 23, 2024 15:05:58.370604038 CET | 53 | 63896 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Nov 23, 2024 15:05:58.017680883 CET | 192.168.2.4 | 1.1.1.1 | 0x84ff | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Nov 23, 2024 15:05:58.370604038 CET | 1.1.1.1 | 192.168.2.4 | 0x84ff | No error (0) | 104.21.33.116 | A (IP address) | IN (0x0001) | false | ||
| Nov 23, 2024 15:05:58.370604038 CET | 1.1.1.1 | 192.168.2.4 | 0x84ff | No error (0) | 172.67.162.84 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49740 | 147.45.47.81 | 80 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| Nov 23, 2024 15:06:18.585519075 CET | 198 | OUT |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:05:59 UTC | 265 | OUT | |
| 2024-11-23 14:05:59 UTC | 8 | OUT | |
| 2024-11-23 14:06:00 UTC | 1018 | IN | |
| 2024-11-23 14:06:00 UTC | 7 | IN | |
| 2024-11-23 14:06:00 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49731 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:01 UTC | 266 | OUT | |
| 2024-11-23 14:06:01 UTC | 51 | OUT | |
| 2024-11-23 14:06:02 UTC | 1023 | IN | |
| 2024-11-23 14:06:02 UTC | 346 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 968 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN | |
| 2024-11-23 14:06:02 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49732 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:04 UTC | 285 | OUT | |
| 2024-11-23 14:06:04 UTC | 15331 | OUT | |
| 2024-11-23 14:06:04 UTC | 2842 | OUT | |
| 2024-11-23 14:06:05 UTC | 1019 | IN | |
| 2024-11-23 14:06:05 UTC | 19 | IN | |
| 2024-11-23 14:06:05 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49733 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:06 UTC | 277 | OUT | |
| 2024-11-23 14:06:06 UTC | 8752 | OUT | |
| 2024-11-23 14:06:07 UTC | 1015 | IN | |
| 2024-11-23 14:06:07 UTC | 19 | IN | |
| 2024-11-23 14:06:07 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49734 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:08 UTC | 281 | OUT | |
| 2024-11-23 14:06:08 UTC | 15331 | OUT | |
| 2024-11-23 14:06:08 UTC | 5092 | OUT | |
| 2024-11-23 14:06:09 UTC | 1015 | IN | |
| 2024-11-23 14:06:09 UTC | 19 | IN | |
| 2024-11-23 14:06:09 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49735 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:11 UTC | 274 | OUT | |
| 2024-11-23 14:06:11 UTC | 1214 | OUT | |
| 2024-11-23 14:06:11 UTC | 1022 | IN | |
| 2024-11-23 14:06:11 UTC | 19 | IN | |
| 2024-11-23 14:06:11 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49736 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:13 UTC | 282 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:13 UTC | 15331 | OUT | |
| 2024-11-23 14:06:16 UTC | 1021 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49738 | 104.21.33.116 | 443 | 7328 | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-11-23 14:06:17 UTC | 266 | OUT | |
| 2024-11-23 14:06:17 UTC | 86 | OUT | |
| 2024-11-23 14:06:18 UTC | 1027 | IN | |
| 2024-11-23 14:06:18 UTC | 126 | IN | |
| 2024-11-23 14:06:18 UTC | 5 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 09:05:56 |
| Start date: | 23/11/2024 |
| Path: | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x6b0000 |
| File size: | 495'616 bytes |
| MD5 hash: | FAD119B9DB79CCBFE3A65A13F0822B22 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 09:05:56 |
| Start date: | 23/11/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 09:05:57 |
| Start date: | 23/11/2024 |
| Path: | C:\Users\user\Desktop\Call 0f Duty A1 Launcher.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x6b0000 |
| File size: | 495'616 bytes |
| MD5 hash: | FAD119B9DB79CCBFE3A65A13F0822B22 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
Execution Graph
| Execution Coverage: | 4% |
| Dynamic/Decrypted Code Coverage: | 100% |
| Signature Coverage: | 3.5% |
| Total number of Nodes: | 1663 |
| Total number of Limit Nodes: | 24 |
Graph
Function 006DB18D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295threadinjectionmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BCD10 Relevance: .0, Instructions: 29COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BBEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C6CE6 Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CA732 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C6E00 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CB0CB Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
Download Yara Rule
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C3B60 Relevance: 1.6, APIs: 1, Instructions: 86COMMON
Download Yara Rule
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BCD90 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CBC45 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C4CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BCE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CC7DB Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C5444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C15A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C5200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C5438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C9F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006B86C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C34D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BF980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006BBD50 Relevance: .0, Instructions: 15COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C90D3 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 303COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006D0308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C6F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CDF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C94F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CDC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CC5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006CD22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C8D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 006C45A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0355ECBF Relevance: 6.1, APIs: 4, Instructions: 107COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|