Edit tour

Windows Analysis Report
zq6a1iqg.exe

Overview

General Information

Sample name:	zq6a1iqg.exe
Analysis ID:	1577368
MD5:	fd636191c054ea1e9f60d45bb50eaafc
SHA1:	351cda4cd5f58d474126f5a60f92d4296f28121e
SHA256:	d8efa36e63e09c7999fa217695f94d05e6ba642588f5a9c8f5807c8c816b93c1
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

zq6a1iqg.exe (PID: 6844 cmdline: "C:\Users\user\Desktop\zq6a1iqg.exe" MD5: FD636191C054EA1E9F60D45BB50EAAFC)

MSBuild.exe (PID: 1748 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["leg-sate-boat.sbs", "occupy-blushi.sbs", "powerful-avoids.sbs", "disobey-curly.sbs", "frogs-severz.sbs", "story-tense-faz.sbs", "property-imper.sbs", "blade-govern.sbs", "motion-treesz.sbs"], "Build id": "rFk4jg--yout"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: zq6a1iqg.exe PID: 6844	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 23.55.153.106, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1748, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:50.048256+0100	2028371	3	Unknown Traffic	192.168.2.8	49706	23.55.153.106	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:46.608297+0100	2057812	1	Domain Observed Used for C2 Detected	192.168.2.8	52470	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:47.317603+0100	2057814	1	Domain Observed Used for C2 Detected	192.168.2.8	50618	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:45.953375+0100	2057818	1	Domain Observed Used for C2 Detected	192.168.2.8	63917	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:47.073586+0100	2057824	1	Domain Observed Used for C2 Detected	192.168.2.8	61625	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:47.544511+0100	2057826	1	Domain Observed Used for C2 Detected	192.168.2.8	50347	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:46.376546+0100	2057830	1	Domain Observed Used for C2 Detected	192.168.2.8	55571	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:47.774985+0100	2057834	1	Domain Observed Used for C2 Detected	192.168.2.8	63821	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:45.722572+0100	2057836	1	Domain Observed Used for C2 Detected	192.168.2.8	61750	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:46.844563+0100	2057842	1	Domain Observed Used for C2 Detected	192.168.2.8	59550	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:41:50.839388+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.8	49706	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://blade-govern.sbs:443/apii	Avira URL Cloud: Label: malware
Source: https://powerful-avoids.sbs:443/apih5	Avira URL Cloud: Label: malware
Source: https://motion-treesz.sbs:443/api	Avira URL Cloud: Label: malware
Source: property-imper.sbs	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.zq6a1iqg.exe.4719838.4.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["leg-sate-boat.sbs", "occupy-blushi.sbs", "powerful-avoids.sbs", "disobey-curly.sbs", "frogs-severz.sbs", "story-tense-faz.sbs", "property-imper.sbs", "blade-govern.sbs", "motion-treesz.sbs"], "Build id": "rFk4jg--yout"}

Multi AV Scanner detection for submitted file

Source: zq6a1iqg.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: zq6a1iqg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: powerful-avoids.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: motion-treesz.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: disobey-curly.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: leg-sate-boat.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: story-tense-faz.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: blade-govern.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: occupy-blushi.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: frogs-severz.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: property-imper.sbs
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rFk4jg--yout

Source: zq6a1iqg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.8:49706 version: TLS 1.2

Source: zq6a1iqg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: f:\dd\xcp\clr\mef\src\ComponentModel\obj\Debug\System.ComponentModel.Composition.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\zYRQQg.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp, zq6a1iqg.exe, 00000001.00000002.1536075132.0000000005B60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: private_cheat.pdb source: zq6a1iqg.exe
Source:	Binary string: PE.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp, zq6a1iqg.exe, 00000001.00000002.1534833355.00000000054A0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_02D9E8A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	2_2_0043C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C18BC4BAh	2_2_0043C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6DBC3610h	2_2_0043C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	2_2_0043C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push eax	2_2_0043B860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00420870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, eax	2_2_0040C02B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push eax	2_2_0043F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edi, eax	2_2_0043F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	2_2_0040E0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, eax	2_2_0043B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, ecx	2_2_0043B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	2_2_0043BCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	2_2_004098F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, ebp	2_2_00405C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, ebp	2_2_00405C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, ecx	2_2_0040BC9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00428CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	2_2_0040E970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	2_2_0040AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_0040EA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	2_2_00425E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	2_2_0040E35B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-58FA0F6Ch]	2_2_00440F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], bl	2_2_0040CF05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	2_2_004077D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	2_2_004077D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057818 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs) : 192.168.2.8:63917 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057814 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs) : 192.168.2.8:50618 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057834 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs) : 192.168.2.8:63821 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057824 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs) : 192.168.2.8:61625 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057836 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs) : 192.168.2.8:61750 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057830 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs) : 192.168.2.8:55571 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057812 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs) : 192.168.2.8:52470 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057842 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs) : 192.168.2.8:59550 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057826 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs) : 192.168.2.8:50347 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.8:49706 -> 23.55.153.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: leg-sate-boat.sbs
Source: Malware configuration extractor	URLs: occupy-blushi.sbs
Source: Malware configuration extractor	URLs: powerful-avoids.sbs
Source: Malware configuration extractor	URLs: disobey-curly.sbs
Source: Malware configuration extractor	URLs: frogs-severz.sbs
Source: Malware configuration extractor	URLs: story-tense-faz.sbs
Source: Malware configuration extractor	URLs: property-imper.sbs
Source: Malware configuration extractor	URLs: blade-govern.sbs
Source: Malware configuration extractor	URLs: motion-treesz.sbs

Source: Joe Sandbox View

IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49706 -> 23.55.153.106:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs
Source: global traffic	DNS traffic detected: DNS query: occupy-blushi.sbs
Source: global traffic	DNS traffic detected: DNS query: blade-govern.sbs
Source: global traffic	DNS traffic detected: DNS query: story-tense-faz.sbs
Source: global traffic	DNS traffic detected: DNS query: leg-sate-boat.sbs
Source: global traffic	DNS traffic detected: DNS query: disobey-curly.sbs
Source: global traffic	DNS traffic detected: DNS query: motion-treesz.sbs
Source: global traffic	DNS traffic detected: DNS query: powerful-avoids.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: zq6a1iqg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: zq6a1iqg.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: zq6a1iqg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: zq6a1iqg.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: zq6a1iqg.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs:443/apii
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs:443/api
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs:443/api
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs:443/apih5
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: zq6a1iqg.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/B
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1585313514.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/xZ
Source: MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.8:49706 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00434470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434470

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00434470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434470

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_02D909F8	1_2_02D909F8
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_02D909E7	1_2_02D909E7
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E70040	1_2_05E70040
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E785A0	1_2_05E785A0
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E78590	1_2_05E78590
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E70006	1_2_05E70006
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E7B7AC	1_2_05E7B7AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004089A0	2_2_004089A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B210	2_2_0040B210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404040	2_2_00404040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406840	2_2_00406840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043C040	2_2_0043C040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00420870	2_2_00420870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00439030	2_2_00439030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406CC0	2_2_00406CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004094D0	2_2_004094D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043F8D0	2_2_0043F8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E0D8	2_2_0040E0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043B8E0	2_2_0043B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004324E0	2_2_004324E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004098F0	2_2_004098F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00440C80	2_2_00440C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405C90	2_2_00405C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428CB0	2_2_00428CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E970	2_2_0040E970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00423D70	2_2_00423D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040AD00	2_2_0040AD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00419530	2_2_00419530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004341D0	2_2_004341D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00403580	2_2_00403580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00441580	2_2_00441580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004061A0	2_2_004061A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00420650	2_2_00420650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409210	2_2_00409210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00427E20	2_2_00427E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00404AC0	2_2_00404AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00425E90	2_2_00425E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041FB60	2_2_0041FB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00440F60	2_2_00440F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00428770	2_2_00428770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040CF05	2_2_0040CF05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041DB30	2_2_0041DB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004027D0	2_2_004027D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004077D0	2_2_004077D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043C780	2_2_0043C780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00421790	2_2_00421790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004387B0	2_2_004387B0

Source: zq6a1iqg.exe

Static PE information: invalid certificate

Source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.ComponentModel.Composition.dllP vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezYRQQg.dll0 vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1530989407.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1534833355.00000000054A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1536075132.0000000005B60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamezYRQQg.dll0 vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000002.1529896140.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zq6a1iqg.exe
Source: zq6a1iqg.exe, 00000001.00000000.1516510208.0000000000BBA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameprivate_cheat.exe$ vs zq6a1iqg.exe
Source: zq6a1iqg.exe	Binary or memory string: OriginalFilenameprivate_cheat.exe$ vs zq6a1iqg.exe

Source: zq6a1iqg.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: zq6a1iqg.exe, oFWTbkIg9bJS30O2a7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: zq6a1iqg.exe, oFWTbkIg9bJS30O2a7.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.zq6a1iqg.exe.4719838.4.raw.unpack, QAWUVRRgq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.zq6a1iqg.exe.5b60000.8.raw.unpack, QAWUVRRgq.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@10/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00439030 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,

2_2_00439030

Source: C:\Users\user\Desktop\zq6a1iqg.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zq6a1iqg.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Mutant created: NULL

Source: zq6a1iqg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: zq6a1iqg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zq6a1iqg.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\zq6a1iqg.exe "C:\Users\user\Desktop\zq6a1iqg.exe"
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: zq6a1iqg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: zq6a1iqg.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: zq6a1iqg.exe

Static file information: File size 2394760 > 1048576

Source: zq6a1iqg.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x224600

Source: zq6a1iqg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: zq6a1iqg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: f:\dd\xcp\clr\mef\src\ComponentModel\obj\Debug\System.ComponentModel.Composition.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\zYRQQg.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp, zq6a1iqg.exe, 00000001.00000002.1536075132.0000000005B60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: private_cheat.pdb source: zq6a1iqg.exe
Source:	Binary string: PE.pdb source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp, zq6a1iqg.exe, 00000001.00000002.1534833355.00000000054A0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: zq6a1iqg.exe, oFWTbkIg9bJS30O2a7.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: zq6a1iqg.exe, hIfWcQBjh30Uw5ArLk.cs

.Net Code: baiwYuCFtO System.Reflection.Assembly.Load(byte[])

Source: zq6a1iqg.exe

Static PE information: 0xB79A8A14 [Fri Aug 12 07:07:00 2067 UTC]

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E7E1A2 push es; ret	1_2_05E7E141
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Code function: 1_2_05E7E13B push es; ret	1_2_05E7E141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00415057 push eax; iretd	2_2_00415058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00418028 push esp; ret	2_2_0041802B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041642B push esp; ret	2_2_00416438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00418100 push esp; iretd	2_2_00418102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041811F push esp; iretd	2_2_00418135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004181DA push eax; iretd	2_2_004181DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00414BB8 push esp; iretd	2_2_00414BD4

Source: zq6a1iqg.exe, rwwX7ZJOf4sV9hOXmD.cs	High entropy of concatenated method names: 'fOfN4sV9h', 'jXmIDFh0b', 'rAV2SJu7o', 'y9vXHShSw5j44RcUh6', 'Owaj5QoABeTJB1SVnD', 'HAHtrm0X8QMN4Q406c', 'iMOw5paX9Qv2ECpnQy', 'w5hbBY6ajCEgJZj4ft', 'zPKi4g3rkHwlTXVK9Z', 'G5F2eBLqfi3Qt7AnDp'
Source: zq6a1iqg.exe, hIfWcQBjh30Uw5ArLk.cs	High entropy of concatenated method names: 'lLHifFIsCLsZtjvFfN0i', 'baiwYuCFtO', 'pZIwB34GcQ', 'JhPLburkmddrsLpKLs7', 'alEuQJrKZrn2upo8JRk', 'J829tRrYml1DVCs5UyR', 'cWNjFSr9RZWlDV35X7m', 'O4iQdPrfXuDIiCUDu4X', 'Yk4YKkri36HeOnOlCk0', 'GhA7sXrmf0J3o1pV0aq'
Source: zq6a1iqg.exe, f0ZdMK8RDlgUQi1tf3.cs	High entropy of concatenated method names: 'aMnbd9qep6', 'warbA3rO4X', 'Equals', 'GetHashCode', 'z8mbtoCJFQ', 'ToString', 'Mf9PWSre9MKVTQ5SlDI', 'O1lVWgrNxtDw78prVK8', 'NdlnrPr4k26ZpJOY3wr', 'x1cFd5rUDRwOLKbRJSx'
Source: zq6a1iqg.exe, oFWTbkIg9bJS30O2a7.cs	High entropy of concatenated method names: 'D5UOp2rbvyUL5H3JR4Y', 'KwHKavrhVOvWQQRSV1l', 'ce4DmfsmSrOT856tDgfrkMb', 'QUOwe7Aox2', 'Jbn4AKraiBWXIquRfBJ', 'LbPgSxr6i8VYV9i45Hk', 'g96K4Ar39JdtZAg6A8d', 'E0anAmrgrDcUTo3q5Ca', 'XiINNIrIYPcBWn2u7kR', 'Ebqt7lrtVlqGhwh7OrP'
Source: zq6a1iqg.exe, UserControlAuth.cs	High entropy of concatenated method names: 'Dispose', 'Hm2xDFCVA', 'MtgOr6Husb', 'oE1OeSBQDE', 'xupOwl8Ij2', 'A2SOSoCZLY', 'oqROqY2oTi', 'Y6yOMBXF2I', 'I87OPkZn6W', 'yPKOiH7A7g'
Source: zq6a1iqg.exe, vIkgBnXU3Lk4Ne7nbW.cs	High entropy of concatenated method names: 'XlEwMsq62X', 'a08wgTnE1X', 'UfjwTUQTSK', 'fnQwD9aasX', 'skHwskHUYy', 'K9SwFe8JK1', 'YkiwkamY0D', 'LwtwPDLkbB', 'OQvwmj1hcP', 'rviwzxvF8E'

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: zq6a1iqg.exe PID: 6844, type: MEMORYSTR

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe TID: 6208	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe TID: 6388	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6492	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: zq6a1iqg.exe, 00000001.00000002.1531344659.0000000004344000.00000004.00000800.00020000.00000000.sdmp, zq6a1iqg.exe, 00000001.00000002.1536075132.0000000005B60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: RXYEMBXBYYLMBOWIUQZKYAZNZEFKHGFSUNPISAPMANMFSGDAMEFXTWZRXLEIWMURSTROZNPTANKK

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0043DF70 LdrInitializeThunk,

2_2_0043DF70

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 445000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 457000	Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F0E008	Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe	Queries volume information: C:\Users\user\Desktop\zq6a1iqg.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\zq6a1iqg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\zq6a1iqg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zq6a1iqg.exe	76%	ReversingLabs	Win32.Trojan.Remcos
zq6a1iqg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://blade-govern.sbs:443/apii	100%	Avira URL Cloud	malware
https://powerful-avoids.sbs:443/apih5	100%	Avira URL Cloud	malware
https://motion-treesz.sbs:443/api	100%	Avira URL Cloud	malware
property-imper.sbs	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
occupy-blushi.sbs	unknown	unknown	false	high
disobey-curly.sbs	unknown	unknown	false	high
blade-govern.sbs	unknown	unknown	false	high
story-tense-faz.sbs	unknown	unknown	false	high
powerful-avoids.sbs	unknown	unknown	false	high
motion-treesz.sbs	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
frogs-severz.sbs	unknown	unknown	false	high
leg-sate-boat.sbs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
blade-govern.sbs	false		high
powerful-avoids.sbs	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
occupy-blushi.sbs	false		high
motion-treesz.sbs	false		high
property-imper.sbs	true	Avira URL Cloud: malware	unknown
leg-sate-boat.sbs	false		high
disobey-curly.sbs	false		high
story-tense-faz.sbs	false		high
frogs-severz.sbs	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	zq6a1iqg.exe	false		high
http://ocsp.sectigo.com0	zq6a1iqg.exe	false		high
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blade-govern.sbs:443/apii	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	zq6a1iqg.exe	false		high
https://medal.tv	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerful-avoids.sbs:443/apih5	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://motion-treesz.sbs:443/api	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/B	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	zq6a1iqg.exe	false		high
https://steamcommunity.com/xZ	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	zq6a1iqg.exe	false		high
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199724331900	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://occupy-blushi.sbs:443/api	MSBuild.exe, 00000002.00000002.1585038483.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	zq6a1iqg.exe	false		high
https://www.google.com/recaptcha/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000002.00000002.1584810588.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	MSBuild.exe, 00000002.00000002.1585313514.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	MSBuild.exe, 00000002.00000002.1586248835.00000000012D5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577368
Start date and time:	2024-12-18 12:40:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zq6a1iqg.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/1@10/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 41 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: zq6a1iqg.exe

Simulations

Behavior and APIs

Time	Type	Description
06:41:43	API Interceptor	1x Sleep call for process: zq6a1iqg.exe modified
06:41:44	API Interceptor	5x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.55.153.106	cccc2.exe	Get hash	malicious	LummaC	Browse
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	99awhy8l.exe	Get hash	malicious	LummaC	Browse
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	23.44.201.32

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

Process:	C:\Users\user\Desktop\zq6a1iqg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.363435887027673
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTt92W+P12MUAvvrs:Q3La/KDLI4MWuPTAt92n4M6
MD5:	073F05396DE9273ED9563E2E299BB296
SHA1:	3EBA610FE88F782B4BCA99C3C39DC6AF65C574ED
SHA-256:	C180FCC444FA7EAAC96D0EBC011ADA54DCFF3022C06087CB2526A182BA05C30B
SHA-512:	354432510FD8C60EAC239DC8E9BE7A8C92CACB0FC09F3908721D41B8BBD8F480E88D650BC6AB306CAFE3D189660356200BB2F5E11143776222A75B2F9C5748BE
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.949608835675208
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	zq6a1iqg.exe
File size:	2'394'760 bytes
MD5:	fd636191c054ea1e9f60d45bb50eaafc
SHA1:	351cda4cd5f58d474126f5a60f92d4296f28121e
SHA256:	d8efa36e63e09c7999fa217695f94d05e6ba642588f5a9c8f5807c8c816b93c1
SHA512:	0e4c0f02081bc77115479f136aa2bbd5a8ec6f1d83119b74ceec3a3ee98116c1557623328095a32fd99d380b9f43b519933e307f333f5c6b927774587fb07436
SSDEEP:	49152:5X3GDR6HM+RNLVqzAJamOHZF+Pzgvk9afAPr1686itwodRTOayqf/L:5X3o6HMmVUAk4bgcAfAPJhztwouayqfz
TLSH:	22B5231F72A9CF42D19014B2C1CFC8B427E26CA79A7AEB553B48321B1FF9267DD1111A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................F".. .......d".. ...."...@.. ........................$.....<.$...@................................

File Icon


Icon Hash:	c7637f7164645095

Static PE Info

General

Entrypoint:	0x6264be
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB79A8A14 [Fri Aug 12 07:07:00 2067 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Oppo Electronic Korea
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	17/11/2024 18:14:17 18/11/2034 18:14:17
Subject Chain	CN=Oppo Electronic Korea
Version:	3
Thumbprint MD5:	CBBCA22547E35857495BF30584BB10CF
Thumbprint SHA-1:	8FA494CAB924441A9FEB3D7D9CE971AC5B1AEA9E
Thumbprint SHA-256:	8537E18CB0EE231AF45FA04E3E11F513DE08EED65293126EA94454135952884F
Serial:	54FECD73D26608B944146AFDD037D542

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x226470	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22a000	0x21b8c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x246a00	0x2088	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x226423	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2244c4	0x224600	01d096a732019c0565e3d97baaf00c2d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.sdata	0x228000	0x1e8	0x200	ba1a51c546597b8fdcb7d0154e4ab651	False	0.857421875	data	6.638446248926509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22a000	0x21b8c	0x21c00	c7d8b3432c4961cdef428290237c75ee	False	0.5937861689814815	DIY-Thermocam raw data (Lepton 2.x), scale -13875--13824, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 144115188075855872.000000	6.500294930322141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24c000	0xc	0x200	8ea5d68875b502e916028994b7bba8eb	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x22a1c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.676125703564728
RT_ICON	0x22b268	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.48187293339631554
RT_ICON	0x22f490	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.3423192949248787
RT_ICON	0x23fcb8	0xb63c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9990997170539312
RT_GROUP_ICON	0x24b2f4	0x3e	data	0.8225806451612904
RT_VERSION	0x24b334	0x66c	data	0.2773722627737226
RT_MANIFEST	0x24b9a0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T12:41:45.722572+0100	2057836	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs)	1	192.168.2.8	61750	1.1.1.1	53	UDP
2024-12-18T12:41:45.953375+0100	2057818	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs)	1	192.168.2.8	63917	1.1.1.1	53	UDP
2024-12-18T12:41:46.376546+0100	2057830	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs)	1	192.168.2.8	55571	1.1.1.1	53	UDP
2024-12-18T12:41:46.608297+0100	2057812	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs)	1	192.168.2.8	52470	1.1.1.1	53	UDP
2024-12-18T12:41:46.844563+0100	2057842	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs)	1	192.168.2.8	59550	1.1.1.1	53	UDP
2024-12-18T12:41:47.073586+0100	2057824	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs)	1	192.168.2.8	61625	1.1.1.1	53	UDP
2024-12-18T12:41:47.317603+0100	2057814	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs)	1	192.168.2.8	50618	1.1.1.1	53	UDP
2024-12-18T12:41:47.544511+0100	2057826	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs)	1	192.168.2.8	50347	1.1.1.1	53	UDP
2024-12-18T12:41:47.774985+0100	2057834	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs)	1	192.168.2.8	63821	1.1.1.1	53	UDP
2024-12-18T12:41:50.048256+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49706	23.55.153.106	443	TCP
2024-12-18T12:41:50.839388+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.8	49706	23.55.153.106	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:41:38.166093111 CET	49676	443	192.168.2.8	52.182.143.211
Dec 18, 2024 12:41:38.416099072 CET	49673	443	192.168.2.8	23.206.229.226
Dec 18, 2024 12:41:38.744254112 CET	49672	443	192.168.2.8	23.206.229.226
Dec 18, 2024 12:41:40.791332006 CET	49677	80	192.168.2.8	192.229.211.108
Dec 18, 2024 12:41:48.025486946 CET	49673	443	192.168.2.8	23.206.229.226
Dec 18, 2024 12:41:48.213893890 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:48.213954926 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:48.214035988 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:48.353559017 CET	49672	443	192.168.2.8	23.206.229.226
Dec 18, 2024 12:41:48.650160074 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:48.650185108 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.048105001 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.048255920 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.053869009 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.053874969 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.054341078 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.103564978 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.108486891 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.155337095 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.792819977 CET	443	49705	23.206.229.226	192.168.2.8
Dec 18, 2024 12:41:50.793000937 CET	49705	443	192.168.2.8	23.206.229.226
Dec 18, 2024 12:41:50.839449883 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.839489937 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.839646101 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.839646101 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.839663982 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.839677095 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.839683056 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:50.839695930 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:50.840147972 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.017584085 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:51.017687082 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:51.017699003 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.017723083 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:51.017785072 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.025141954 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:51.025249004 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.037306070 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.037306070 CET	49706	443	192.168.2.8	23.55.153.106
Dec 18, 2024 12:41:51.037332058 CET	443	49706	23.55.153.106	192.168.2.8
Dec 18, 2024 12:41:51.037343025 CET	443	49706	23.55.153.106	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:41:45.722572088 CET	61750	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:45.946563959 CET	53	61750	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:45.953375101 CET	63917	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:46.350291014 CET	53	63917	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:46.376545906 CET	55571	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:46.603393078 CET	53	55571	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:46.608297110 CET	52470	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:46.840184927 CET	53	52470	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:46.844563007 CET	59550	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:47.068253994 CET	53	59550	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:47.073585987 CET	61625	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:47.313752890 CET	53	61625	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:47.317603111 CET	50618	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:47.541815042 CET	53	50618	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:47.544511080 CET	50347	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:47.772561073 CET	53	50347	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:47.774985075 CET	63821	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:48.006917953 CET	53	63821	1.1.1.1	192.168.2.8
Dec 18, 2024 12:41:48.059348106 CET	55848	53	192.168.2.8	1.1.1.1
Dec 18, 2024 12:41:48.196715117 CET	53	55848	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 12:41:45.722572088 CET	192.168.2.8	1.1.1.1	0xa9bb	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:45.953375101 CET	192.168.2.8	1.1.1.1	0xea78	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.376545906 CET	192.168.2.8	1.1.1.1	0x2e5d	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.608297110 CET	192.168.2.8	1.1.1.1	0xb938	Standard query (0)	blade-govern.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.844563007 CET	192.168.2.8	1.1.1.1	0xaeb1	Standard query (0)	story-tense-faz.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.073585987 CET	192.168.2.8	1.1.1.1	0x52c3	Standard query (0)	leg-sate-boat.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.317603111 CET	192.168.2.8	1.1.1.1	0x8735	Standard query (0)	disobey-curly.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.544511080 CET	192.168.2.8	1.1.1.1	0x43c8	Standard query (0)	motion-treesz.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.774985075 CET	192.168.2.8	1.1.1.1	0x46df	Standard query (0)	powerful-avoids.sbs	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:48.059348106 CET	192.168.2.8	1.1.1.1	0x2e5e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 12:41:45.946563959 CET	1.1.1.1	192.168.2.8	0xa9bb	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.350291014 CET	1.1.1.1	192.168.2.8	0xea78	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.603393078 CET	1.1.1.1	192.168.2.8	0x2e5d	Name error (3)	occupy-blushi.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:46.840184927 CET	1.1.1.1	192.168.2.8	0xb938	Name error (3)	blade-govern.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.068253994 CET	1.1.1.1	192.168.2.8	0xaeb1	Name error (3)	story-tense-faz.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.313752890 CET	1.1.1.1	192.168.2.8	0x52c3	Name error (3)	leg-sate-boat.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.541815042 CET	1.1.1.1	192.168.2.8	0x8735	Name error (3)	disobey-curly.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:47.772561073 CET	1.1.1.1	192.168.2.8	0x43c8	Name error (3)	motion-treesz.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:48.006917953 CET	1.1.1.1	192.168.2.8	0x46df	Name error (3)	powerful-avoids.sbs	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:41:48.196715117 CET	1.1.1.1	192.168.2.8	0x2e5e	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	23.55.153.106	443	1748	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:41:50 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 11:41:50 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 11:41:50 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=7c4a9ff0e836dad5a65f53cc; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 11:41:50 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 11:41:51 UTC	10097	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>
2024-12-18 11:41:51 UTC	1089	IN	Data Raw: 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 09 Data Ascii: heir respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br>

Target ID:	1
Start time:	06:41:42
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\zq6a1iqg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zq6a1iqg.exe"
Imagebase:	0x990000
File size:	2'394'760 bytes
MD5 hash:	FD636191C054EA1E9F60D45BB50EAAFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:41:44
Start date:	18/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xd40000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	95
Total number of Limit Nodes:	2

Executed Functions

Function 05E70006 Relevance: 491.5, Strings: 387, Instructions: 7751
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 05E717DB
4, xrefs: 05E72AB1
F, xrefs: 05E745FE
U, xrefs: 05E7291B
4, xrefs: 05E74662
M, xrefs: 05E71167
4, xrefs: 05E75B30
T, xrefs: 05E739C3
U, xrefs: 05E741C5
c, xrefs: 05E71E25
0, xrefs: 05E76CD4
b, xrefs: 05E702CF
F, xrefs: 05E75E44
$, xrefs: 05E743BD
S, xrefs: 05E74C10
/, xrefs: 05E742B7
K, xrefs: 05E72EE9
\, xrefs: 05E70C69
&, xrefs: 05E74E86
wg(B, xrefs: 05E76E5E
M, xrefs: 05E709A1
_|B, xrefs: 05E7618A
;, xrefs: 05E737B1
$, xrefs: 05E7491A
h[B, xrefs: 05E7598E
h[B, xrefs: 05E771D4
Eb, xrefs: 05E75284
@, xrefs: 05E71BED
c, xrefs: 05E73405
$, xrefs: 05E77196
/, xrefs: 05E73325
c, xrefs: 05E74EA4
5c2B, xrefs: 05E71E3D
", xrefs: 05E702A9
Da:B, xrefs: 05E73D2D
_|B, xrefs: 05E7316F
', xrefs: 05E708E3
/, xrefs: 05E71A7B
3, xrefs: 05E70EA1
5, xrefs: 05E74195
?Z\A, xrefs: 05E70D99
Y, xrefs: 05E76DB2
N, xrefs: 05E72EF5
6, xrefs: 05E72989
4, xrefs: 05E74D68
", xrefs: 05E7463E
$, xrefs: 05E7189B
_, xrefs: 05E70287
a, xrefs: 05E7575C
%, xrefs: 05E70B53
c, xrefs: 05E765A2
A, xrefs: 05E7062F
4, xrefs: 05E768A4
[, xrefs: 05E73B3F
K, xrefs: 05E7163F
$, xrefs: 05E73145
0, xrefs: 05E7240F
`, xrefs: 05E711FF
4, xrefs: 05E72E8D
;, xrefs: 05E71F07
N, xrefs: 05E72F95
a, xrefs: 05E71063
H, xrefs: 05E7668E
c, xrefs: 05E736CF
E, xrefs: 05E710A7
, xrefs: 05E71217
E, xrefs: 05E71D5D
E, xrefs: 05E72E75
;, xrefs: 05E767CC
J, xrefs: 05E71137
c, xrefs: 05E761BE
/, xrefs: 05E74F34
?OB, xrefs: 05E73B97
0, xrefs: 05E7512E
c, xrefs: 05E766EA
$, xrefs: 05E773D8
/, xrefs: 05E772D2
-, xrefs: 05E73FA1
4, xrefs: 05E71CE9
6, xrefs: 05E75A08
Da:B, xrefs: 05E75502
6, xrefs: 05E74233
7, xrefs: 05E705A7
J, xrefs: 05E724A9
N, xrefs: 05E75F10
Y, xrefs: 05E71DD5
N, xrefs: 05E75FB0
9, xrefs: 05E74B9A
6, xrefs: 05E70C4F
$, xrefs: 05E75B92
;, xrefs: 05E77330
S, xrefs: 05E71B91
Z, xrefs: 05E711B5
$, xrefs: 05E7417B
5, xrefs: 05E70FC5
<, xrefs: 05E76EE0
4, xrefs: 05E77376
L, xrefs: 05E70639
Eb, xrefs: 05E76ACA
%, xrefs: 05E721C3
F, xrefs: 05E742AB
V8iB, xrefs: 05E70497
', xrefs: 05E702F7
wg(B, xrefs: 05E72599
/, xrefs: 05E74AFA
Y, xrefs: 05E73D97
M, xrefs: 05E73D5F
a, xrefs: 05E77128
, xrefs: 05E75EDC
,, xrefs: 05E708C5
@, xrefs: 05E764B2
Z, xrefs: 05E70347
;, xrefs: 05E74F86
Y, xrefs: 05E7556C
N: B, xrefs: 05E75B4A
0, xrefs: 05E73959
L, xrefs: 05E7009A
b, xrefs: 05E7590C
T, xrefs: 05E72119
TZB, xrefs: 05E71231
B, xrefs: 05E7392F
7, xrefs: 05E7096B
?OB, xrefs: 05E7536C
_, xrefs: 05E75EC2
F, xrefs: 05E72A01
*, xrefs: 05E7021D
b, xrefs: 05E710F3
[, xrefs: 05E72295
b, xrefs: 05E7036B
X, xrefs: 05E74C3A
c, xrefs: 05E718F9
E, xrefs: 05E7057B
;, xrefs: 05E72A6B
H, xrefs: 05E74E48
fw4@, xrefs: 05E754CE
U, xrefs: 05E704F1
0, xrefs: 05E7548E
Y, xrefs: 05E758A4
/, xrefs: 05E7375F
wg(B, xrefs: 05E73E43
:, xrefs: 05E706D7
>, xrefs: 05E762D4
?OB, xrefs: 05E76BB2
, xrefs: 05E72EC1
E, xrefs: 05E7612A
#, xrefs: 05E728B3
&, xrefs: 05E766CC
<, xrefs: 05E7261B
%, xrefs: 05E73A6D
", xrefs: 05E712B9
4, xrefs: 05E715E3
<, xrefs: 05E70753
X, xrefs: 05E71BBB
H, xrefs: 05E71DC9
-, xrefs: 05E748CA
$, xrefs: 05E76160
B, xrefs: 05E70407
$, xrefs: 05E75950
', xrefs: 05E70531
-, xrefs: 05E75776
N, xrefs: 05E716EB
;, xrefs: 05E75AEA
#, xrefs: 05E7415D
*, xrefs: 05E70659
a, xrefs: 05E73F87
\, xrefs: 05E70EAD
5, xrefs: 05E742FB
Y, xrefs: 05E7399F
B, xrefs: 05E7715E
E, xrefs: 05E715CB
N: B, xrefs: 05E77390
A, xrefs: 05E708D9
Y, xrefs: 05E770EA
9, xrefs: 05E7485A
4, xrefs: 05E73593
C, xrefs: 05E70A21
c, xrefs: 05E731A3
b, xrefs: 05E70F69
<, xrefs: 05E73EC5
B, xrefs: 05E72085
,, xrefs: 05E70447
B, xrefs: 05E74143
J, xrefs: 05E73D53
4, xrefs: 05E71FDF
M, xrefs: 05E75534
c, xrefs: 05E76420
(, xrefs: 05E70DD9
9, xrefs: 05E73085
B, xrefs: 05E7694A
J, xrefs: 05E7507C
W, xrefs: 05E770F6
c, xrefs: 05E74978
W, xrefs: 05E740DB
5, xrefs: 05E7043D
#, xrefs: 05E757B8
#, xrefs: 05E73FE3
U, xrefs: 05E7599A
=, xrefs: 05E722C9
_, xrefs: 05E715FD
E, xrefs: 05E74DDC
O, xrefs: 05E70CBB
E, xrefs: 05E748E4
<, xrefs: 05E7569A
h[B, xrefs: 05E741B9
X, xrefs: 05E76480
9, xrefs: 05E70B2F
fw4@, xrefs: 05E73CF9
@, xrefs: 05E704A9
E, xrefs: 05E7464A
c, xrefs: 05E74BDA
H, xrefs: 05E73673
b, xrefs: 05E74137
Z, xrefs: 05E70853
Q, xrefs: 05E70F05
6, xrefs: 05E7724E
T, xrefs: 05E75198
N, xrefs: 05E7476A
h[B, xrefs: 05E7290F
W, xrefs: 05E72831
Y, xrefs: 05E724ED
O, xrefs: 05E71249
-, xrefs: 05E726F7
Y, xrefs: 05E72825
a, xrefs: 05E758E2
Y, xrefs: 05E7367F
c, xrefs: 05E71B5B
Y, xrefs: 05E7669A
E, xrefs: 05E7310F
., xrefs: 05E70899
W, xrefs: 05E758B0
Y, xrefs: 05E74E54
7, xrefs: 05E705DD
Dd9B, xrefs: 05E72A25
c, xrefs: 05E73587
Dd9B, xrefs: 05E75AA4
", xrefs: 05E72E69
5c2B, xrefs: 05E76702
>, xrefs: 05E71A0F
E, xrefs: 05E75E90
a, xrefs: 05E726DD
$, xrefs: 05E728D1
Da:B, xrefs: 05E76D48
E, xrefs: 05E76622
N: B, xrefs: 05E72ACB
0, xrefs: 05E76974
E, xrefs: 05E70FB9
K, xrefs: 05E75F04
F, xrefs: 05E75A80
;, xrefs: 05E70207
\, xrefs: 05E70335
a, xrefs: 05E70E17
N, xrefs: 05E746CA
_|B, xrefs: 05E74944
H, xrefs: 05E73BC3
ZM|B, xrefs: 05E70F5D
_|B, xrefs: 05E718C5
H, xrefs: 05E75398
a, xrefs: 05E76FA2
4, xrefs: 05E765AE
J, xrefs: 05E738A7
B, xrefs: 05E70D2F
9, xrefs: 05E760A0
U, xrefs: 05E771E0
5c2B, xrefs: 05E74EBC
, xrefs: 05E70955
+, xrefs: 05E70A17
@, xrefs: 05E70F51
4, xrefs: 05E73889
fw4@, xrefs: 05E76D14
M, xrefs: 05E724B5
2MB, xrefs: 05E70DA5
5, xrefs: 05E72A51
H, xrefs: 05E76BDE
c, xrefs: 05E71CDD
T, xrefs: 05E769DE
-, xrefs: 05E7184B
;, xrefs: 05E701F5
5, xrefs: 05E77316
E, xrefs: 05E73607
X, xrefs: 05E70F11
Y, xrefs: 05E75174
5, xrefs: 05E7596A
/, xrefs: 05E75A8C
N: B, xrefs: 05E74375
Eb, xrefs: 05E73AAF
F, xrefs: 05E72E29
_, xrefs: 05E72EA7
Eb, xrefs: 05E72205
5, xrefs: 05E75AD0
!, xrefs: 05E706E1
?OB, xrefs: 05E722ED
;, xrefs: 05E74315
a, xrefs: 05E7410D
L, xrefs: 05E7072B
#, xrefs: 05E77178
Y, xrefs: 05E720F5
4, xrefs: 05E7505E
D, xrefs: 05E701EB
, xrefs: 05E71617
Z, xrefs: 05E706F7
%, xrefs: 05E76A88
4, xrefs: 05E75EA8
>, xrefs: 05E732B9
c, xrefs: 05E707B5
", xrefs: 05E709E5
_, xrefs: 05E70B91
', xrefs: 05E702C5
-, xrefs: 05E730F5
Y, xrefs: 05E7078D
H, xrefs: 05E72319
9, xrefs: 05E763E0
Y, xrefs: 05E740CF
:, xrefs: 05E701C7
Dd9B, xrefs: 05E742CF
c, xrefs: 05E74D5C
J, xrefs: 05E75528
-, xrefs: 05E76FBC
S, xrefs: 05E7343B
%, xrefs: 05E75242
J, xrefs: 05E768C2
wg(B, xrefs: 05E75618
N, xrefs: 05E7164B
[, xrefs: 05E75314
/, xrefs: 05E71EB5
, xrefs: 05E70102
M, xrefs: 05E76D7A
", xrefs: 05E75E84
S, xrefs: 05E76456
Y, xrefs: 05E769BA
J, xrefs: 05E71FFD
5, xrefs: 05E728EB
=, xrefs: 05E73B73
B, xrefs: 05E75104
a, xrefs: 05E72863
Dd9B, xrefs: 05E772EA
=, xrefs: 05E70C43
@, xrefs: 05E74C6C
B, xrefs: 05E72899
F, xrefs: 05E7157F
0, xrefs: 05E720AF
&, xrefs: 05E736B1
[, xrefs: 05E70AA7
B, xrefs: 05E75918
9, xrefs: 05E71B1B
=QOB, xrefs: 05E7014A
5, xrefs: 05E771B0
#, xrefs: 05E76FFE
@, xrefs: 05E73497
>, xrefs: 05E74A8E
[, xrefs: 05E76B5A
fw4@, xrefs: 05E7244F
M, xrefs: 05E70F1D
0, xrefs: 05E73CB9
F, xrefs: 05E772C6
/, xrefs: 05E7677A
:, xrefs: 05E70F29
9, xrefs: 05E733C5
U, xrefs: 05E704B3
Da:B, xrefs: 05E72483
=, xrefs: 05E76B8E
/, xrefs: 05E76340
b, xrefs: 05E77152
E, xrefs: 05E71865
", xrefs: 05E715BF
&, xrefs: 05E71E07
9, xrefs: 05E712A1
-, xrefs: 05E76110
_, xrefs: 05E7467C
/, xrefs: 05E72A0D
X, xrefs: 05E73465
#, xrefs: 05E72739
(, xrefs: 05E7070B
>, xrefs: 05E70CEB
$, xrefs: 05E72B13
J, xrefs: 05E76D6E
5c2B, xrefs: 05E736E7
B, xrefs: 05E70F75
b, xrefs: 05E7288D
", xrefs: 05E700F4
K, xrefs: 05E746BE
a, xrefs: 05E701BD
*, xrefs: 05E70D63
4, xrefs: 05E7435B
=, xrefs: 05E75348
6, xrefs: 05E707A3
, xrefs: 05E74696
#, xrefs: 05E75932

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $!$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$&$&$&$&$'$'$'$'$($($*$*$*$+$,$,$-$-$-$-$-$-$-$-$.$/$/$/$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$3$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5c2B$5c2B$5c2B$5c2B$6$6$6$6$6$6$7$7$7$9$9$9$9$9$9$9$9$9$9$:$:$:$;$;$;$;$;$;$;$;$;$;$<$<$<$<$<$=$=$=$=$=$=QOB$>$>$>$>$>$?Z\A$?OB$?OB$?OB$?OB$@$@$@$@$@$@$A$A$B$B$B$B$B$B$B$B$B$B$B$C$D$Da:B$Da:B$Da:B$Da:B$Dd9B$Dd9B$Dd9B$Dd9B$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$Eb$Eb$Eb$Eb$F$F$F$F$F$F$F$F$H$H$H$H$H$H$H$H$J$J$J$J$J$J$J$J$J$K$K$K$K$L$L$L$M$M$M$M$M$M$M$N$N$N$N$N$N$N$N$N: B$N: B$N: B$N: B$O$O$Q$S$S$S$S$T$T$T$T$U$U$U$U$U$U$V8iB$W$W$W$W$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$ZM|B$[$[$[$[$[$\$\$\$_$_$_$_$_$_$`$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$fw4@$fw4@$fw4@$fw4@$wg(B$wg(B$wg(B$wg(B$2MB$TZB$_|B$_|B$_|B$_|B$h[B$h[B$h[B$h[B
API String ID: 0-2489452855
Opcode ID: 3045d068dffe6dea09f40349090dbe43da6e1d2345ae401d7d2286b4df267b1a
Instruction ID: d081b84d512e145b2bb4f7a44319e20c356674b6fd824b5cc7b0fbc364787ea7
Opcode Fuzzy Hash: 3045d068dffe6dea09f40349090dbe43da6e1d2345ae401d7d2286b4df267b1a
Instruction Fuzzy Hash: 38D391B8D466698BDB24CF25D944BEAFAB1FB57300F01B5E99418B7340D7798E848F08

Function 05E70040 Relevance: 491.5, Strings: 387, Instructions: 7723
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

9, xrefs: 05E717DB
4, xrefs: 05E72AB1
F, xrefs: 05E745FE
U, xrefs: 05E7291B
4, xrefs: 05E74662
M, xrefs: 05E71167
4, xrefs: 05E75B30
T, xrefs: 05E739C3
U, xrefs: 05E741C5
c, xrefs: 05E71E25
0, xrefs: 05E76CD4
b, xrefs: 05E702CF
F, xrefs: 05E75E44
$, xrefs: 05E743BD
S, xrefs: 05E74C10
/, xrefs: 05E742B7
K, xrefs: 05E72EE9
\, xrefs: 05E70C69
&, xrefs: 05E74E86
wg(B, xrefs: 05E76E5E
M, xrefs: 05E709A1
_|B, xrefs: 05E7618A
;, xrefs: 05E737B1
$, xrefs: 05E7491A
h[B, xrefs: 05E7598E
h[B, xrefs: 05E771D4
Eb, xrefs: 05E75284
@, xrefs: 05E71BED
c, xrefs: 05E73405
$, xrefs: 05E77196
/, xrefs: 05E73325
c, xrefs: 05E74EA4
5c2B, xrefs: 05E71E3D
", xrefs: 05E702A9
Da:B, xrefs: 05E73D2D
_|B, xrefs: 05E7316F
', xrefs: 05E708E3
/, xrefs: 05E71A7B
3, xrefs: 05E70EA1
5, xrefs: 05E74195
?Z\A, xrefs: 05E70D99
Y, xrefs: 05E76DB2
N, xrefs: 05E72EF5
6, xrefs: 05E72989
4, xrefs: 05E74D68
", xrefs: 05E7463E
$, xrefs: 05E7189B
_, xrefs: 05E70287
a, xrefs: 05E7575C
%, xrefs: 05E70B53
c, xrefs: 05E765A2
A, xrefs: 05E7062F
4, xrefs: 05E768A4
[, xrefs: 05E73B3F
K, xrefs: 05E7163F
$, xrefs: 05E73145
0, xrefs: 05E7240F
`, xrefs: 05E711FF
4, xrefs: 05E72E8D
;, xrefs: 05E71F07
N, xrefs: 05E72F95
a, xrefs: 05E71063
H, xrefs: 05E7668E
c, xrefs: 05E736CF
E, xrefs: 05E710A7
, xrefs: 05E71217
E, xrefs: 05E71D5D
E, xrefs: 05E72E75
;, xrefs: 05E767CC
J, xrefs: 05E71137
c, xrefs: 05E761BE
/, xrefs: 05E74F34
?OB, xrefs: 05E73B97
0, xrefs: 05E7512E
c, xrefs: 05E766EA
$, xrefs: 05E773D8
/, xrefs: 05E772D2
-, xrefs: 05E73FA1
4, xrefs: 05E71CE9
6, xrefs: 05E75A08
Da:B, xrefs: 05E75502
6, xrefs: 05E74233
7, xrefs: 05E705A7
J, xrefs: 05E724A9
N, xrefs: 05E75F10
Y, xrefs: 05E71DD5
N, xrefs: 05E75FB0
9, xrefs: 05E74B9A
6, xrefs: 05E70C4F
$, xrefs: 05E75B92
;, xrefs: 05E77330
S, xrefs: 05E71B91
Z, xrefs: 05E711B5
$, xrefs: 05E7417B
5, xrefs: 05E70FC5
<, xrefs: 05E76EE0
4, xrefs: 05E77376
L, xrefs: 05E70639
Eb, xrefs: 05E76ACA
%, xrefs: 05E721C3
F, xrefs: 05E742AB
V8iB, xrefs: 05E70497
', xrefs: 05E702F7
wg(B, xrefs: 05E72599
/, xrefs: 05E74AFA
Y, xrefs: 05E73D97
M, xrefs: 05E73D5F
a, xrefs: 05E77128
, xrefs: 05E75EDC
,, xrefs: 05E708C5
@, xrefs: 05E764B2
Z, xrefs: 05E70347
;, xrefs: 05E74F86
Y, xrefs: 05E7556C
N: B, xrefs: 05E75B4A
0, xrefs: 05E73959
L, xrefs: 05E7009A
b, xrefs: 05E7590C
T, xrefs: 05E72119
TZB, xrefs: 05E71231
B, xrefs: 05E7392F
7, xrefs: 05E7096B
?OB, xrefs: 05E7536C
_, xrefs: 05E75EC2
F, xrefs: 05E72A01
*, xrefs: 05E7021D
b, xrefs: 05E710F3
[, xrefs: 05E72295
b, xrefs: 05E7036B
X, xrefs: 05E74C3A
c, xrefs: 05E718F9
E, xrefs: 05E7057B
;, xrefs: 05E72A6B
H, xrefs: 05E74E48
fw4@, xrefs: 05E754CE
U, xrefs: 05E704F1
0, xrefs: 05E7548E
Y, xrefs: 05E758A4
/, xrefs: 05E7375F
wg(B, xrefs: 05E73E43
:, xrefs: 05E706D7
>, xrefs: 05E762D4
?OB, xrefs: 05E76BB2
, xrefs: 05E72EC1
E, xrefs: 05E7612A
#, xrefs: 05E728B3
&, xrefs: 05E766CC
<, xrefs: 05E7261B
%, xrefs: 05E73A6D
", xrefs: 05E712B9
4, xrefs: 05E715E3
<, xrefs: 05E70753
X, xrefs: 05E71BBB
H, xrefs: 05E71DC9
-, xrefs: 05E748CA
$, xrefs: 05E76160
B, xrefs: 05E70407
$, xrefs: 05E75950
', xrefs: 05E70531
-, xrefs: 05E75776
N, xrefs: 05E716EB
;, xrefs: 05E75AEA
#, xrefs: 05E7415D
*, xrefs: 05E70659
a, xrefs: 05E73F87
\, xrefs: 05E70EAD
5, xrefs: 05E742FB
Y, xrefs: 05E7399F
B, xrefs: 05E7715E
E, xrefs: 05E715CB
N: B, xrefs: 05E77390
A, xrefs: 05E708D9
Y, xrefs: 05E770EA
9, xrefs: 05E7485A
4, xrefs: 05E73593
C, xrefs: 05E70A21
c, xrefs: 05E731A3
b, xrefs: 05E70F69
<, xrefs: 05E73EC5
B, xrefs: 05E72085
,, xrefs: 05E70447
B, xrefs: 05E74143
J, xrefs: 05E73D53
4, xrefs: 05E71FDF
M, xrefs: 05E75534
c, xrefs: 05E76420
(, xrefs: 05E70DD9
9, xrefs: 05E73085
B, xrefs: 05E7694A
J, xrefs: 05E7507C
W, xrefs: 05E770F6
c, xrefs: 05E74978
W, xrefs: 05E740DB
5, xrefs: 05E7043D
#, xrefs: 05E757B8
#, xrefs: 05E73FE3
U, xrefs: 05E7599A
=, xrefs: 05E722C9
_, xrefs: 05E715FD
E, xrefs: 05E74DDC
O, xrefs: 05E70CBB
E, xrefs: 05E748E4
<, xrefs: 05E7569A
h[B, xrefs: 05E741B9
X, xrefs: 05E76480
9, xrefs: 05E70B2F
fw4@, xrefs: 05E73CF9
@, xrefs: 05E704A9
E, xrefs: 05E7464A
c, xrefs: 05E74BDA
H, xrefs: 05E73673
b, xrefs: 05E74137
Z, xrefs: 05E70853
Q, xrefs: 05E70F05
6, xrefs: 05E7724E
T, xrefs: 05E75198
N, xrefs: 05E7476A
h[B, xrefs: 05E7290F
W, xrefs: 05E72831
Y, xrefs: 05E724ED
O, xrefs: 05E71249
-, xrefs: 05E726F7
Y, xrefs: 05E72825
a, xrefs: 05E758E2
Y, xrefs: 05E7367F
c, xrefs: 05E71B5B
Y, xrefs: 05E7669A
E, xrefs: 05E7310F
., xrefs: 05E70899
W, xrefs: 05E758B0
Y, xrefs: 05E74E54
7, xrefs: 05E705DD
Dd9B, xrefs: 05E72A25
c, xrefs: 05E73587
Dd9B, xrefs: 05E75AA4
", xrefs: 05E72E69
5c2B, xrefs: 05E76702
>, xrefs: 05E71A0F
E, xrefs: 05E75E90
a, xrefs: 05E726DD
$, xrefs: 05E728D1
Da:B, xrefs: 05E76D48
E, xrefs: 05E76622
N: B, xrefs: 05E72ACB
0, xrefs: 05E76974
E, xrefs: 05E70FB9
K, xrefs: 05E75F04
F, xrefs: 05E75A80
;, xrefs: 05E70207
\, xrefs: 05E70335
a, xrefs: 05E70E17
N, xrefs: 05E746CA
_|B, xrefs: 05E74944
H, xrefs: 05E73BC3
ZM|B, xrefs: 05E70F5D
_|B, xrefs: 05E718C5
H, xrefs: 05E75398
a, xrefs: 05E76FA2
4, xrefs: 05E765AE
J, xrefs: 05E738A7
B, xrefs: 05E70D2F
9, xrefs: 05E760A0
U, xrefs: 05E771E0
5c2B, xrefs: 05E74EBC
, xrefs: 05E70955
+, xrefs: 05E70A17
@, xrefs: 05E70F51
4, xrefs: 05E73889
fw4@, xrefs: 05E76D14
M, xrefs: 05E724B5
2MB, xrefs: 05E70DA5
5, xrefs: 05E72A51
H, xrefs: 05E76BDE
c, xrefs: 05E71CDD
T, xrefs: 05E769DE
-, xrefs: 05E7184B
;, xrefs: 05E701F5
5, xrefs: 05E77316
E, xrefs: 05E73607
X, xrefs: 05E70F11
Y, xrefs: 05E75174
5, xrefs: 05E7596A
/, xrefs: 05E75A8C
N: B, xrefs: 05E74375
Eb, xrefs: 05E73AAF
F, xrefs: 05E72E29
_, xrefs: 05E72EA7
Eb, xrefs: 05E72205
5, xrefs: 05E75AD0
!, xrefs: 05E706E1
?OB, xrefs: 05E722ED
;, xrefs: 05E74315
a, xrefs: 05E7410D
L, xrefs: 05E7072B
#, xrefs: 05E77178
Y, xrefs: 05E720F5
4, xrefs: 05E7505E
D, xrefs: 05E701EB
, xrefs: 05E71617
Z, xrefs: 05E706F7
%, xrefs: 05E76A88
4, xrefs: 05E75EA8
>, xrefs: 05E732B9
c, xrefs: 05E707B5
", xrefs: 05E709E5
_, xrefs: 05E70B91
', xrefs: 05E702C5
-, xrefs: 05E730F5
Y, xrefs: 05E7078D
H, xrefs: 05E72319
9, xrefs: 05E763E0
Y, xrefs: 05E740CF
:, xrefs: 05E701C7
Dd9B, xrefs: 05E742CF
c, xrefs: 05E74D5C
J, xrefs: 05E75528
-, xrefs: 05E76FBC
S, xrefs: 05E7343B
%, xrefs: 05E75242
J, xrefs: 05E768C2
wg(B, xrefs: 05E75618
N, xrefs: 05E7164B
[, xrefs: 05E75314
/, xrefs: 05E71EB5
, xrefs: 05E70102
M, xrefs: 05E76D7A
", xrefs: 05E75E84
S, xrefs: 05E76456
Y, xrefs: 05E769BA
J, xrefs: 05E71FFD
5, xrefs: 05E728EB
=, xrefs: 05E73B73
B, xrefs: 05E75104
a, xrefs: 05E72863
Dd9B, xrefs: 05E772EA
=, xrefs: 05E70C43
@, xrefs: 05E74C6C
B, xrefs: 05E72899
F, xrefs: 05E7157F
0, xrefs: 05E720AF
&, xrefs: 05E736B1
[, xrefs: 05E70AA7
B, xrefs: 05E75918
9, xrefs: 05E71B1B
=QOB, xrefs: 05E7014A
5, xrefs: 05E771B0
#, xrefs: 05E76FFE
@, xrefs: 05E73497
>, xrefs: 05E74A8E
[, xrefs: 05E76B5A
fw4@, xrefs: 05E7244F
M, xrefs: 05E70F1D
0, xrefs: 05E73CB9
F, xrefs: 05E772C6
/, xrefs: 05E7677A
:, xrefs: 05E70F29
9, xrefs: 05E733C5
U, xrefs: 05E704B3
Da:B, xrefs: 05E72483
=, xrefs: 05E76B8E
/, xrefs: 05E76340
b, xrefs: 05E77152
E, xrefs: 05E71865
", xrefs: 05E715BF
&, xrefs: 05E71E07
9, xrefs: 05E712A1
-, xrefs: 05E76110
_, xrefs: 05E7467C
/, xrefs: 05E72A0D
X, xrefs: 05E73465
#, xrefs: 05E72739
(, xrefs: 05E7070B
>, xrefs: 05E70CEB
$, xrefs: 05E72B13
J, xrefs: 05E76D6E
5c2B, xrefs: 05E736E7
B, xrefs: 05E70F75
b, xrefs: 05E7288D
", xrefs: 05E700F4
K, xrefs: 05E746BE
a, xrefs: 05E701BD
*, xrefs: 05E70D63
4, xrefs: 05E7435B
=, xrefs: 05E75348
6, xrefs: 05E707A3
, xrefs: 05E74696
#, xrefs: 05E75932

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $!$"$"$"$"$"$"$"$"$#$#$#$#$#$#$#$#$$$$$$$$$$$$$$$$$$$$$$$$$%$%$%$%$%$&$&$&$&$'$'$'$'$($($*$*$*$+$,$,$-$-$-$-$-$-$-$-$.$/$/$/$/$/$/$/$/$/$/$/$/$0$0$0$0$0$0$0$0$3$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$4$5$5$5$5$5$5$5$5$5$5$5c2B$5c2B$5c2B$5c2B$6$6$6$6$6$6$7$7$7$9$9$9$9$9$9$9$9$9$9$:$:$:$;$;$;$;$;$;$;$;$;$;$<$<$<$<$<$=$=$=$=$=$=QOB$>$>$>$>$>$?Z\A$?OB$?OB$?OB$?OB$@$@$@$@$@$@$A$A$B$B$B$B$B$B$B$B$B$B$B$C$D$Da:B$Da:B$Da:B$Da:B$Dd9B$Dd9B$Dd9B$Dd9B$E$E$E$E$E$E$E$E$E$E$E$E$E$E$E$Eb$Eb$Eb$Eb$F$F$F$F$F$F$F$F$H$H$H$H$H$H$H$H$J$J$J$J$J$J$J$J$J$K$K$K$K$L$L$L$M$M$M$M$M$M$M$N$N$N$N$N$N$N$N$N: B$N: B$N: B$N: B$O$O$Q$S$S$S$S$T$T$T$T$U$U$U$U$U$U$V8iB$W$W$W$W$X$X$X$X$X$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Y$Z$Z$Z$Z$ZM|B$[$[$[$[$[$\$\$\$_$_$_$_$_$_$`$a$a$a$a$a$a$a$a$a$a$a$b$b$b$b$b$b$b$b$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$c$fw4@$fw4@$fw4@$fw4@$wg(B$wg(B$wg(B$wg(B$2MB$TZB$_|B$_|B$_|B$_|B$h[B$h[B$h[B$h[B
API String ID: 0-2489452855
Opcode ID: d193ada5c3cb13dee5734b9270c85b2ee3cd53889c41aba3c1815d323ab25097
Instruction ID: 957a075dd28a42325dddc076e089d3c45d5659c695285069ce83952a66ea9f69
Opcode Fuzzy Hash: d193ada5c3cb13dee5734b9270c85b2ee3cd53889c41aba3c1815d323ab25097
Instruction Fuzzy Hash: B4D391B8D466298BDB24CF25D944BEAFAB1FB57300F01B5E99418B7340D7799E848F08

Function 055E08CE Relevance: 6.3, Strings: 5, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
8, xrefs: 055E07FC
<, xrefs: 055E07A3
#, xrefs: 055E08DC
., xrefs: 055E075F

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: #$%$.$8$<
API String ID: 0-2226067322
Opcode ID: ff2164db885deb8c82f8640b9c73fc7b79441d08c2def70f32ff95360044fc85
Instruction ID: 5a343534c921118e1cb065a2c2c27e53a30d1184786c606635b822a284bc11cb
Opcode Fuzzy Hash: ff2164db885deb8c82f8640b9c73fc7b79441d08c2def70f32ff95360044fc85
Instruction Fuzzy Hash: 8D41B27494122E8FDB64DF64C988BEEBBB2BB04304F1184E9D41EA7650DB748AC8DF40

Function 055E0719 Relevance: 5.1, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
8, xrefs: 055E07FC
<, xrefs: 055E07A3
., xrefs: 055E075F

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$.$8$<
API String ID: 0-965348960
Opcode ID: 681d368d6cfdb2674393793b0d42e422d91c5e1fc6d3098e09b97c4e20ca7069
Instruction ID: 785455d533f15d162affdb8c876ceb0e2fa25a749866620bbe65bec90f8c88a4
Opcode Fuzzy Hash: 681d368d6cfdb2674393793b0d42e422d91c5e1fc6d3098e09b97c4e20ca7069
Instruction Fuzzy Hash: 2E41A07090122A8FDBA8DF64C998BEEBBB2BB45304F1084E9D41DA7650DB749EC4DF40

Function 055E0C83 Relevance: 3.9, Strings: 3, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
0, xrefs: 055E02B6
(, xrefs: 055E0280

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$($0
API String ID: 0-20752722
Opcode ID: 6e0ca70fca85563472f72958e660af0bce1d6f34c69f31d177ebbd421a0fe67a
Instruction ID: 73c4724ac2d9bdaa92d1eb279aae81f720e63206dd523ca23f8fc17f81b84176
Opcode Fuzzy Hash: 6e0ca70fca85563472f72958e660af0bce1d6f34c69f31d177ebbd421a0fe67a
Instruction Fuzzy Hash: 5D519E7490122ECFDB64DF64C988BEDBBB2BB08305F1184E9D419A7290DB749AC8DF44

Function 055E092C Relevance: 3.8, Strings: 3, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
;, xrefs: 055E0604
!, xrefs: 055E093A

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: !$%$;
API String ID: 0-1807107401
Opcode ID: 04ae727173dfa640e9bf5635d3930d2c1973635d8779b6430a6e3aed1b1f5588
Instruction ID: a6ce7867964bd33333480b4c19fd6b9838652d0d5d3e69f21c876685807ea571
Opcode Fuzzy Hash: 04ae727173dfa640e9bf5635d3930d2c1973635d8779b6430a6e3aed1b1f5588
Instruction Fuzzy Hash: 9C41A07094522ECFEB64DF64C888BEDBBB1BB05305F1184E9D419A7690D7758AC4DF40

Function 055E022E Relevance: 3.8, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
0, xrefs: 055E02B6
(, xrefs: 055E0280

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$($0
API String ID: 0-20752722
Opcode ID: c8672c52a216578812345eb4196ab0c5ef0f78acd524891c7c875da36f5ea1d3
Instruction ID: e101110658fb7f08ae727bdcd866e9fc260802c2b464f46cd45789f8a78995b2
Opcode Fuzzy Hash: c8672c52a216578812345eb4196ab0c5ef0f78acd524891c7c875da36f5ea1d3
Instruction Fuzzy Hash: 5841E77494122E8FDB64CF64C888BEDBBB2BB04305F1185E9D419A7690DB708EC4DF40

Function 055E0613 Relevance: 3.8, Strings: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
7, xrefs: 055E0667
', xrefs: 055E063E

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$'$7
API String ID: 0-2483321804
Opcode ID: f63d03e597d3c0ed055a5932d8b17bed13985b2144b79bf8a4103d91e7b58868
Instruction ID: 9a51c6b3c26bc9e6d74ecffe37742183ffafb1277176d079897aad329854fa12
Opcode Fuzzy Hash: f63d03e597d3c0ed055a5932d8b17bed13985b2144b79bf8a4103d91e7b58868
Instruction Fuzzy Hash: B131917494122E8FDB64DF64C989BEEBBB2BB08305F1184EAD429A7651DB704AC49F40

Function 055E0135 Relevance: 2.6, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
,, xrefs: 055E0A12

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$,
API String ID: 0-49795164
Opcode ID: aa51410e652f032792b0e5d1cf6866841005a6318f7b94259917f7633834d8b0
Instruction ID: 9e5754694db3e80fa05331f79d470878ef419a3d1b98c59cae058d9fca59d716
Opcode Fuzzy Hash: aa51410e652f032792b0e5d1cf6866841005a6318f7b94259917f7633834d8b0
Instruction Fuzzy Hash: 8041C27494022ECFDB64CF64C989BEEBBB2BB04305F1084E9D429A7690E7749AC4DF50

Function 055E0972 Relevance: 2.6, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
, xrefs: 055E09BA

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: $%
API String ID: 0-2111875603
Opcode ID: 4d4ce92a74a2c13a48fad26c451b239ea1b58f0733ead8cb4a948d161283e981
Instruction ID: d27ec1c1a5b910d0a9eb1ceb67a4d0977e829509d859a3eb798ce697097a47a9
Opcode Fuzzy Hash: 4d4ce92a74a2c13a48fad26c451b239ea1b58f0733ead8cb4a948d161283e981
Instruction Fuzzy Hash: EB31BD7494122E8FDB64CF64C988BEEBBB2BB08308F1184E9D429A7651D7709AC4DF40

Function 055E088D Relevance: 2.6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 055E06C0
/, xrefs: 055E08BF

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$/
API String ID: 0-2617147878
Opcode ID: 2a443732e8868cfc2ce06414d3de231ae66c5eff87800895012124fe79ba82fd
Instruction ID: 1e0a82c31729ce963be9b31d87fe8c82972e46ac1b98cebe313675013468228a
Opcode Fuzzy Hash: 2a443732e8868cfc2ce06414d3de231ae66c5eff87800895012124fe79ba82fd
Instruction Fuzzy Hash: E231F57480122ECFDB64CF60C988BEEBBB2BB04305F1184E9D429A7651D7708AC4DF40

Function 05E7F74C Relevance: 1.9, APIs: 1, Instructions: 359
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05E7FA1F

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4d0cc305b231b989d8f3b074ae6074bb8d645ea64068a8522d39260d3081c674
Instruction ID: 738e81cc137d1d43b5c4aa803621b64ae96f135be9a60b5a45704c9cc60819db
Opcode Fuzzy Hash: 4d0cc305b231b989d8f3b074ae6074bb8d645ea64068a8522d39260d3081c674
Instruction Fuzzy Hash: 25D1F171D0021D9FEB20CFA8C844BEEBBB1BF49304F1095AAD859B7240DB749A85CF95

Function 05E7F758 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05E7FA1F

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bf7e636c417377db2b26a395c75490ee38437a491418cb4c54afe9730c73a77e
Instruction ID: 87d2c960d4bf75165cd437f13f499cf94e57e6e594280df3e7817419c30cfea6
Opcode Fuzzy Hash: bf7e636c417377db2b26a395c75490ee38437a491418cb4c54afe9730c73a77e
Instruction Fuzzy Hash: AEC10571D0021D9FEB20DFA8C841BEEBBB1BF49304F0095A9D859B7250DB749A85CF95

Function 05E7F3C8 Relevance: 1.6, APIs: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05E7F4A3

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 89153c778af65e7685a2b493403d778b55021955a1a92374311117d71c51cbeb
Instruction ID: 96a5ca537cc21cad4379531e63b2def3bb23224f1781452f2ea2b68008f22ff9
Opcode Fuzzy Hash: 89153c778af65e7685a2b493403d778b55021955a1a92374311117d71c51cbeb
Instruction Fuzzy Hash: 7941CCB5D002589FDF00CFA9D980ADEFBF1BB49310F14902AE819B7200D338AA05CF64

Function 05E7F3D0 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05E7F4A3

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fc76d6e38d3e683be8d6f7a12f8b796907cb9bc079fe4bf99beec24bfe61e276
Instruction ID: d52d38757d41d168cdac19ab76563c9f229a9ecb31ff43b67b75ee004c1c6d6f
Opcode Fuzzy Hash: fc76d6e38d3e683be8d6f7a12f8b796907cb9bc079fe4bf99beec24bfe61e276
Instruction Fuzzy Hash: 50419AB5D012589FDF10CFA9D984ADEFBF1BB49310F24942AE819B7200D735AA45CF54

Function 02D9E698 Relevance: 1.6, APIs: 1, Instructions: 112libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 02D9E7A1

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d219e4ab2ed5ddbdf232113c636a94d09da7bc5872a2c971db97136e0f2394f2
Instruction ID: 9c0e46d97c1429f251d66a0990411c76abc3955dff78bfa039fe01d0f052f4b3
Opcode Fuzzy Hash: d219e4ab2ed5ddbdf232113c636a94d09da7bc5872a2c971db97136e0f2394f2
Instruction Fuzzy Hash: 2A411FB4D00218CFDB10CFA9D984B9EBBF2FB48304F14912AE819AB384D7759845CF82

Function 05E7F2A9 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05E7F35A

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b098e1a9454830d562c9dbb44936a30588bb4f458f0b13d3193323bf8a1ea1b
Instruction ID: 3fb5d72ef5955e6b21b9b515c95c96155ebd52e1b9f75576bcd8304e5e978342
Opcode Fuzzy Hash: 9b098e1a9454830d562c9dbb44936a30588bb4f458f0b13d3193323bf8a1ea1b
Instruction Fuzzy Hash: A13178B5D00258EFDF10CFA9D980ADEBBB5FB49310F14A42AE815B7210D735A905CF64

Function 05E7F2B0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05E7F35A

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 575c1bfc11b5c1be4e9ec42e428aae73406358fb6a9ce94b4b041f4bffae3156
Instruction ID: 44a9ec1e7249a200b11c81c9172fda650b4dc738698c9b1fba842546fbe505a6
Opcode Fuzzy Hash: 575c1bfc11b5c1be4e9ec42e428aae73406358fb6a9ce94b4b041f4bffae3156
Instruction Fuzzy Hash: B43188B5D00258DFDF10CFA9D980A9EFBB5FB49310F14A42AE815B7210D735A901CF64

Function 05E7F180 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05E7F237

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 85c443d3d160ccb3351b55758a04d37e6c8193ea6f577f883bbbe26a120f2ebf
Instruction ID: 1f60e0d2f6fcc8ff5bec7f0b967883e0fd135b5f37241941819caac00c0d9d35
Opcode Fuzzy Hash: 85c443d3d160ccb3351b55758a04d37e6c8193ea6f577f883bbbe26a120f2ebf
Instruction Fuzzy Hash: F641CAB4D01258DFDB10CFAAD984AEEBBF1BF49310F24942AE419B7240D778A945CF94

Function 05E7F188 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05E7F237

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7adc5b24de62ea6392a9285b475ae2f4890f3224552cb8f8ab4e37c0867a1712
Instruction ID: 4d3e75b023f61dc69ad38e9d69f8ab9ebc5505ad649c15e7e4614951fb4ecb28
Opcode Fuzzy Hash: 7adc5b24de62ea6392a9285b475ae2f4890f3224552cb8f8ab4e37c0867a1712
Instruction Fuzzy Hash: 4431B8B4D01258DFDB10CFAAD984AEEBBF1BF49310F24902AE419B7240D778A945CF94

Function 02D9E3C0 Relevance: 1.6, APIs: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02D9E467

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3d89e0eb06a505118440f0a0118fe2b6b3562c460a7e283a1f7f587b5f1dfc5b
Instruction ID: ebe4a3aa089761152946cd5797dc43133c260e13907823f3bd8cf41713f933f3
Opcode Fuzzy Hash: 3d89e0eb06a505118440f0a0118fe2b6b3562c460a7e283a1f7f587b5f1dfc5b
Instruction Fuzzy Hash: 613157B9D012589FCF14CFAAE580A9EFBB5BB49310F24902AE814B7310D775A945CF64

Function 05E7F090 Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05E7F116

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0cd915985c87b97c74a346b312831a3e56d353415385116efdbeecd47fb7af3d
Instruction ID: 273ee53da0f1465b2af353cb23d81402b003202a110b129d64f2484cc348ad2b
Opcode Fuzzy Hash: 0cd915985c87b97c74a346b312831a3e56d353415385116efdbeecd47fb7af3d
Instruction Fuzzy Hash: F3319AB4D012189FDB14CFAAE985A9EFBB5FB49310F14942AE819B7300D775A901CF94

Function 05E7F098 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05E7F116

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 468289b5e2bb1ef7d4fcf78c93b3ecca8d2748ea1207b80bd417b49aa7f49c08
Instruction ID: 8a6a1d73e03c1cca5f0bee55a45623d4f39f820b99f191b4422e43b751d0e008
Opcode Fuzzy Hash: 468289b5e2bb1ef7d4fcf78c93b3ecca8d2748ea1207b80bd417b49aa7f49c08
Instruction Fuzzy Hash: 0431AAB4D012189FDB14CFAAE981A9EFBF5BB49310F14942AE819B7300D735A901CF94

Function 055E0FC2 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

%, xrefs: 055E06C0

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: b6621e9bc5a8bcb8f207982204099ff78ef0fc8ba1f25e79bf5bae2559326c39
Instruction ID: 2332e40ef2f69e36968b52e67719c0f98759b65ca70098a1820a62f561c075b2
Opcode Fuzzy Hash: b6621e9bc5a8bcb8f207982204099ff78ef0fc8ba1f25e79bf5bae2559326c39
Instruction Fuzzy Hash: 1551D270D4122ACFDB64DF64C988BEDBBB2BB08304F1085E9D41AA7690E7749AC4DF40

Function 02D9F7A8 Relevance: 1.3, APIs: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 02D9F849

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dc3820339bba18e99af595432da1d01ba9e9b39e317254e9d9a4f758b2f150f5
Instruction ID: 68cf5d84c267e05d345daf16e2ac9a7f371460418363cc7657e6e60bd06322c8
Opcode Fuzzy Hash: dc3820339bba18e99af595432da1d01ba9e9b39e317254e9d9a4f758b2f150f5
Instruction Fuzzy Hash: 5A3164B8D002589FCF10CFAAD984A9EFBB4BB09310F24902AE818B7310D335A945CF65

Function 055E0D5D Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

:, xrefs: 055E0D9B

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 58fc70e2b13dd4df1ad43dabc67728edb0b899fc05834b9fb4db1f5e81681aaa
Instruction ID: 8a31f44139fb5b3f16e5e512e8d61725e7422a4a23fc44d903ad559e6cff83c7
Opcode Fuzzy Hash: 58fc70e2b13dd4df1ad43dabc67728edb0b899fc05834b9fb4db1f5e81681aaa
Instruction Fuzzy Hash: 9EE0C275901218DFDB24CF94CA40FE9B7F5EB48304F148099E50DA7291C775AE85CF10

Function 0136D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1530662425.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_136d000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37526e71b6b1ce7c96bed7c9facf5c72e5cc8cca416e0987e6733fe614878274
Instruction ID: c5601c34c593820a1a18dd728129edf8865130f46fc211d251640520f2a3d69e
Opcode Fuzzy Hash: 37526e71b6b1ce7c96bed7c9facf5c72e5cc8cca416e0987e6733fe614878274
Instruction Fuzzy Hash: C6213771604248DFDB11DF54D9C4B26BF69FB84318F24C569E9490B64AC336D40BCBA2

Function 0136D017 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1530662425.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_136d000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f01e5f1659ed64de2dcc6f226e42ecfc18c18a3f275a02967475ac6a1a18fc9
Instruction ID: c282caf4b685162629b13d77fbc793f4c55f550b37e6ecf9e5418efcf2d71865
Opcode Fuzzy Hash: 2f01e5f1659ed64de2dcc6f226e42ecfc18c18a3f275a02967475ac6a1a18fc9
Instruction Fuzzy Hash: 6311BE76504280DFCB12CF54D9C4B16BF72FB84318F24C6A9D8490B65AC33AD45ACBA2

Function 055E1640 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3aeb19198811c5458f5c533b9d1f19f2dac8111aca9f5035476370672eeaec
Instruction ID: 348c3b5167b41a272da0f89db0c463515d687f4d789a602e15d0911f2b5960fc
Opcode Fuzzy Hash: 7d3aeb19198811c5458f5c533b9d1f19f2dac8111aca9f5035476370672eeaec
Instruction Fuzzy Hash: E2013171904609EFDB48DFA8C900AAEBBF6FF49304F04C4A9E81893251D7719911DF40

Function 055E1630 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd867a026bdfa7b3b593e5814909fc22e0b2563bbc49f41f5562526df2888fb
Instruction ID: f35e47094ea7894d81db79d79eccbcc1cba17a96a9ade88aee86e32b6498ec24
Opcode Fuzzy Hash: 3fd867a026bdfa7b3b593e5814909fc22e0b2563bbc49f41f5562526df2888fb
Instruction Fuzzy Hash: 33F04F71908208AFCF45DFA8C9009ADBFB5FB09300F0484AAE854D7351D7718A11EB80

Function 055E15D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ebd11c696fa3099ea81d3da67279d9751135bf1556f432bcc925b2779ae491
Instruction ID: 0eb2c49bfcad4a8f0c92f9d14b02ecaf3073d2b470fef16ed0f2767872a803f0
Opcode Fuzzy Hash: b6ebd11c696fa3099ea81d3da67279d9751135bf1556f432bcc925b2779ae491
Instruction Fuzzy Hash: 44F04970D046099FDB58DFA9C9006AEFBF5FF49205F04C4AA9829A3240DB708A01DB84

Function 055E1A40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ebd11c696fa3099ea81d3da67279d9751135bf1556f432bcc925b2779ae491
Instruction ID: 2009fb40ece62289b56533147539752170601e2921cca2d36e69b783b789518f
Opcode Fuzzy Hash: b6ebd11c696fa3099ea81d3da67279d9751135bf1556f432bcc925b2779ae491
Instruction Fuzzy Hash: 9AF0F971904608AFDB58DFA9C9016BEFBF6FF48201F14C4AAD868A3251E7719A41DB84

Function 055E15C1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbaed083f89e66cfdacb83a73b80a27b1fd0b6d26cbe4ef9191e53492f5ce6c
Instruction ID: ddbe02670e3e6ff38e70f34c273ad5b79957d812cf2ec0b7c80de22834b6da02
Opcode Fuzzy Hash: cfbaed083f89e66cfdacb83a73b80a27b1fd0b6d26cbe4ef9191e53492f5ce6c
Instruction Fuzzy Hash: 5BF03AB5908209AFCB88DFE9D9156ADBBB5FB09314F1484AAD81592211DB718A01DB80

Function 055E1AB0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a861e0fed1fe6db034d9d88c99024ded38a1fbdb00b96ecf502801fbf91151
Instruction ID: 67ca12f16491ea9d69c07f530b78cd6874d41313afe792aeab1975b305555c6c
Opcode Fuzzy Hash: c0a861e0fed1fe6db034d9d88c99024ded38a1fbdb00b96ecf502801fbf91151
Instruction Fuzzy Hash: 78F01D74E046089FDB48EFA9C9416BEFBF5FF48205F1484A9D819D3340E7709941CB84

Function 055E1AA1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89559f195890eec90a7c0d2af327472a69c72cea98b5bb4bbf1b869833c116bf
Instruction ID: 21d1312e8c6492ade30d56d66459189b6d9582c363ffe1640ad4790b5cfc46e1
Opcode Fuzzy Hash: 89559f195890eec90a7c0d2af327472a69c72cea98b5bb4bbf1b869833c116bf
Instruction Fuzzy Hash: 3BF01275E04608AFD784EFA8C9827BDBBF5FB49204F1485A99C18D3340D7759941DB84

Function 055E1A30 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269e3a7c741f0a85158289a65ab75ac1ff53f2c478cfc20ea3042d40d753b485
Instruction ID: 0a6f32519b59de719585276d3147d33c2f7eb4c7aecb18f6753773111df00709
Opcode Fuzzy Hash: 269e3a7c741f0a85158289a65ab75ac1ff53f2c478cfc20ea3042d40d753b485
Instruction Fuzzy Hash: B3F0E9715083859FCB55CBA8C8416B9BFF2FB06215B2485EBDC5497692D239CE02E780

Function 055E0DF7 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd9f2788a3e81d1b1b4472bf209d88ebf8d4d8d8d1fa01a534d67ef6830b2eb
Instruction ID: e81952d38c72ebb80059c481a234a35f4d79a53f06afc51d4e5f16f2f07ee7ee
Opcode Fuzzy Hash: 2bd9f2788a3e81d1b1b4472bf209d88ebf8d4d8d8d1fa01a534d67ef6830b2eb
Instruction Fuzzy Hash: 68E02D7990426ACFCB64DF60D989BE9BBB2FB14315F1144EA9409A2294DB745BC8DF00

Non-executed Functions

Function 05E7B7AC Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

UUUU, xrefs: 05E7B8B1
UUUU, xrefs: 05E7B7E7
X$c{, xrefs: 05E7B995

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: UUUU$UUUU$X$c{
API String ID: 0-153604399
Opcode ID: 8e44c06daad70d8047d935b4dcf7891d6ecca9d74ad5b8b2330f23b45f9e322d
Instruction ID: 7a9862cf879c65bd6cf16167e853fe2ef971c87ec5b05532e0a838fd320766a4
Opcode Fuzzy Hash: 8e44c06daad70d8047d935b4dcf7891d6ecca9d74ad5b8b2330f23b45f9e322d
Instruction Fuzzy Hash: 09818FB1E102289FDB64CFA9C981B9DFBF2BF89304F1481A9E54CE7255D7349A858F01

Function 05E785A0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edcb37e36c7545f755cdc5514e15e637906bc59c58d16f79e13c5c226d6f7d8
Instruction ID: 90915f711f0075ea0c54aeb22f92142a44f84ffeed3f69be90af2b8a2587e63d
Opcode Fuzzy Hash: 1edcb37e36c7545f755cdc5514e15e637906bc59c58d16f79e13c5c226d6f7d8
Instruction Fuzzy Hash: 6E515E30A102498FEB48EFBAE9506EEBBF3FBD9304F14C569D005AB258EB745905CB51

Function 05E78590 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1537396933.0000000005E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5e70000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f65ea369454e08fa46faa6c9f36fa14af7c97bfb643c530a1eb0bda660a1bc
Instruction ID: 90a444f3b69d04cd1b2caa8ee3799b5754ac4e1e20091da9f4ca28fb193164de
Opcode Fuzzy Hash: 49f65ea369454e08fa46faa6c9f36fa14af7c97bfb643c530a1eb0bda660a1bc
Instruction Fuzzy Hash: 49515B30A102498BEB48EFBAE9916EE7BF3FBD9300F14C569D0059B258EB745905CB80

Function 02D909E7 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be053be2186f71e41bbc07a157b1fbcd5f94d699376c72a7b9644688eb57825
Instruction ID: 83124faee52550e68d3db226f9cfff71ce57ea464e3091062fbed0592ec93eb4
Opcode Fuzzy Hash: 8be053be2186f71e41bbc07a157b1fbcd5f94d699376c72a7b9644688eb57825
Instruction Fuzzy Hash: 1B512674E04209CFDB59EFB9E85069ABBF7BFC9304F00C529D005AB268EB745805CB91

Function 02D909F8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e86d0b169985fb08ec5a855c31d88ce197eb6cb941d590fbc9a4f241950efc4
Instruction ID: ce842e6e6b1606ddee40290f44e59f0adb6444d82e9e271f17433926c73b21ea
Opcode Fuzzy Hash: 6e86d0b169985fb08ec5a855c31d88ce197eb6cb941d590fbc9a4f241950efc4
Instruction Fuzzy Hash: 53510774E04209CFDB59EFBAE85069ABBF7BFC9304F14C529D005AB268EB745805CB91

Function 02D9E8A0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1530864674.0000000002D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d90000_zq6a1iqg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320ccc02473ea64e05bd0d952915dead51f7ff46cc2463b66f34dcf9909f7aca
Instruction ID: 0632c2275537c8f048a5b08e481d544d4af6e2ed80b3841f79b5e928c39af65e
Opcode Fuzzy Hash: 320ccc02473ea64e05bd0d952915dead51f7ff46cc2463b66f34dcf9909f7aca
Instruction Fuzzy Hash: F841CEB4D00248DFDF54CFAAD985BAEBBF1BB09304F24912AE815AB350D7749845CF85

Function 055E06CF Relevance: 6.3, Strings: 5, Instructions: 96COMMON

Download Yara Rule

Strings

%, xrefs: 055E06C0
2, xrefs: 055E0F12
(, xrefs: 055E0F0E
*, xrefs: 055E06DC
&, xrefs: 055E070A

Memory Dump Source

Source File: 00000001.00000002.1534935898.00000000055E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 055E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_55e0000_zq6a1iqg.jbxd

Similarity

API ID:
String ID: %$&$($*$2
API String ID: 0-2970082260
Opcode ID: a96da6cf5649bd6967366c27ee6ae120b4a041fb916463b3101e172b0d199ed0
Instruction ID: 088f73980625feb4689e39e0d72a99125f3af38e65248efff9bd59c78211d798
Opcode Fuzzy Hash: a96da6cf5649bd6967366c27ee6ae120b4a041fb916463b3101e172b0d199ed0
Instruction Fuzzy Hash: 3141C27094522ECFDB68DF64C889BEEBBB2BB45305F1184E9C429A7651DB704AC4CF40

Analysis Process: MSBuild.exePID: 1748, Parent PID: 6844COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24%
Total number of Nodes:	254
Total number of Limit Nodes:	18

Executed Functions

Function 004089A0 Relevance: 7.7, APIs: 5, Instructions: 242
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089C2
GetCurrentThreadId.KERNEL32 ref: 004089D5
GetCurrentProcessId.KERNEL32 ref: 004089DD
GetForegroundWindow.USER32 ref: 00408BD2
ExitProcess.KERNEL32 ref: 00408CB5

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 448402f8edc22f0c169554d7cdd299670e5b3afa010ca0547ce2b46543dcc2db
Instruction ID: 8cf386439752addaba4cdd5a2328998a91882dbaf7756ccb1846ca93dac1a1d9
Opcode Fuzzy Hash: 448402f8edc22f0c169554d7cdd299670e5b3afa010ca0547ce2b46543dcc2db
Instruction Fuzzy Hash: CB710677B547044BD708DFBADD8235AFAD2ABC8714F09D43EA885D7390EA789C044689

Function 0043DF70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043BA46,?,00000010,00000005,00000000,?,00000000,?,?,00419158,?,?,004119B4), ref: 0043DF9E

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043DED0 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000,00000000,00000001,?,00000000,00000000,0040B5FE,00000000,00000001), ref: 0043DF36

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab554f5c28010f77283fbef3996d14c1bfd5bf5638fb3c3622d951c40a4d188f
Instruction ID: cb6f0903ee34e7aaa3abfaba356f2a2918ae25efb13eb98352585469c15522a7
Opcode Fuzzy Hash: ab554f5c28010f77283fbef3996d14c1bfd5bf5638fb3c3622d951c40a4d188f
Instruction Fuzzy Hash: 1F017B76D082009BD3181B21ACA2AAB7B68DFDB354F16143DE24387640C62C4807C6EA

Function 0043B7E0 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043B84E

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e673116cc8e36a6bb49cbabe2cdf620d6a173cef19be1431a2d1bf83e7de0cdf
Instruction ID: 55a697b3b7f38dfeef0d40990279f07795ac9d6f77ef781571bf68e037f10c61
Opcode Fuzzy Hash: e673116cc8e36a6bb49cbabe2cdf620d6a173cef19be1431a2d1bf83e7de0cdf
Instruction Fuzzy Hash: AD017633A457080BC300AE7CDC9465ABB96EFD9224F2A063DE5D4873D1DA31990A8295

Non-executed Functions

Function 00439030 Relevance: 30.4, APIs: 10, Strings: 7, Instructions: 621
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 00439137
SysAllocString.OLEAUT32(13C511C2), ref: 004391B6
CoSetProxyBlanket.OLE32(0000FDFC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004391FC
SysAllocString.OLEAUT32(13C511C2), ref: 00439265
SysAllocString.OLEAUT32(13C511C2), ref: 0043930E
VariantInit.OLEAUT32(?), ref: 00439384

Strings

C, xrefs: 004390E6
\, xrefs: 004390F1
E!q#, xrefs: 004390D3, 004390DD, 004396A7
E!q#, xrefs: 00439230, 00439688, 004391B1, 00439199
IK, xrefs: 004393A2
=3, xrefs: 0043915D
Lgfe, xrefs: 00439212

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: =3$C$E!q#$E!q#$Lgfe$\$IK
API String ID: 65563702-4011188741
Opcode ID: 576ecb6780cd3a86b5549137dc952b33a15b612dd27fec80164cd18e3dc059cb
Instruction ID: 9251e3c66033709fe23b4e1ee742b75be419a17e7591596e0cc195c23d498240
Opcode Fuzzy Hash: 576ecb6780cd3a86b5549137dc952b33a15b612dd27fec80164cd18e3dc059cb
Instruction Fuzzy Hash: 542233B2908301ABE324CF20CC41B5BBBA5EF99714F148A1DF4959B3C1D7B8D905CB9A

Function 00434470 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 111clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434480
GetWindowLongW.USER32 ref: 004344A5
GetClipboardData.USER32 ref: 004344B5
GlobalLock.KERNEL32 ref: 004344D4
GlobalUnlock.KERNEL32 ref: 004345D2
CloseClipboard.USER32 ref: 004345DB

Strings

<, xrefs: 0043454D
G, xrefs: 00434543
c, xrefs: 00434525
], xrefs: 00434566
F, xrefs: 00434539

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: <$F$G$]$c
API String ID: 2832541153-1818401840
Opcode ID: e956dbc6c29cb9f242dda5c6eef536b53b6413acc147ab9da98435be699a115c
Instruction ID: 7e34b2cb0d45b88925ede279eb1f96e1ea01dda7cf2764298d89eb53cb338a03
Opcode Fuzzy Hash: e956dbc6c29cb9f242dda5c6eef536b53b6413acc147ab9da98435be699a115c
Instruction Fuzzy Hash: DC41B07180C7819FD300AF38948835EBFE0AB96324F045E2EE5D9863D2C6799549C797

Function 0040E35B Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0040E370

Strings

Lk, xrefs: 0040E749, 0040E750
Zb, xrefs: 0040E59F
r, xrefs: 0040E385
U\, xrefs: 0040E5AA

Memory Dump Source

Source File: 00000002.00000002.1583736906.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Uninitialize
String ID: Lk$U\$Zb$r
API String ID: 3861434553-3997483426
Opcode ID: 43aa4fe2daabb56ee0c0189276c116c532aecf1b25a6e7641c8b17845f3c9312
Instruction ID: ef410df6409a163283a486a480043fce37e142e129954a82ac19f0ffe715bc95
Opcode Fuzzy Hash: 43aa4fe2daabb56ee0c0189276c116c532aecf1b25a6e7641c8b17845f3c9312
Instruction Fuzzy Hash: C7A1BEB010C3D18AD7758F26C8947EFBBE1AB93308F188DADD0E95B282D73941058B5B

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zq6a1iqg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zq6a1iqg.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
zq6a1iqg.exe

Function 05E70006 Relevance: 491.5, Strings: 387, Instructions: 7751
COMMON

Function 05E70040 Relevance: 491.5, Strings: 387, Instructions: 7723
COMMON

Function 055E08CE Relevance: 6.3, Strings: 5, Instructions: 91
COMMON

Function 055E0719 Relevance: 5.1, Strings: 4, Instructions: 93
COMMON

Function 055E0C83 Relevance: 3.9, Strings: 3, Instructions: 112
COMMON

Function 055E092C Relevance: 3.8, Strings: 3, Instructions: 89
COMMON

Function 055E022E Relevance: 3.8, Strings: 3, Instructions: 77
COMMON

Function 055E0613 Relevance: 3.8, Strings: 3, Instructions: 67
COMMON

Function 055E0135 Relevance: 2.6, Strings: 2, Instructions: 95
COMMON

Function 055E0972 Relevance: 2.6, Strings: 2, Instructions: 67
COMMON

Function 055E088D Relevance: 2.6, Strings: 2, Instructions: 59
COMMON

Function 05E7F74C Relevance: 1.9, APIs: 1, Instructions: 359
processCOMMON

Function 05E7F758 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Function 05E7F3C8 Relevance: 1.6, APIs: 1, Instructions: 119
injectionCOMMON