Edit tour

Windows Analysis Report
HUSDGHCE23ED.exe

Overview

General Information

Sample name:	HUSDGHCE23ED.exe
Analysis ID:	1578148
MD5:	43d515ce2b62bad63485ed46844f643a
SHA1:	54d484d170f54f420d82a475b9e6735cdffa5f85
SHA256:	547f1a4190de76e64b30bbf7af297dd27726fb938027fd19b65db5e6d74e23cd
Tags:	exeuser-TeamDreier
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HUSDGHCE23ED.exe (PID: 2168 cmdline: "C:\Users\user\Desktop\HUSDGHCE23ED.exe" MD5: 43D515CE2B62BAD63485ED46844F643A)

HUSDGHCE23ED.exe (PID: 5424 cmdline: "C:\Users\user\Desktop\HUSDGHCE23ED.exe" MD5: 43D515CE2B62BAD63485ED46844F643A)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7704742999:AAG0GCBtZYjgQBMY4ELoXFDZtEO_hdGA7UY", "Telegram Chatid": "7245529134"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.2729460791.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc6fef:$a1: get_encryptedPassword 0xdde1f:$a1: get_encryptedPassword 0xf4a3f:$a1: get_encryptedPassword 0xc7317:$a2: get_encryptedUsername 0xde147:$a2: get_encryptedUsername 0xf4d67:$a2: get_encryptedUsername 0xc6d8a:$a3: get_timePasswordChanged 0xddbba:$a3: get_timePasswordChanged 0xf47da:$a3: get_timePasswordChanged 0xc6eab:$a4: get_passwordField 0xddcdb:$a4: get_passwordField 0xf48fb:$a4: get_passwordField 0xc7005:$a5: set_encryptedPassword 0xdde35:$a5: set_encryptedPassword 0xf4a55:$a5: set_encryptedPassword 0xc8961:$a7: get_logins 0xdf791:$a7: get_logins 0xf63b1:$a7: get_logins 0xc8612:$a8: GetOutlookPasswords 0xdf442:$a8: GetOutlookPasswords 0xf6062:$a8: GetOutlookPasswords
Process Memory Space: HUSDGHCE23ED.exe PID: 2168	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 2168	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 2168	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 2168	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc8b4a:$a1: get_encryptedPassword 0xc8dcf:$a2: get_encryptedUsername 0xc8912:$a3: get_timePasswordChanged 0xc8a1a:$a4: get_passwordField 0xc8b60:$a5: set_encryptedPassword 0xc9e80:$a7: get_logins 0xc9bde:$a8: GetOutlookPasswords 0xc9a39:$a9: StartKeylogger 0xc9dee:$a10: KeyLoggerEventArgs 0xc9a96:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: HUSDGHCE23ED.exe PID: 5424	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 5424	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 5424	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HUSDGHCE23ED.exe PID: 5424	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1339d:$a1: get_encryptedPassword 0x136b6:$a2: get_encryptedUsername 0x1314c:$a3: get_timePasswordChanged 0x1326d:$a4: get_passwordField 0x133b3:$a5: set_encryptedPassword 0x14cb6:$a7: get_logins 0x14967:$a8: GetOutlookPasswords 0x14759:$a9: StartKeylogger 0x14c06:$a10: KeyLoggerEventArgs 0x147b6:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
2.2.HUSDGHCE23ED.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.HUSDGHCE23ED.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.HUSDGHCE23ED.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.HUSDGHCE23ED.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
2.2.HUSDGHCE23ED.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x25dff:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26127:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25b9a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25cbb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x25e15:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27771:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27422:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x27214:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x276c1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler 0x27271:$a11: KeyLoggerEventArgsEventHandler
0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2adab:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a2a9:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x2a5b7:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data 0x2b3af:$a5: \Kometa\User Data\Default\Login Data
0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x2600f:$a1: get_encryptedPassword 0x3cc2f:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26337:$a2: get_encryptedUsername 0x3cf57:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25daa:$a3: get_timePasswordChanged 0x3c9ca:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25ecb:$a4: get_passwordField 0x3caeb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x26025:$a5: set_encryptedPassword 0x3cc45:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27981:$a7: get_logins 0x3e5a1:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27632:$a8: GetOutlookPasswords 0x3e252:$a8: GetOutlookPasswords
0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x2afbb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x41bdb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x2a4b9:$a3: \Google\Chrome\User Data\Default\Login Data 0x410d9:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x2a7c7:$a4: \Orbitum\User Data\Default\Login Data 0x413e7:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data 0x2b5bf:$a5: \Kometa\User Data\Default\Login Data 0x421df:$a5: \Kometa\User Data\Default\Login Data
0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x81e7f:$a1: get_encryptedPassword 0x98caf:$a1: get_encryptedPassword 0xaf8cf:$a1: get_encryptedPassword 0x821a7:$a2: get_encryptedUsername 0x98fd7:$a2: get_encryptedUsername 0xafbf7:$a2: get_encryptedUsername 0x81c1a:$a3: get_timePasswordChanged 0x98a4a:$a3: get_timePasswordChanged 0xaf66a:$a3: get_timePasswordChanged 0x81d3b:$a4: get_passwordField 0x98b6b:$a4: get_passwordField 0xaf78b:$a4: get_passwordField 0x81e95:$a5: set_encryptedPassword 0x98cc5:$a5: set_encryptedPassword 0xaf8e5:$a5: set_encryptedPassword 0x837f1:$a7: get_logins 0x9a621:$a7: get_logins 0xb1241:$a7: get_logins 0x834a2:$a8: GetOutlookPasswords 0x9a2d2:$a8: GetOutlookPasswords 0xb0ef2:$a8: GetOutlookPasswords
0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x86e2b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x9dc5b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xb487b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x86329:$a3: \Google\Chrome\User Data\Default\Login Data 0x9d159:$a3: \Google\Chrome\User Data\Default\Login Data 0xb3d79:$a3: \Google\Chrome\User Data\Default\Login Data 0x86637:$a4: \Orbitum\User Data\Default\Login Data 0x9d467:$a4: \Orbitum\User Data\Default\Login Data 0xb4087:$a4: \Orbitum\User Data\Default\Login Data 0x8742f:$a5: \Kometa\User Data\Default\Login Data 0x9e25f:$a5: \Kometa\User Data\Default\Login Data 0xb4e7f:$a5: \Kometa\User Data\Default\Login Data
Click to see the 25 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T10:28:34.565523+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49705	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7704742999:AAG0GCBtZYjgQBMY4ELoXFDZtEO_hdGA7UY", "Telegram Chatid": "7245529134"}

Multi AV Scanner detection for submitted file

Source: HUSDGHCE23ED.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: HUSDGHCE23ED.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.9:49710 version: TLS 1.0

Source: HUSDGHCE23ED.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: HUSDGHCE23ED.exe, 00000000.00000002.2734013912.00000000059C0000.00000004.08000000.00040000.00000000.sdmp, HUSDGHCE23ED.exe, 00000000.00000002.2729492545.0000000002F21000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107A7D8h	2_2_0107A3C0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107A0B1h	2_2_01079E00
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107E640h	2_2_0107E220
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107A7D8h	2_2_0107A706
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107EA98h	2_2_0107E7F0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107EEF0h	2_2_0107EC48
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107F348h	2_2_0107F0A0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107F7A0h	2_2_0107F4F8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 0107FBF8h	2_2_0107F950
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CB718h	2_2_063CB470
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C95ADh	2_2_063C9270
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CAA10h	2_2_063CA768
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C8811h	2_2_063C8568
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CB2C0h	2_2_063CB018
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C83B9h	2_2_063C8110
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C90C1h	2_2_063C8E18
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C7F61h	2_2_063C7CB8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CBFC8h	2_2_063CBD20
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CAE68h	2_2_063CABC0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063CBB70h	2_2_063CB8C8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 4x nop then jmp 063C8C69h	2_2_063C89C0

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49705 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.9:49710 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_015CD304	0_2_015CD304
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_055465B0	0_2_055465B0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_0554BF60	0_2_0554BF60
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_05540040	0_2_05540040
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_05540006	0_2_05540006
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_0554AD51	0_2_0554AD51
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_05B59680	0_2_05B59680
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_01072DD1	2_2_01072DD1
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_01079E00	2_2_01079E00
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107E220	2_2_0107E220
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107E7E0	2_2_0107E7E0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107E7F0	2_2_0107E7F0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107EC45	2_2_0107EC45
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107EC48	2_2_0107EC48
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F090	2_2_0107F090
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F0A0	2_2_0107F0A0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F4E8	2_2_0107F4E8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F4F8	2_2_0107F4F8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F941	2_2_0107F941
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107F950	2_2_0107F950
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_01079DEF	2_2_01079DEF
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CE698	2_2_063CE698
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB470	2_2_063CB470
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4560	2_2_063C4560
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C9270	2_2_063C9270
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CF3F8	2_2_063CF3F8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C0040	2_2_063C0040
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CC178	2_2_063CC178
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4BE1	2_2_063C4BE1
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C98D0	2_2_063C98D0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C7711	2_2_063C7711
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CA768	2_2_063CA768
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CA759	2_2_063CA759
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB460	2_2_063CB460
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8568	2_2_063C8568
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8565	2_2_063C8565
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C9262	2_2_063C9262
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4340	2_2_063C4340
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C001E	2_2_063C001E
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB018	2_2_063CB018
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB009	2_2_063CB009
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8110	2_2_063C8110
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8100	2_2_063C8100
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8E18	2_2_063C8E18
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C8E08	2_2_063C8E08
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4C79	2_2_063C4C79
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C7CB8	2_2_063C7CB8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C7CA7	2_2_063C7CA7
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CBD20	2_2_063CBD20
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CBD10	2_2_063CBD10
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C3BB8	2_2_063C3BB8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CABB0	2_2_063CABB0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C3BA8	2_2_063C3BA8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CABC0	2_2_063CABC0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB8B8	2_2_063CB8B8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063CB8C8	2_2_063CB8C8
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C98C5	2_2_063C98C5
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C89B2	2_2_063C89B2
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C89C0	2_2_063C89C0

Source: HUSDGHCE23ED.exe, 00000000.00000002.2734013912.00000000059C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2733489199.0000000005870000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2727975891.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000000.1483342733.0000000000B12000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSelda.exe, vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2729492545.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2729492545.0000000002F21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000002.00000002.2727668161.00000000009B7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe, 00000002.00000002.2727538704.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUSDGHCE23ED.exe
Source: HUSDGHCE23ED.exe	Binary or memory string: OriginalFilenameSelda.exe, vs HUSDGHCE23ED.exe

Source: HUSDGHCE23ED.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HUSDGHCE23ED.exe.5870000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.HUSDGHCE23ED.exe.5870000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/2

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Mutant created: NULL

Source: HUSDGHCE23ED.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HUSDGHCE23ED.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002D20000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002CFF000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2731061238.0000000003C2D000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: HUSDGHCE23ED.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\HUSDGHCE23ED.exe "C:\Users\user\Desktop\HUSDGHCE23ED.exe"
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process created: C:\Users\user\Desktop\HUSDGHCE23ED.exe "C:\Users\user\Desktop\HUSDGHCE23ED.exe"
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process created: C:\Users\user\Desktop\HUSDGHCE23ED.exe "C:\Users\user\Desktop\HUSDGHCE23ED.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: HUSDGHCE23ED.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HUSDGHCE23ED.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: HUSDGHCE23ED.exe, --.cs

.Net Code: CypherMatic System.Reflection.Assembly.Load(byte[])

Source: HUSDGHCE23ED.exe

Static PE information: 0xA304A0A8 [Thu Aug 31 23:18:00 2056 UTC]

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_0554B518 pushfd ; iretd	0_2_0554B521
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 0_2_05B5A152 pushad ; iretd	0_2_05B5A159
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107BF80 push esp; ret	2_2_0107BFED
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_0107BFE0 push esp; ret	2_2_0107BFED
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C376A push es; retf	2_2_063C378C
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4B36 push es; iretd	2_2_063C4BE0
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Code function: 2_2_063C4BB0 push es; iretd	2_2_063C4BE0

Source: HUSDGHCE23ED.exe

Static PE information: section name: .text entropy: 6.848620491340598

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 2F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 4F20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 1070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior

Source: HUSDGHCE23ED.exe, 00000002.00000002.2727817199.0000000000D17000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Code function: 2_2_063C4560 LdrInitializeThunk,LdrInitializeThunk,

2_2_063C4560

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: HUSDGHCE23ED.exe, -J-.cs	Reference to suspicious API methods: _FFFD_FFFD_05C1_0314.LoadLibraryExW("compstui.dll", IntPtr.Zero, _0609_06E8._07BB_FFFD \| _0609_06E8._FFFDm_FFFD_002DW)
Source: 0.2.HUSDGHCE23ED.exe.59c0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.HUSDGHCE23ED.exe.59c0000.6.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Memory written: C:\Users\user\Desktop\HUSDGHCE23ED.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Process created: C:\Users\user\Desktop\HUSDGHCE23ED.exe "C:\Users\user\Desktop\HUSDGHCE23ED.exe"

Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Users\user\Desktop\HUSDGHCE23ED.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Users\user\Desktop\HUSDGHCE23ED.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\HUSDGHCE23ED.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2729460791.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.HUSDGHCE23ED.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3ff7c40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3fe0e10.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HUSDGHCE23ED.exe.3f6e170.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 2168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUSDGHCE23ED.exe PID: 5424, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	1 Data from Local System	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HUSDGHCE23ED.exe	66%	ReversingLabs	Win32.Trojan.Znyonm

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C9F000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C72000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	HUSDGHCE23ED.exe, 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2729460791.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp, HUSDGHCE23ED.exe, 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
158.101.44.242	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578148
Start date and time:	2024-12-19 10:27:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HUSDGHCE23ED.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 172.202.163.200, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: HUSDGHCE23ED.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
158.101.44.242	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Justificante pago-09453256434687.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	150.136.65.7
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.123.7.187
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	129.148.164.81
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	132.145.4.150
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	192.29.189.21
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	172.67.179.109
	CROC000400 .pdf	Get hash	malicious	Unknown	Browse	162.247.243.29
	contract_signed.pdf	Get hash	malicious	Unknown	Browse	104.21.16.1
	https://ipfs.io/ipfs/bafybeih7f27bkklyai5zhnf5s57wuee5khsdrrblepmiz5bozrxxoam2lq/index12.html#pdeneve@vanas.eu	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	iviewers.dll	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	script.ps1	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	SWIFT COPY.exe	Get hash	malicious	FormBook	Browse	104.21.86.111
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.842210277030262
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	HUSDGHCE23ED.exe
File size:	959'488 bytes
MD5:	43d515ce2b62bad63485ed46844f643a
SHA1:	54d484d170f54f420d82a475b9e6735cdffa5f85
SHA256:	547f1a4190de76e64b30bbf7af297dd27726fb938027fd19b65db5e6d74e23cd
SHA512:	497469af92b1ebb3f34cf5987cb38789059c342347a73afa6441e63808af7b579c506715e22445ed1ecb47507d9da97401a4b96f6351932371112fb43ab297c8
SSDEEP:	24576:mJVcWy9iv8r2FHqbawOGHtCW8OGSJwnpeWHm:mJVcWy9avOGSEeWH
TLSH:	3D158C1677FC5E1ED2AE477BF4B4081A87F5F902B362EA0D6810B76D0C93B8149513AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4eb8de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA304A0A8 [Thu Aug 31 23:18:00 2056 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xeb890	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xec000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe98e4	0xe9a00	1f0d1120f225a0eb56842731261c2c10	False	0.5024077046548957	data	6.848620491340598	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xec000	0x586	0x600	b17a6a297e819edcf190895f02b6935d	False	0.4147135416666667	data	4.02242861256686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xc	0x200	a00dcdd8ede12488b6e48ca4e84351cd	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xec0a0	0x2fc	data			0.43848167539267013
RT_MANIFEST	0xec39c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T10:28:34.565523+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49705	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 10:28:29.135600090 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:28:29.255162954 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:28:29.255250931 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:28:29.282262087 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:28:29.401981115 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:28:32.459820032 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:28:32.481225967 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:28:32.600698948 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:28:34.511753082 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:28:34.565522909 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:28:34.829097986 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:34.829153061 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:34.829217911 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:34.839296103 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:34.839318037 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.053741932 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.054047108 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:36.059118032 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:36.059125900 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.060398102 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.112494946 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:36.144057035 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:36.191343069 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.489612103 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.489713907 CET	443	49710	172.67.177.134	192.168.2.9
Dec 19, 2024 10:28:36.490016937 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:28:36.496438980 CET	49710	443	192.168.2.9	172.67.177.134
Dec 19, 2024 10:29:39.516609907 CET	80	49705	158.101.44.242	192.168.2.9
Dec 19, 2024 10:29:39.516669989 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:30:14.519728899 CET	49705	80	192.168.2.9	158.101.44.242
Dec 19, 2024 10:30:14.639226913 CET	80	49705	158.101.44.242	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 10:28:28.955974102 CET	56940	53	192.168.2.9	1.1.1.1
Dec 19, 2024 10:28:29.094106913 CET	53	56940	1.1.1.1	192.168.2.9
Dec 19, 2024 10:28:34.514331102 CET	49493	53	192.168.2.9	1.1.1.1
Dec 19, 2024 10:28:34.828166962 CET	53	49493	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 10:28:28.955974102 CET	192.168.2.9	1.1.1.1	0x2d50	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:34.514331102 CET	192.168.2.9	1.1.1.1	0x35f2	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:29.094106913 CET	1.1.1.1	192.168.2.9	0x2d50	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:34.828166962 CET	1.1.1.1	192.168.2.9	0x35f2	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 19, 2024 10:28:34.828166962 CET	1.1.1.1	192.168.2.9	0x35f2	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49705	158.101.44.242	80	5424	C:\Users\user\Desktop\HUSDGHCE23ED.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 10:28:29.282262087 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 10:28:32.459820032 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 19 Dec 2024 09:28:32 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 88c2a4ab3b834bbbe3a336b34e8509c6 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Dec 19, 2024 10:28:32.481225967 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 19, 2024 10:28:34.511753082 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 09:28:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5251b1e82f2a12415684d9c9335c25a5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49710	172.67.177.134	443	5424	C:\Users\user\Desktop\HUSDGHCE23ED.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 09:28:36 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-19 09:28:36 UTC	876	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 09:28:36 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 589285 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eMrnn0pgSd1p%2BO1jCKpLP3R%2B8zR7YjQ9COQZ2%2F0p24zYCJanuLqzhvxfywPimmM0n9fayV48Gt3N35T7eg6GBiAfVTxsFKm4kuLwHCsZaqxQS9mIXOd9iLDqivFE5NXcs9UtYKnx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f465d0b0fbc0f74-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1456&min_rtt=1446&rtt_var=562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1912246&cwnd=151&unsent_bytes=0&cid=76754fbbad323156&ts=448&x=0"
2024-12-19 09:28:36 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	04:28:26
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\HUSDGHCE23ED.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUSDGHCE23ED.exe"
Imagebase:	0xb10000
File size:	959'488 bytes
MD5 hash:	43D515CE2B62BAD63485ED46844F643A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2731298048.0000000003F29000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:28:27
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\HUSDGHCE23ED.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUSDGHCE23ED.exe"
Imagebase:	0x740000
File size:	959'488 bytes
MD5 hash:	43D515CE2B62BAD63485ED46844F643A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.2727538704.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2729460791.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.3%
Total number of Nodes:	218
Total number of Limit Nodes:	9

Executed Functions

Function 0554BF60 Relevance: 1.9, Strings: 1, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 0554C720

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 8085fe0ef32531a122f77cd6e44f43957e3a385ea0c6653d4cf1f63186bdbcf5
Instruction ID: b7f3d84cb1a956d942a976dd2cf30211817592f6fa986f8bfec6be7754ed99c1
Opcode Fuzzy Hash: 8085fe0ef32531a122f77cd6e44f43957e3a385ea0c6653d4cf1f63186bdbcf5
Instruction Fuzzy Hash: DA52D074E01229CFEB69DF65C954BEDBBB2BF89305F1481EA8009A7291DB345E85CF40

Function 05B59680 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2734926900.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b50000_HUSDGHCE23ED.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 932d2a2be1601290fc20133a7a49e343bae47c860d821635166738e48222b204
Instruction ID: cbd339ef3308a35b55730dfd7609ec9c181a850a643d070618f5dd68d540cb5f
Opcode Fuzzy Hash: 932d2a2be1601290fc20133a7a49e343bae47c860d821635166738e48222b204
Instruction Fuzzy Hash: 91F11E70A00309CFEB18DFA5C944BADBBF2FF88314F558199D805AF2A5DB71A945CB90

Function 055465B0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf75b335e6603397b111ca9a432925d90f6026e52c27ade31d97d9545074bef6
Instruction ID: 8e6fc13289a335857d526f4d9aebdee328ebabab698f626f9181356334cb3401
Opcode Fuzzy Hash: bf75b335e6603397b111ca9a432925d90f6026e52c27ade31d97d9545074bef6
Instruction Fuzzy Hash: 92A1CF74E00219CFDB14DFA9C584A9EFBF2BF48315F1481AAD409AB356D734A981CF90

Function 015CAD48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015CAF9E

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b9e760194492051e55ef28ac1bd455ad647f46ccfa096dc333e79be8fd2f26da
Instruction ID: d1ae1d6b9a6594b9482638732615d56934c9e6d6fff9f53276db119edec55008
Opcode Fuzzy Hash: b9e760194492051e55ef28ac1bd455ad647f46ccfa096dc333e79be8fd2f26da
Instruction Fuzzy Hash: AF713770A00B098FE725DFAAD44475ABBF1FF88600F00892DD586DBA50EB75E845CF91

Function 0554CA96 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 0554CBDC

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 296fbedeac3e1352d04d5279907e09d8f74e1e788b17cc89c03c8aec18f91fce
Instruction ID: f349b9944be08d89a4648c828bb3f7b2670ea9e25ad15727718acf99d1d8bd37
Opcode Fuzzy Hash: 296fbedeac3e1352d04d5279907e09d8f74e1e788b17cc89c03c8aec18f91fce
Instruction Fuzzy Hash: B4510575901329DFDF24CF95C944BDDBBB2BF49304F1080AAE918AB250DB759A88CF51

Function 0554CAA0 Relevance: 1.6, APIs: 1, Instructions: 137
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 0554CBDC

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2444a42c3d749dc0665759402da0616008a9c946e4796a4fb54c71031da0a33e
Instruction ID: 30325faa8c5c839fdb775ba431d9831ec5fc47f9ab5e173ce0432a970d6e5575
Opcode Fuzzy Hash: 2444a42c3d749dc0665759402da0616008a9c946e4796a4fb54c71031da0a33e
Instruction Fuzzy Hash: E0510775901329DFDF24CF95C944BDEBBB1BF49304F1080AAE908A7250D7759A88CF51

Function 055418E4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05541A02

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e076f53fbb40c2c5218ff58ccb898ca661ead6d74ab29ab1255c50d7e1bb580f
Instruction ID: 05b5c597ee2a0c98f503aad4b9b57a2d9f9e3d76850d4ef51b535b360325ea60
Opcode Fuzzy Hash: e076f53fbb40c2c5218ff58ccb898ca661ead6d74ab29ab1255c50d7e1bb580f
Instruction Fuzzy Hash: 7151C1B5D00749DFDB14CF9AC884ADEBBB5FF48314F64812AE819AB210D7719985CF90

Function 055418F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05541A02

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0f5087485dc65b2af85c24952bb8abbd971fc91f05453df8f549ca765b3d6d95
Instruction ID: 42e81b0254918bba5ddec534da4735c7f016aa100c39631b7bbd074345d5f572
Opcode Fuzzy Hash: 0f5087485dc65b2af85c24952bb8abbd971fc91f05453df8f549ca765b3d6d95
Instruction Fuzzy Hash: 4841C0B5D00708DFDB14CF9AC884ADEBBB5FF48314F24812AE819AB210D770A985CF90

Function 015C4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015C59C9

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 57dca2c5bc1adc22ad00487d19e7d4e0d44fc74b13e5c76ecd343e95ceb57b48
Instruction ID: 559dfca9dabf9beb913a0849be996ca2df653c6b69918cc06609d0909c1d595b
Opcode Fuzzy Hash: 57dca2c5bc1adc22ad00487d19e7d4e0d44fc74b13e5c76ecd343e95ceb57b48
Instruction Fuzzy Hash: 1841C070D10718CFDB24CFAAC884BDEBBB5BF49704F60806AD408AB251EBB16945CF90

Function 015C590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015C59C9

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b426e07f5fd02456baf74a64f1cf43ba98b432a66af1dc0d47a9a2bab6bd47a2
Instruction ID: b7117dc03a79082f688e72c824241b74b570d2e32cd9008155b7dab6db89b5a3
Opcode Fuzzy Hash: b426e07f5fd02456baf74a64f1cf43ba98b432a66af1dc0d47a9a2bab6bd47a2
Instruction Fuzzy Hash: 5C41D2B0D10719CFDB24CFAAC884BDDBBB5BF49704F60806AD408AB251EBB56945CF50

Function 05544050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05544111

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 88aa23513c299d3bdcd877738ffff45d412440f443fcf9855a557b02b5a58c9f
Instruction ID: fa7a59c0d4550d33a46073f2897a5488c3cbbef56fd1714e855ff30e24935013
Opcode Fuzzy Hash: 88aa23513c299d3bdcd877738ffff45d412440f443fcf9855a557b02b5a58c9f
Instruction Fuzzy Hash: 0A4106B9900349CFDB14CF99C848BAABBF6FB88314F24C459D519AB321D775A845CFA0

Function 0554BC48 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0554BCE0

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6a166d48c0b021ce51db0324504b0e5f82efee6b254aaaf24a399b206e4bc245
Instruction ID: 2871c50b91e0404320cb3c971edcadfc8269880080c3da03114d78a99843cf4f
Opcode Fuzzy Hash: 6a166d48c0b021ce51db0324504b0e5f82efee6b254aaaf24a399b206e4bc245
Instruction Fuzzy Hash: 3F2104B59003499FDF10CFA9C885BEEBBF1FB48324F148429E959A7240DB799954CBA0

Function 0554BC50 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0554BCE0

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 82f73084deffd64c6846821b64ace1185cad3f1b3b6830cffd6eb6040aa89698
Instruction ID: 819abbe97091ea03d9f57f2ab1a78568a5ebcd39bee30bf8b7109acb779f7efc
Opcode Fuzzy Hash: 82f73084deffd64c6846821b64ace1185cad3f1b3b6830cffd6eb6040aa89698
Instruction Fuzzy Hash: 7A2126B59003099FDF10CFAAC885BEEBBF5FF48314F148429E959A7240CB799954CBA4

Function 015CB730 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,015CD5E6,?,?,?,?,?), ref: 015CD6A7

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6e1fc4810792c9aebcd35ad67de71aef435995beb38d1d0af84ac7f2788b85a9
Instruction ID: 0d41987c83267f83cf3df106e2ebb84830b4ad4458bc57dffeab7b85b6c108c3
Opcode Fuzzy Hash: 6e1fc4810792c9aebcd35ad67de71aef435995beb38d1d0af84ac7f2788b85a9
Instruction Fuzzy Hash: AE21E4B5900208EFDB10CFDAD484AEEBBF4FB48710F14842AE958A7350D374A954CFA4

Function 0554BB72 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0554BBF6

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d0a9041e7dae1aa90e4e1dcd768585faab0fb604b25535ccc983dfd581a18052
Instruction ID: dee6bda59f06464a08dea1a24c5d436e8e36617007865a4763e95afe70e1720e
Opcode Fuzzy Hash: d0a9041e7dae1aa90e4e1dcd768585faab0fb604b25535ccc983dfd581a18052
Instruction Fuzzy Hash: A42138719043098FDB10DFAAC4857EEBBF4FF48324F548429D559A7241CB789945CFA4

Function 0554BB78 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0554BBF6

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c8db2ac4c10eb7910a30008f8b27b522425e73b77d33382ed1109d26da359c51
Instruction ID: 3ca100300ce78eaabaf43137dd3ce3ff69041b548e41c0648c3ca08cc0a781ed
Opcode Fuzzy Hash: c8db2ac4c10eb7910a30008f8b27b522425e73b77d33382ed1109d26da359c51
Instruction Fuzzy Hash: 7D2135719043098FDB10DFAAC4857EEBBF4FF48224F54842AD559A7241CB789945CFA4

Function 015CD619 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,015CD5E6,?,?,?,?,?), ref: 015CD6A7

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2206f0aef5de751823aa34150dd63daa05a76276afafe90a3a718255474bef61
Instruction ID: 2851038581a9bbaa6e425df5c9e9e3d1abb06e81b05b76ebdc0a50e861f9a820
Opcode Fuzzy Hash: 2206f0aef5de751823aa34150dd63daa05a76276afafe90a3a718255474bef61
Instruction Fuzzy Hash: E121E3B59002089FDB10CF9AD584ADEBBF4FB48314F24842AE958A7350D378A955CF60

Function 0554CD80 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0554CDF9

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 17c94d14f2fb320e3a7ab271d5191b9e98236755a9bb661b1c36daa41b534e0c
Instruction ID: baee0e985ba863be3e28601c2f1e64cef7220a9129d9dd6abae4dbd00158b329
Opcode Fuzzy Hash: 17c94d14f2fb320e3a7ab271d5191b9e98236755a9bb661b1c36daa41b534e0c
Instruction Fuzzy Hash: D921E0B59017599FDB10CF9AD884BDEFBF4FB48310F10842AE958A7250C378A954CFA1

Function 0554CCC8 Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0554CD3B

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 49daa97fdc0d33618678d8e317128ef0a67c13f5e38cc41344b9f5d18117a0ea
Instruction ID: b70969ee4a4963e62bc933d8e79eeeba914b74b421281028dbb3050898eb27e7
Opcode Fuzzy Hash: 49daa97fdc0d33618678d8e317128ef0a67c13f5e38cc41344b9f5d18117a0ea
Instruction Fuzzy Hash: 2B1134B6D006498FDB10CF9AD845BDEBBF4BB88324F15842AD458B7250D778A545CFA0

Function 05B57A30 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,05B59862,00000000,00000000,03F242C4,02F407E8), ref: 05B59CB0

Memory Dump Source

Source File: 00000000.00000002.2734926900.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b50000_HUSDGHCE23ED.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 5154ebf0fd299c5ae9ff5739c760366a4096d04fa66c379f37ba79a505fe1635
Instruction ID: c172bcc16a1b05ad53b49bfc57dc26d4beddb4c4a90a0f0f843f0a7a51c01153
Opcode Fuzzy Hash: 5154ebf0fd299c5ae9ff5739c760366a4096d04fa66c379f37ba79a505fe1635
Instruction Fuzzy Hash: FE1114B5804209DFDB10CF9AC544BEEBBF8FB48320F10802AE958A3251C378A944CFA5

Function 0554CD88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0554CDF9

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b84706aa0c9487762b9cbcbe8c5ffc160c999d921fa7f0d782bf5d4283e688d1
Instruction ID: 3dd8e7aa5c1b6467f675cffc833cf987328b1d6a66d657b6e008a612bea84e6c
Opcode Fuzzy Hash: b84706aa0c9487762b9cbcbe8c5ffc160c999d921fa7f0d782bf5d4283e688d1
Instruction Fuzzy Hash: 1721E0B58012599FDB10CF9AC884BDEFBF8FB48310F10842AE958A3250C378A954CFA5

Function 0554BD38 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0554BDAE

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d47e3b82665ffc64fdcf3af3162e62e29506705ceb3171c04dc72c20f34bdb04
Instruction ID: c6ddefbe88316eb53a694a939bd6e52485bdffc42cd073657c29f95eb3d7ab3e
Opcode Fuzzy Hash: d47e3b82665ffc64fdcf3af3162e62e29506705ceb3171c04dc72c20f34bdb04
Instruction Fuzzy Hash: 9E1156759002489FDF10CFAAC8447EEBBF1AB48324F14882AE559A7250C7759544CF90

Function 05B59C42 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,05B59862,00000000,00000000,03F242C4,02F407E8), ref: 05B59CB0

Memory Dump Source

Source File: 00000000.00000002.2734926900.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b50000_HUSDGHCE23ED.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: a9116d6d49bf726953906f4cfd32b45888a7457390b913f620fc88998a5a8788
Instruction ID: 6f6c32bdd7535b9506f618868b5be585aff20e86167aec3838cd0f1325514a29
Opcode Fuzzy Hash: a9116d6d49bf726953906f4cfd32b45888a7457390b913f620fc88998a5a8788
Instruction Fuzzy Hash: 781114B6800209DFDB10CF9AC945BDEBBF8FB08320F10802AE958A3250C378A544CFA5

Function 0554CCD0 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0554CD3B

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a9d5a87a4693d033abd0caed595f601821407860e6450e820c554e8490e387f5
Instruction ID: bd85359bceb2d725433f57b21e0120260e86110c5a7cd34299a175d1b0dfd902
Opcode Fuzzy Hash: a9d5a87a4693d033abd0caed595f601821407860e6450e820c554e8490e387f5
Instruction Fuzzy Hash: 161143B6C006498FDB10CF9AC845BDEFBF4FB88324F14802AD458A3250D778A945CFA1

Function 0554BD40 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0554BDAE

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b33584640ac10a1fdeabedc16b13888fccdc00a95dd89148bb0740a8aeb5f796
Instruction ID: a7baf615296885ea6cb444494f08b933e9fec1651bfc675f1af735e6e2471489
Opcode Fuzzy Hash: b33584640ac10a1fdeabedc16b13888fccdc00a95dd89148bb0740a8aeb5f796
Instruction Fuzzy Hash: F01144718003089FDF10CFAAC844BEEBBF5EB48324F148429E559A7250CB759540CFA0

Function 0554BDF8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0554BE62

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 41ffabee2ccfde3c894a6c51d29ebfd42eee74a470d3950cc4a350078f2ae566
Instruction ID: b65e6ccab2fcb98f2bc57328679a221f880abefaa5dc1ecf922a76b1b35457c2
Opcode Fuzzy Hash: 41ffabee2ccfde3c894a6c51d29ebfd42eee74a470d3950cc4a350078f2ae566
Instruction Fuzzy Hash: 101155B59043488FDB10DFAAC4457EEFBF4EB88324F24842AD559A7280CB799945CFA0

Function 0554BE00 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0554BE62

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e4d47019fe765f40b71ee3aa461f1cbcfb8053fbd870a359f8dc36955c28efa5
Instruction ID: 5bf71a98385c5edf9bb307f2ba46c75cdb3df7c6774484842ca3069e0071d110
Opcode Fuzzy Hash: e4d47019fe765f40b71ee3aa461f1cbcfb8053fbd870a359f8dc36955c28efa5
Instruction Fuzzy Hash: 9B1136B19043488FDB14DFAAC4457EEFBF4EB88224F248429D559A7250CB75A944CFA4

Function 015CAF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 015CAF9E

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e25dbb951c6a4d16946fbffae454b0aa7f29cf00b6f5b5477374479def87c6e4
Instruction ID: 0767feea3188ab210e9798b28ae0c222b546e78becd215fa9e7d9511ad862a96
Opcode Fuzzy Hash: e25dbb951c6a4d16946fbffae454b0aa7f29cf00b6f5b5477374479def87c6e4
Instruction Fuzzy Hash: 701110B9C006498FDB14CF9AD444BDEFBF4BB88714F10842AD968A7250D379A545CFA1

Function 05B592AC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,05B599A7), ref: 05B5A445

Memory Dump Source

Source File: 00000000.00000002.2734926900.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b50000_HUSDGHCE23ED.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 8e86673c107e0f77e46866a2f9e0dc4b62863ece1e688907cba03e1e40a6dbe3
Instruction ID: e9658a9b6f9d58658369833e2600e034a6b3295ba6ce654263074f71b5cee5d6
Opcode Fuzzy Hash: 8e86673c107e0f77e46866a2f9e0dc4b62863ece1e688907cba03e1e40a6dbe3
Instruction Fuzzy Hash: 9311EDB5C046488FCB24DF9AD448BDEFBF4EB48324F10856AE959B7210D378A544CFA5

Function 05541B30 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05541B95

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 64b35e70779a9251495f377cf6e49cda4fef458e7a4849fcf589b1977c0e5717
Instruction ID: 98267bc6179602df9999f2bd2dd62abb7f0686602755513767551c49e9980c18
Opcode Fuzzy Hash: 64b35e70779a9251495f377cf6e49cda4fef458e7a4849fcf589b1977c0e5717
Instruction Fuzzy Hash: B811F2B58006499FDB10DF9AD485BDEBBF8FB48324F10841AD959A7340D374A944CFA5

Function 05B5A3E2 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,05B599A7), ref: 05B5A445

Memory Dump Source

Source File: 00000000.00000002.2734926900.0000000005B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b50000_HUSDGHCE23ED.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 553bba943b8e6fb0f788281c7ef3b544554f8f84729769c9045b7f5e221574e6
Instruction ID: 598a20ec04a9ea9f0067f5ade4dc75e9c2d5659ae0e0ddc393f2ef23e4c256f8
Opcode Fuzzy Hash: 553bba943b8e6fb0f788281c7ef3b544554f8f84729769c9045b7f5e221574e6
Instruction Fuzzy Hash: D311FEB5C046498FCB14DF9AD844BDEFBF4EB48324F10856AD958B3210D378A544CFA5

Function 05541B38 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 05541B95

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: de31a64cf4d8c7386566f5ded950339727966629fe0fab6d72fa259165a2051b
Instruction ID: d8cdc91af9b278de8c4161dcc69e58148f0df81ecfe87fbc522e18238df1804b
Opcode Fuzzy Hash: de31a64cf4d8c7386566f5ded950339727966629fe0fab6d72fa259165a2051b
Instruction Fuzzy Hash: 061100B58006488FDB10CF9AC484BDEBBF8FB88324F20841AD959A7340C374A944CFA5

Function 014ED3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728554610.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322d96bdd9e51cfe5c4cb3baf368692a926e86ec2d70e9cb493268fad73f10a8
Instruction ID: ad84b51d52617f00f5135bf7de553af9ed2a1d3e67799e2ddbffd490595ecb9e
Opcode Fuzzy Hash: 322d96bdd9e51cfe5c4cb3baf368692a926e86ec2d70e9cb493268fad73f10a8
Instruction Fuzzy Hash: 9C213671904204DFDB05DF84D9C8B56BBA5FB98315F20C57AE8090B366C336E456CAA2

Function 014FD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728612807.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2f9f9e08e3d3fe056cac872dd4b0ac46b053e432ea0d8fd9437247dda2c588
Instruction ID: afcb241fd381df5825b0fbd1325144df3bb39e70279e0a5d0c0b2e10333ddb54
Opcode Fuzzy Hash: 1c2f9f9e08e3d3fe056cac872dd4b0ac46b053e432ea0d8fd9437247dda2c588
Instruction Fuzzy Hash: 602137B1904300DFDB15DF54D8C0B16BB61FB84318F20C56EDA0A4B366C336D447CA62

Function 014FD2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728612807.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac27b7254c592f35a1669c8ef20632801f1573a9dafd3a3a3679d4ec4c90a37b
Instruction ID: ac307aa6dfeb714a1ac6da3ed063dcc4c63245a35686afa2118aa9ac36d95f40
Opcode Fuzzy Hash: ac27b7254c592f35a1669c8ef20632801f1573a9dafd3a3a3679d4ec4c90a37b
Instruction Fuzzy Hash: A3213876904304DFDB01DF94D9C0B2ABB65FB84324F24C56EDA490B352C336D446CAA2

Function 014FD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728612807.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8648a01c8f85d9010cbfc8eb6737ad22e6cacbd18653b6e40d0148246c384026
Instruction ID: 31d67a0a1dc78e483a631df32a839d113d4d4a0039b2de4fbf4deebdbafa219b
Opcode Fuzzy Hash: 8648a01c8f85d9010cbfc8eb6737ad22e6cacbd18653b6e40d0148246c384026
Instruction Fuzzy Hash: 2E217F755093808FCB06CF24D594716BF71EB46218F28C5EAD9498F7A7C33A984ACB62

Function 014ED3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728554610.00000000014ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 014ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14ed000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction ID: b0d425f8354eb97eb212c4ac0ebc4a309f1ab97ae1ea67e1acee4b52fbbf7192
Opcode Fuzzy Hash: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction Fuzzy Hash: 2611C076804240CFCB02CF44D5C4B56BFA1FB94314F2482AAD8490A667C33AD456CB91

Function 014FD2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728612807.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe29617760380478690089006a0cc6f54f4220f428edbdb5d188c8f044c695c2
Instruction ID: e288940a5c06a0b7988b8054c6b752b1d210352366c4c204081f686928934235
Opcode Fuzzy Hash: fe29617760380478690089006a0cc6f54f4220f428edbdb5d188c8f044c695c2
Instruction Fuzzy Hash: 09119076904680CFDB12CF14D5C4B1ABB61FB84324F24C6AEDA494B756C33AD44ACB92

Non-executed Functions

Function 05540040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645f142eb1bbf4f33bb13efe1d49e2d46c24cf332918f486a08c5135f60fd3cd
Instruction ID: 1b6797bd4660e7e79dd2b294553cfe09e21ace367a7f71e8db3ac661054b4d87
Opcode Fuzzy Hash: 645f142eb1bbf4f33bb13efe1d49e2d46c24cf332918f486a08c5135f60fd3cd
Instruction Fuzzy Hash: 9E1287B28C27458BE390CF66E84C18A3BB1B7E2314BD14A09D3611A2E5D7B611E6CF44

Function 015CD304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2728904812.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245dcfbb03150d35a94f0b0860310538250d8d4406caf4b4d8999421bbd33502
Instruction ID: 67a1ecb69e8518462f569ff5a4d620bf58e02b3e0acf5965be308d1fe13a3fdb
Opcode Fuzzy Hash: 245dcfbb03150d35a94f0b0860310538250d8d4406caf4b4d8999421bbd33502
Instruction Fuzzy Hash: FBA15B36E0020A8FCF15DFA5C84059EBBB2FF88704B15856EE906AF261DB31E956CB40

Function 0554AD51 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55dabcaa73ed9b9eb8c4151dd3f8523f65260a9edc48d1eb0d1b12fc42d4813
Instruction ID: 8259ad36dbc9b42315e8680f65ae4e27154c61e6641990ce7687514eb7b440a6
Opcode Fuzzy Hash: f55dabcaa73ed9b9eb8c4151dd3f8523f65260a9edc48d1eb0d1b12fc42d4813
Instruction Fuzzy Hash: 8681AF34B00219DBDB18DFB5986437E77A3BFC8751F09892DE416EB288CE35D8069B91

Function 05540006 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2732629623.0000000005540000.00000040.00000800.00020000.00000000.sdmp, Offset: 05540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5540000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c914e22a1b263efad766ed7ceb4932ada42a4ba98e16295502a3df66d89ff1
Instruction ID: 2e98cd8885161b65f94fa7f342e38e96ef08bea572cfd3a1a06997631395fbe0
Opcode Fuzzy Hash: e4c914e22a1b263efad766ed7ceb4932ada42a4ba98e16295502a3df66d89ff1
Instruction Fuzzy Hash: 4FC12CB2CC27458BD390CF66E84818A3B71BBE2314FD14A09D3616B2D1DBB515EACF54

Analysis Process: HUSDGHCE23ED.exePID: 5424, Parent PID: 2168COMMON

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	32.8%
Total number of Nodes:	58
Total number of Limit Nodes:	9

Executed Functions

Function 063C4560 Relevance: 3.4, APIs: 2, Instructions: 357
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 063C45F8

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a991c107829069d851154fd03962c4563c492a970fa3f2100740c6c470274fff
Instruction ID: a0a82a82b42d364914051db33884f83f2030caea450409831fbb5c773f73c7e1
Opcode Fuzzy Hash: a991c107829069d851154fd03962c4563c492a970fa3f2100740c6c470274fff
Instruction Fuzzy Hash: A4F1E174E01218CFDB64DFA9D884B9DBBF2BF88310F1481A9E458AB255DB319D85CF90

Function 063C4340 Relevance: 1.8, APIs: 1, Instructions: 263
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 063C45F8

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2817e4e0eeca3634ea8351c855cbfb7d7980487deeaa75f6c190e13d7e0bdfe
Instruction ID: 903f57055891e8bb2d3bb58cd421670e94f0fe6af30689a1d6c3c7328a3eb996
Opcode Fuzzy Hash: e2817e4e0eeca3634ea8351c855cbfb7d7980487deeaa75f6c190e13d7e0bdfe
Instruction Fuzzy Hash: 2C91AE71E002198FEB58DFB5D8607AEBBF6BF84220F20852DE405EB295DB358C05CB90

Function 01072DD1 Relevance: .4, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ef4f28d190fce74cf2ed614c59bc60a1a8feaa56967bb2c2d5c7f13c28b0de
Instruction ID: 2143b6b4b004f4ddb92a567d9dec3e18b736127696e5deede461a3eca078b485
Opcode Fuzzy Hash: a9ef4f28d190fce74cf2ed614c59bc60a1a8feaa56967bb2c2d5c7f13c28b0de
Instruction Fuzzy Hash: E3E15D34F00319DFEB19DFB5D4546AEBBB2BF88310B148569E486AB348DE359801CB95

Function 063C9270 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc846be6f56f83a54b8a256a33c4d6da1bf7113702bee9a861b3694fbf89842
Instruction ID: b702f7450f472c56cbff7f12b2742f64f1f39d158ba78fc9fc6b749e6e45ac97
Opcode Fuzzy Hash: abc846be6f56f83a54b8a256a33c4d6da1bf7113702bee9a861b3694fbf89842
Instruction Fuzzy Hash: 12E1C174E01218CFEB64DFA5D894B9DBBB2BF89304F2081A9E409A7394DB355E85CF50

Function 01079E00 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b82484ab5799308c2e4616da59f133bba877816c4ffb81c17b2bf34f52bb11
Instruction ID: a4679e71c9742e355bbe27020215c82cfddb9810a6d1a4141cc520c7b9bfd5b9
Opcode Fuzzy Hash: b3b82484ab5799308c2e4616da59f133bba877816c4ffb81c17b2bf34f52bb11
Instruction Fuzzy Hash: 92C1A074E00258CFEB54DFA5D994BADBBB2BF88304F2480A9D909AB354DB355E81CF50

Function 063CB470 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad938e45979425e57d63fc75e1e084e6db5b1b504de6da28147c792c8a5b24d
Instruction ID: 114951eb31e8e546026a0f1eabdc2e778679eb141c6fdb756f5fb6ea4dbba5af
Opcode Fuzzy Hash: cad938e45979425e57d63fc75e1e084e6db5b1b504de6da28147c792c8a5b24d
Instruction Fuzzy Hash: A8C1B174E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D809AB355DB359E85CF50

Function 0107A3C0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5569db4bb13476c602d84a804f7d5359156ad0e8475a6d26f151f658b280ff
Instruction ID: d2dc4cb2755b0d596ab090d789ce4002ec09bc3ea4010c70e5581580d9c1e741
Opcode Fuzzy Hash: bb5569db4bb13476c602d84a804f7d5359156ad0e8475a6d26f151f658b280ff
Instruction Fuzzy Hash: FBA12570E00209CFEB24DFA8C848BDDBBB1FF88304F248269D559AB291DB759984CF54

Function 0107A706 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb1b76bb59e04e9af748b2c1e8f26fbcd7fc6af04ccdc73cff284396a17640c
Instruction ID: 93d500a6c26a12ac6f2ed3cc6614a63130ed2570412955581369d06854a4a664
Opcode Fuzzy Hash: ffb1b76bb59e04e9af748b2c1e8f26fbcd7fc6af04ccdc73cff284396a17640c
Instruction Fuzzy Hash: 7491F374E00208CFEB24DFA8C848BDDBBB1FF48314F248299E549AB291DB759985CF54

Function 01079DEF Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d958918b65e3c95fa826e0472359e359b60b39cc5f35170df9b66c47b9df218
Instruction ID: 88d8ca4b8af9e1a573123a31d881dfc2b63bcc2bea561cc0be1411fb7701506f
Opcode Fuzzy Hash: 1d958918b65e3c95fa826e0472359e359b60b39cc5f35170df9b66c47b9df218
Instruction Fuzzy Hash: 41410370E00248CFEB18CFBAD8546DEBBF2AF89304F24C16AD415AB294EB344945CF54

Function 063C4944 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 063C4A86

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 80d18ce810bb756eedcf9f2d69001d61636a238119a0fa5b706ad03a70ea8444
Instruction ID: 45a7eadfb4b3cf3b828d269a8d07c9ee498081ed3fa33ceef10324f74261c1e3
Opcode Fuzzy Hash: 80d18ce810bb756eedcf9f2d69001d61636a238119a0fa5b706ad03a70ea8444
Instruction Fuzzy Hash: AB117278E001098FEB54DFA8D894AEDB7F5FB88325F148128E454E7242D730DD41CB94

Function 0107B277 Relevance: 1.5, Strings: 1, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0107B3AD

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: da552395984e9211bb08543c7c3f2943861f3bc7b7815062523b0e08745a21bd
Instruction ID: 6c1d62dd0ab94bf32c6bf571b9254f8deb2ef77656a8ec79db7cfb469d5b1abf
Opcode Fuzzy Hash: da552395984e9211bb08543c7c3f2943861f3bc7b7815062523b0e08745a21bd
Instruction Fuzzy Hash: 90A1C430B002059FEB669F78985826D7BE7FF85320F148259EA968B3D1CE358C41CBD5

Function 0107B2BE Relevance: 1.5, Strings: 1, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0107B35D

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4e52001029b7d030ea660f8d364bd07d81dd109cd7f3c4a50ece7a241c7957c7
Instruction ID: a9158fb6ba9554c1964b280dcaca7612756f07c633bd55ef307e490768a55ff6
Opcode Fuzzy Hash: 4e52001029b7d030ea660f8d364bd07d81dd109cd7f3c4a50ece7a241c7957c7
Instruction Fuzzy Hash: 8B81E230B002059FDB669F78D85826E7BE6FF89320F144669E696CB390DE358C41CBD5

Function 010719B8 Relevance: .8, Instructions: 844
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c242430b36c0233cd50ae55b681d0e06ca5e850d0372e9a4c3f4fabd7ef35555
Instruction ID: 9941f1658513d9e10adcdd82b7271856d77f758fe5f2ea32eb9176907c36c163
Opcode Fuzzy Hash: c242430b36c0233cd50ae55b681d0e06ca5e850d0372e9a4c3f4fabd7ef35555
Instruction Fuzzy Hash: 08620A36A143638BC7A68F61E8511EABBF0FFD5235728466FE1C085142D37C4B99CBA1

Function 0107CDC8 Relevance: .8, Instructions: 806
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7613c1650d43aed32b104efea6c11f5cd97f2cd460da3f80fce8f03b2af374
Instruction ID: 5ecd6f61a47a1cea1634a0f1573790aea2efac833b32c7a0ce49215e62b2a074
Opcode Fuzzy Hash: ed7613c1650d43aed32b104efea6c11f5cd97f2cd460da3f80fce8f03b2af374
Instruction Fuzzy Hash: E2622534A00219DFEB55EBE4C860BAEBBB2FF88301F1080A9D14A6B395CE355D55DF51

Function 0107DB08 Relevance: .4, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dde1a8c2aca072a1d60b84ff5dda67bc45fd6a2061a0560befe8c5c0291af72
Instruction ID: 63b9a08731d1796c97d85d2c3e47de030fc3f68f22d40bba9329760698f82c07
Opcode Fuzzy Hash: 4dde1a8c2aca072a1d60b84ff5dda67bc45fd6a2061a0560befe8c5c0291af72
Instruction Fuzzy Hash: ABF13C75E00215CFDB05DFACD8849ADBBF6BF88310B1A84A9E555AB361CB31EC41CB94

Function 01074E6D Relevance: .3, Instructions: 293
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ba7cc98061fff0a0f49d3c7298d40fef8ede996a69a5d221d919ca2937aae8
Instruction ID: 0a5d6b593779bd3fe349291e4f369365c5f1232c883cfeb537412a0eaad10401
Opcode Fuzzy Hash: 82ba7cc98061fff0a0f49d3c7298d40fef8ede996a69a5d221d919ca2937aae8
Instruction Fuzzy Hash: C0F01C714153828FD3212B74A8BC27A7F75EF4F3137442C80E0CACA02ADB2E5445CB55

Function 0107C2C8 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b535ed016d80a8300a9e18d1af96e9159d6eb3b9a72ac506108e2591310c2ed
Instruction ID: 5f382ae72b1b9f9d08da4dbf38d0dc8aab2beb8cbf130831a911b7adace4fc23
Opcode Fuzzy Hash: 7b535ed016d80a8300a9e18d1af96e9159d6eb3b9a72ac506108e2591310c2ed
Instruction Fuzzy Hash: 3161F472B002069FE764CB7DD880AAFBBF9FBC9320B14856EE595C7640D630D9018BA4

Function 01070B20 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a6981db274cfce6317790a6bfd9c426347c03469b947b0e8b337bd7f9c18b7
Instruction ID: ab2f71214dc430486927bcfc784db457f7245140873b5ed7503343e1c2277f2b
Opcode Fuzzy Hash: 96a6981db274cfce6317790a6bfd9c426347c03469b947b0e8b337bd7f9c18b7
Instruction Fuzzy Hash: 16A1FB74A00289CFCF05EFB4E894A9DBBB5FB49309B118629E445EB369DB346D45CF80

Function 01070B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f646daef9267a11190b2432aef465c65c9ec24b6f3dc059ed9d5b9bfbf9e7db3
Instruction ID: ca70206d4c5b37ef1f2a6bd789f5dc7c3a102423156dd2e74e691d5098f74471
Opcode Fuzzy Hash: f646daef9267a11190b2432aef465c65c9ec24b6f3dc059ed9d5b9bfbf9e7db3
Instruction Fuzzy Hash: 91A1FA74A00289CFCF15EFB4E894A9DBBB5FB49309B118629E405EB369DB346D45CF80

Function 0107CA78 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a696882867b00930e3ef8b68889378c027e764678a726bce36b62d43b09ca22
Instruction ID: 98bc3f44efcd6b73be45ed7ad7c154b4ad77297a32924bcf0ff7b612e4cdda54
Opcode Fuzzy Hash: 8a696882867b00930e3ef8b68889378c027e764678a726bce36b62d43b09ca22
Instruction Fuzzy Hash: 9851B331B045168FE754DF3DCA84A7A7BE9FF8861070544AAF586CB261EB31EC019B54

Function 0107BAD8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a85c3b0c9537b346cb991c9e1695531d153a61c34ab1c0a4fd98598195424e6d
Instruction ID: 30f9a6ca661c56027d4db40cd118c4590c22574517f97106ef4f23f96fbb1a35
Opcode Fuzzy Hash: a85c3b0c9537b346cb991c9e1695531d153a61c34ab1c0a4fd98598195424e6d
Instruction Fuzzy Hash: A0514835A002088FDB15DBA8C494EEEBBF6FF88320F155095E541EB3A1CA71EC41CBA4

Function 01079B9F Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff109507095865208a33b0e2912e253008ed0a91c289b078b12572b4dca2407
Instruction ID: 1a12a4a207cf6e0c3fa19aea6c50cb305bb05eca6014dfe9a96ea2a0d6118f4a
Opcode Fuzzy Hash: cff109507095865208a33b0e2912e253008ed0a91c289b078b12572b4dca2407
Instruction Fuzzy Hash: 364136300363878FD3212B34A5AC16ABF7AEF1B31BF092C49E29BC5511DB201468DBA5

Function 010746A0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0835e72332bc3e7ceec127abd319b4d04c906f6e08f6bfb0e14071b5e375f12f
Instruction ID: 2bc91c465834a3a69c9ccf672c374dca5348ed628833f6ca73fe6ee8f84d554b
Opcode Fuzzy Hash: 0835e72332bc3e7ceec127abd319b4d04c906f6e08f6bfb0e14071b5e375f12f
Instruction Fuzzy Hash: 1651C274E00248CFDB58DFA9D494A9DBBF2BF89301F248069E855EB368DB349846CF54

Function 01072C78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44576a889556b1a227ef3cb8300829b179be2059a9664c84ce606157a0f49f0a
Instruction ID: 57b3db1f5d73058da7788de4ae43ddebfc8e692808617adecbb7a15ea88307fa
Opcode Fuzzy Hash: 44576a889556b1a227ef3cb8300829b179be2059a9664c84ce606157a0f49f0a
Instruction Fuzzy Hash: FB314431F043198BEF695ABA48A427E6BE6BFC4240F18807ED883C3384DF798C448759

Function 0107BFF0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b562212f765aca7c5b812342c90613525aad23575e2414a7298f2587dc2db94
Instruction ID: 8d952834be7676a85bd88af80f44c1e3f67b7ccd6c204eac15415db42769d4ae
Opcode Fuzzy Hash: 5b562212f765aca7c5b812342c90613525aad23575e2414a7298f2587dc2db94
Instruction Fuzzy Hash: F631D530B0020A9FDB15EB74D854AAF7BE6AF89200F1444B9E549DB351DE318D12C7D0

Function 0107C888 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d101da8b97a083322880d82766588d15dd7a634e211b52452165ec76a4aa68
Instruction ID: f297c82f341114460b00ae906d574e2a583755c9e968f540c26e88bcd82e1380
Opcode Fuzzy Hash: 57d101da8b97a083322880d82766588d15dd7a634e211b52452165ec76a4aa68
Instruction Fuzzy Hash: D1414A74A00106DFEB55DF28D948AAE7BB6BB48310F1500A9E946CB3A1CB31DD90CB90

Function 01073168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bd813bd786a6d230d585b8549fc76f79f729bd67355aa4272f43ac644a6cdd
Instruction ID: 898547cfbc06853ed728076a197dd53a71b722275c5420bba1d9da9db2980df2
Opcode Fuzzy Hash: a0bd813bd786a6d230d585b8549fc76f79f729bd67355aa4272f43ac644a6cdd
Instruction Fuzzy Hash: 8841A274E012489FDB08DFAAD88499DBBF6BF89300F249529E805BB364DB355845CF14

Function 0107BBB1 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb7a33f3a79c84e06b94fe952b5ba1872f47c9f68e17642b6cfd54c96d71ec6
Instruction ID: 54c5a84788cdf60abd9af85282d1e869303bc3bef222d32292900b8a675ed438
Opcode Fuzzy Hash: dfb7a33f3a79c84e06b94fe952b5ba1872f47c9f68e17642b6cfd54c96d71ec6
Instruction Fuzzy Hash: 4331E575B002098FDB45EBA8C490EDDBBB2BF88220F195594E501AF361DE71EC85CBA5

Function 0107BBE5 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006488093412a6cbe4ee40cbe16a0fb247803538b7560a882157b3b93ee7414b
Instruction ID: 69c98099060abd72473add2df1fcdda4a78e506795987a16baaacf1f5593d874
Opcode Fuzzy Hash: 006488093412a6cbe4ee40cbe16a0fb247803538b7560a882157b3b93ee7414b
Instruction Fuzzy Hash: 79310835B002098FDB45EBA8C490EDDBBB2BF88220F155594E501EF361DE71EC81CBA5

Function 0107CCAA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca54b187d20134c956d6b863ada0d504a277eeef02d2653323fca05effd3efa
Instruction ID: ce8a8623322422e45612ec5f267b5d9645a2e62abb61f0389b96eb0cdf3a1569
Opcode Fuzzy Hash: fca54b187d20134c956d6b863ada0d504a277eeef02d2653323fca05effd3efa
Instruction Fuzzy Hash: AD2128307042428BFB663739896457E3FDBAFCA20070880BAE582DB356EE35CC029395

Function 0107DAF9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ec4ae1fbd01970daa210df5eb82f0a8432cc4001039a093c22531fc50409f8
Instruction ID: b387ec303ff84e2ac2d25e4d4325bfb227b693eafafedacaf979f44353512187
Opcode Fuzzy Hash: 31ec4ae1fbd01970daa210df5eb82f0a8432cc4001039a093c22531fc50409f8
Instruction Fuzzy Hash: 5B315E70E006059FCB04DFACC8849EEBBB6BF89310B158159E555DB3A1CB34AC42CB94

Function 0107C132 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0522b86e203625e0c951610ead5eb17de26067363f29c7bab2143e10568f070a
Instruction ID: f2e215649835d1dd739fc5367847655192bf613a6be217de0700d963e0fb4752
Opcode Fuzzy Hash: 0522b86e203625e0c951610ead5eb17de26067363f29c7bab2143e10568f070a
Instruction Fuzzy Hash: 88312530A05246DFD716DF78D860A6EBBB6FF8A210F1480AED4858B352CE319D56C7A1

Function 0107CCB8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4ab5c0f818a9719bf268e7684bf1b69d5ab99a8d82905b02b5a1be8c122a46
Instruction ID: 5bf20cccf87a473f71be2692cfe21dafafd5fca57609cf11d6f48e957aad1f00
Opcode Fuzzy Hash: 4d4ab5c0f818a9719bf268e7684bf1b69d5ab99a8d82905b02b5a1be8c122a46
Instruction Fuzzy Hash: 7021B3307042028BFB56362AC96467E3BD7AFC5715F1880B9D582CB399EE76CC429385

Function 0107CBC0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db19deff725c6cc70290f032f8e095bbcf90af508ad0463f8be29c3df6d5bc27
Instruction ID: ba9252fe3f686e4735ce3230d060ff6f19bda0d92d450bf0bbbe059a6c9d98cf
Opcode Fuzzy Hash: db19deff725c6cc70290f032f8e095bbcf90af508ad0463f8be29c3df6d5bc27
Instruction Fuzzy Hash: E421D631B0424E8FFB15CE699E407BF7FEAAB85200F054466F981D7244DB70DC808764

Function 010718C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079df9658d293c7ce13bccfcac108afeb71cb8ed1643d34e91e7319fe2398afa
Instruction ID: f238060a9765c7365b9601158ab38182496b4d421c129fa63226c854cf97eb67
Opcode Fuzzy Hash: 079df9658d293c7ce13bccfcac108afeb71cb8ed1643d34e91e7319fe2398afa
Instruction Fuzzy Hash: 6121C131E00206DFDB55DB78C4809AE37A9EB88760F20C459E849DB290DB31EE0ACB91

Function 0107FEF0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b586475a1503202ec4418c4e7b5824694cb88105e30c55859b47d23c66e37c38
Instruction ID: b3332a99d72eeeb920f02408b729c54844848b0c5d935284f070545d4b2dfce8
Opcode Fuzzy Hash: b586475a1503202ec4418c4e7b5824694cb88105e30c55859b47d23c66e37c38
Instruction Fuzzy Hash: F22193767041069F9745DF1DE4508AAFBEAFFC9264718C06EE549C7341EE32E806C7A0

Function 01079D32 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f069cdfc665040ad32b9034c18333f05ca1d319684e28e0cc52180a3114813cc
Instruction ID: cc634d02166aec653bdd8c2a94d08b6849cd917e8821f66721c88a7cb1aa2e4c
Opcode Fuzzy Hash: f069cdfc665040ad32b9034c18333f05ca1d319684e28e0cc52180a3114813cc
Instruction Fuzzy Hash: 9021AC70C1024ADFDB01EFB8D4987AEBFB6FF06306F008999D05AAB255DB304A04CB81

Function 0101D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728323744.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_101d000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c53db1a50b1df8be3db8901bacd268910b207aa169e7c6bd44c36defa9c07e
Instruction ID: eb779764b8ae19b563f1acf24f09d37e05ca8dd3d9b0ca8c154d8196d09aa92a
Opcode Fuzzy Hash: a5c53db1a50b1df8be3db8901bacd268910b207aa169e7c6bd44c36defa9c07e
Instruction Fuzzy Hash: 70214971504300DFDB16DF94D9C8B26BBA1FB84314F20C5ADE8890B25AC33AD447CB62

Function 01070EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf770380b77035c9a257550228ee0db301c8127553948f435a39c650d4d0850
Instruction ID: 167a214bc2beece85d995b7e74a9037c9583ac97e29bfdbd306bcedcf57f061d
Opcode Fuzzy Hash: ecf770380b77035c9a257550228ee0db301c8127553948f435a39c650d4d0850
Instruction Fuzzy Hash: 61219D74E04249DFE706EFB8C4106AEBBB2FF86304F00C5A998849B398CB745905CF42

Function 0107BE71 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866945a406878905ab5f5dbaeb4d7e2aaf92af39cc5a848a7e02cf58339b391e
Instruction ID: 7ac3de542e8a16eda844841a795b9664f9e6d3cdc3a978a9fe76c8fb384812ee
Opcode Fuzzy Hash: 866945a406878905ab5f5dbaeb4d7e2aaf92af39cc5a848a7e02cf58339b391e
Instruction Fuzzy Hash: A5117C357042008FC751CF69E494A66BBE2FF89711B1588AAE286CB762CA71EC04CB11

Function 010717B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da7bc52ebd009c89b467304365fd2e784b1353562bf3b1c652fdc78b4f45a1e3
Instruction ID: c28e9c97cda8447ac323a36cd0a6a2aa54b2aa55a4746a17438c90890d0a7276
Opcode Fuzzy Hash: da7bc52ebd009c89b467304365fd2e784b1353562bf3b1c652fdc78b4f45a1e3
Instruction Fuzzy Hash: A6210370C0524A8FCB41DFB8C8941EEBFB0FF0A204F1441AAD485E6265EB355A89CBA1

Function 0107C240 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6360fb3502855145feaf30fb817afe6c025d6822eba347bd5737ffc01cfb65e6
Instruction ID: 658fcc991547c9f17e8186151e9fb19538ae2148702c54e1020dcb082852da90
Opcode Fuzzy Hash: 6360fb3502855145feaf30fb817afe6c025d6822eba347bd5737ffc01cfb65e6
Instruction Fuzzy Hash: 370145312083949FDB276B78981486F7FEAEF866107144497E189CB242CA248C02DBF6

Function 0107C460 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df96e35069c2e8d6b3820dcada0dd2381de633bdf7fce73a3391fb91ac6d5f4
Instruction ID: 93083868c675a1635a46a6338dc7340599f6ae84db3f71989493aa444b7cffe4
Opcode Fuzzy Hash: 5df96e35069c2e8d6b3820dcada0dd2381de633bdf7fce73a3391fb91ac6d5f4
Instruction Fuzzy Hash: 38115E31E002168FEB64EFB8D6446AEBBF6BB88650B454179C655E3200EF31DC418BE9

Function 01075202 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c785f90f4de7cf49bb73f79599d91a0a4299559033653aec88084cc5ac93fd
Instruction ID: 9f1c972e35c948e3694716959386d215c200e0d653240122618f56c13101eb7b
Opcode Fuzzy Hash: a3c785f90f4de7cf49bb73f79599d91a0a4299559033653aec88084cc5ac93fd
Instruction Fuzzy Hash: 4B012232F043104FCB249BBC486457E7FEBEFC6A2030484AAD845CB222EF30C8029754

Function 0101D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728323744.000000000101D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0101D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_101d000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction ID: 98d28eaf1eb56cd1785f9be7a88597d7557f8fc3a93ec27947518b88ebd092dd
Opcode Fuzzy Hash: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction Fuzzy Hash: 7911BE75504280DFCB12CF54D5C4B15BBA2FB84314F24C6AAE8894B657C33AD44ACB61

Function 01075210 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ff373a5b878ef84069ceb7831ff0e47105e873f9fb69707bb3192f5bbe13c7
Instruction ID: 2d8ebd8431a58e7dc17b4ae02f66e12130f7afe0130a0d4bc55686543a74e8ed
Opcode Fuzzy Hash: 81ff373a5b878ef84069ceb7831ff0e47105e873f9fb69707bb3192f5bbe13c7
Instruction Fuzzy Hash: 8B01D632F043144FDB24ABBD986857E7AEBAFC5A207144479E909C7215FF71C80147A4

Function 0107A840 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8081ab77cc172617709408bc95cd05ac710399283e299eb54d70d4059c6e06d2
Instruction ID: 733089fa9b0b09e504b397e75bd68533dc93b5035259b5b1cf3ebd2b70dee2ba
Opcode Fuzzy Hash: 8081ab77cc172617709408bc95cd05ac710399283e299eb54d70d4059c6e06d2
Instruction Fuzzy Hash: 22018C36A00119EFCB60DF78E8849AFBBF5FB88320B144569E95AD3200D7308911CBA1

Function 0107A850 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2626a386ef40e6df84eae53fe3d408e0685c2b5466805cdfd7df227c3c6ff1
Instruction ID: 85f1ca4069fcbc23677bcadb6e353cdf31d3a9072094ffa7a82e8bc37f69e051
Opcode Fuzzy Hash: 5f2626a386ef40e6df84eae53fe3d408e0685c2b5466805cdfd7df227c3c6ff1
Instruction Fuzzy Hash: 52015275E1010AEFDB649F78D844AAFBBBAFB88310F004539EA1693240DB3089118BA1

Function 0107C4F7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a780e2c08702f7f32a634b94684d6c1debd7073c7a595e745675153381d646
Instruction ID: e8b5cc6d50a9de70bbe57fd19eca264a7a59d000ac4f8dc4be5436988ba4ce2d
Opcode Fuzzy Hash: 09a780e2c08702f7f32a634b94684d6c1debd7073c7a595e745675153381d646
Instruction Fuzzy Hash: A2F0C832B042515FC7155B6DA4105ABBBFADFC562071500ABE584CB352CA31D802CBA4

Function 0107FEE0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753c6074bb1c8642ba7ae44a81a6670d64f361847a6cdc5dca859daffaa9d539
Instruction ID: 16e1b115d4f814ee491e2f1ff923df3820a045b10fafe5892d627d67c662b768
Opcode Fuzzy Hash: 753c6074bb1c8642ba7ae44a81a6670d64f361847a6cdc5dca859daffaa9d539
Instruction Fuzzy Hash: D5F0F432B001156F8741DE3D98404BBBBEEEBC9254714C06AE449C3341DE31D80287E0

Function 0107BF80 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbaf33f08bc9dbf9d30128478dec4e5f2ad57da0ed254723fe09484a6ee34588
Instruction ID: 3c0e8d7aa3b640598c02597a6b528c6e52976f7b16a371ff6d0ad599ea87f141
Opcode Fuzzy Hash: fbaf33f08bc9dbf9d30128478dec4e5f2ad57da0ed254723fe09484a6ee34588
Instruction Fuzzy Hash: C7F0F230B093925FC7535778D91855D7FAA9F47740B0544E6F681CB693C8359C04C7B2

Function 0107BD31 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0275ed8119bf2fa4d8b3b8e45ee7c6e999dc44ac2f7ab8e195534edd1556850e
Instruction ID: 1d562838dfb3098fb03648cb848a09c15d4915274fd912130fa143397014428d
Opcode Fuzzy Hash: 0275ed8119bf2fa4d8b3b8e45ee7c6e999dc44ac2f7ab8e195534edd1556850e
Instruction Fuzzy Hash: A3F0AF71904248AFDB60EFA9C8809AFFBF5FF4C350710492AD5C4D3201DA30A911DBA5

Function 0107BF38 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef2c13be471602068b83a9387343aafb14b21c9bc7a5991266038ba55be5422
Instruction ID: 1b883ee1f56eb5fe14e16a5703ddb51def1f3ef7166661f2e800084440241dac
Opcode Fuzzy Hash: eef2c13be471602068b83a9387343aafb14b21c9bc7a5991266038ba55be5422
Instruction Fuzzy Hash: 39F090353102108FC310EF68E498D56BBB5EF8A72071144A6E685CB262CB61EC01CB90

Function 0107C1F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22d2b211d97493f5b9ff1c87a1bd3809be514f0b9bbe3e5738e88832254902b
Instruction ID: 14cfb327cac81913694e4d835ab3bc1d89770a7625c67122fe732aed84990f81
Opcode Fuzzy Hash: c22d2b211d97493f5b9ff1c87a1bd3809be514f0b9bbe3e5738e88832254902b
Instruction Fuzzy Hash: 4FF05E35301106DFD710CF59D488D5ABBEAFF88720B548169FA0987331CB71AC52CB84

Function 0107BF70 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df232493f77ba51d9f13e460c477bd55b03ca24ccc2e12a5ba49f5274795fa3f
Instruction ID: ec66705c5a19b7076033d3c8b483a2eb41b4a859d81628a4f0cace83230d5e85
Opcode Fuzzy Hash: df232493f77ba51d9f13e460c477bd55b03ca24ccc2e12a5ba49f5274795fa3f
Instruction Fuzzy Hash: C2E09239A152528FD7A0BB7CD695869BFE1EF5675071448ABEA80C7221D531DC008B90

Function 01075088 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2231abecda06718242ec2b890ae10fb36f18291c191df8c481a42021676bd424
Instruction ID: dafe325049be24c54661ccc07c9b4ea129ed3a0fa03419ea84ecd3a583be9612
Opcode Fuzzy Hash: 2231abecda06718242ec2b890ae10fb36f18291c191df8c481a42021676bd424
Instruction Fuzzy Hash: F2E002754613068FD3242B64B9BC27E7A79FB8F317B442D04E18EC9029DB7E54448B95

Function 0107BAD6 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a675b6ee6eda644da95d56b638114d6994cbfa94e7a425ccab67f751a6f89
Instruction ID: 406da8c08f7d109d9ef4d02b952be000dbfd3678ad148405b5df02aa1e5f63f2
Opcode Fuzzy Hash: 523a675b6ee6eda644da95d56b638114d6994cbfa94e7a425ccab67f751a6f89
Instruction Fuzzy Hash: CBE01A32701220AB87249A5AD444C6ABBADEF8AA6531900AAE645C7221CA619C01C6D0

Function 01071877 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27915a5757ea9063f4c11ccb2b5689d86205b5feb3fdf7c2896bd5586d7b0f1b
Instruction ID: 753f60eaa0692362083d05dfbe3fa11dacab06612004749690cde69394114195
Opcode Fuzzy Hash: 27915a5757ea9063f4c11ccb2b5689d86205b5feb3fdf7c2896bd5586d7b0f1b
Instruction Fuzzy Hash: F9E02035D502168FCB01D7F49C110DD7F74BD822517588253C4A477051FB30211FD7A1

Function 01071888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d79534d1c3fc97b657cb34e1db99c4f7d91122f2f27073fef0e95714c6f883
Instruction ID: a7925a47f84833d748cca345b0d4b124d72dd65a835aba162b19291c4699523a
Opcode Fuzzy Hash: 32d79534d1c3fc97b657cb34e1db99c4f7d91122f2f27073fef0e95714c6f883
Instruction Fuzzy Hash: D8D01732D2022A979B10AAA9DC048EEBB38EE96621B908626D52437140EB70265986B1

Function 0107C2A0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248bcc89322a35386f0b44f570bd83a8be1a637a7dc9d9bf57b93e86338169af
Instruction ID: e1bbb4ac0845bcc225b9f48bf20b53495cec5985e4bc2baf5b70badb4d67087a
Opcode Fuzzy Hash: 248bcc89322a35386f0b44f570bd83a8be1a637a7dc9d9bf57b93e86338169af
Instruction Fuzzy Hash: 06D0C737310114A74B152A49A404CAE7B5FDBCD771704C02AFA1583310CE754D1297E5

Function 0107325B Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169eae33c266ad1b54dc7005ecea0a92714602bc2f603f9b5ac0975c98768b2d
Instruction ID: bb6ee32019f0a83019f708f65abb0d7688946cc7f8812028cf51305238002f43
Opcode Fuzzy Hash: 169eae33c266ad1b54dc7005ecea0a92714602bc2f603f9b5ac0975c98768b2d
Instruction Fuzzy Hash: 4CE0BD38E04209CFCF10DFA9E54849CB7B9FB48301B008466E829AB210DA386911CF01

Function 0107D9FD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3086f16264d80df870cc37e4dff648ea1225f30d9780bdeeb0b38340b82eb8
Instruction ID: c36e4ac19d1d6853a93837d0da6b9f003b68dbd89066ed0fdbff9a34ee7db756
Opcode Fuzzy Hash: 1b3086f16264d80df870cc37e4dff648ea1225f30d9780bdeeb0b38340b82eb8
Instruction Fuzzy Hash: B7D0673AB00009AFCB159F98E8409DDF7B6FB98221B048156EA16A3260C631A961DB90

Function 0107BF48 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042ec584bb17d71ad8973bde3a2f7ae377b1bf6434c9b674d977aaf0a238a585
Instruction ID: 35b659814fc0670cc2908677069ff830e7f06a0c48b8627969ab9ab46751c013
Opcode Fuzzy Hash: 042ec584bb17d71ad8973bde3a2f7ae377b1bf6434c9b674d977aaf0a238a585
Instruction Fuzzy Hash: 01D0A7353502158FC314AB68E458C6977B9EF4873070140A5E5098B362CF71DC0087D0

Function 010751E0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cc918a7b5af9705c1f4e14e7b0b9f1a0eaf4d17887dd7a995b37eccdd46ac0
Instruction ID: 0d247f5d77aea6514f22461dbd41d0f80cdc1a7bbda61485921423267516d11e
Opcode Fuzzy Hash: b8cc918a7b5af9705c1f4e14e7b0b9f1a0eaf4d17887dd7a995b37eccdd46ac0
Instruction Fuzzy Hash: 30C04C7054E3C04FCB1797305576459BFB19D0711531944DEC8C2CB0B7DA2A541BEB11

Non-executed Functions

Function 0107E220 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c130e972d6f5b7ce48e51569b89918d39899bbaa08ddc3c31c00d6f895f2f689
Instruction ID: 5e2ded4bb1c37f57c118f83fd762a4042c643d578c07b24a43227f6403628bd8
Opcode Fuzzy Hash: c130e972d6f5b7ce48e51569b89918d39899bbaa08ddc3c31c00d6f895f2f689
Instruction Fuzzy Hash: 9202F674E01218CFDB54DFA9C884BADBBB2BF48304F1580A9D859AB365DB31AD81CF54

Function 0107E7F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834637ad6021948ed9450a07ee53f9207bff1cf0381616215baec31e09adaab7
Instruction ID: a27ca07ef5aeed64897f74982a608c39fd0273371c9f478f345cf34e9c94efbf
Opcode Fuzzy Hash: 834637ad6021948ed9450a07ee53f9207bff1cf0381616215baec31e09adaab7
Instruction Fuzzy Hash: E0C1C274E01218CFDB54DFA5D994BADBBB2BF88304F2080A9D809AB355DB355E81CF50

Function 0107EC48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0ae22bd48ca19cabe7112b3d6331062ca0b3a1d3eb8ed6df3735bce158f77c
Instruction ID: 26898422a8414fa21436f568f924b5c48f9f60820b9c38700ec0d34d29111fdd
Opcode Fuzzy Hash: 1f0ae22bd48ca19cabe7112b3d6331062ca0b3a1d3eb8ed6df3735bce158f77c
Instruction Fuzzy Hash: AAC1C274E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D819AB355DB355E81CF50

Function 0107F0A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35bc56dd30e28f29b260898bb8e83dddf4082a0bc41460cafcd7d936f50568a
Instruction ID: 7296388249b83bea8945f3c15e56be86b345bc8935842f8d4e90adcc82c62795
Opcode Fuzzy Hash: c35bc56dd30e28f29b260898bb8e83dddf4082a0bc41460cafcd7d936f50568a
Instruction Fuzzy Hash: 46C1C174E00258CFDB54DFA5D994BADBBB2BF89304F2080A9D819AB354DB359E81CF50

Function 0107F4F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a8d88d23759717f4f0b6b451219ad51564981fe9874b3f28d266b4f040b657
Instruction ID: 242ec836d26ec97d10b841f1f25730294150c0b68d7883722e2832f5f9800558
Opcode Fuzzy Hash: d5a8d88d23759717f4f0b6b451219ad51564981fe9874b3f28d266b4f040b657
Instruction Fuzzy Hash: 0FC1C274E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D819AB355DB355E81CF50

Function 0107F950 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2728639569.0000000001070000.00000040.00000800.00020000.00000000.sdmp, Offset: 01070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1070000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418b9bb620444cf8d2793978978222bc952ea30badba6a523401c5183836d542
Instruction ID: ea6da46144e0f907a12bc3c9d5695dadea1023d6f2b0e610bb0251f4ac1ed78f
Opcode Fuzzy Hash: 418b9bb620444cf8d2793978978222bc952ea30badba6a523401c5183836d542
Instruction Fuzzy Hash: 6BC1C274E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D819AB354DB359E81CF50

Function 063C8E18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf009f498177c54365056ea43fec1c42eaf814e72dd7d91fa4a68fcf564e54e
Instruction ID: c525665c4b5a7c480d8485a73f2df0a958d0a48b621cb66e7fed7cb0461d5a8f
Opcode Fuzzy Hash: faf009f498177c54365056ea43fec1c42eaf814e72dd7d91fa4a68fcf564e54e
Instruction Fuzzy Hash: F0C1B274E00258CFDB54DFA5D994BADBBB2BF88304F1080A9D809AB355DB355E85CF50

Function 063CA768 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b604d9214dc9c2833cff0962c4b9c6e4782b607adc9a1c76a19973df2060f913
Instruction ID: 5f6d6ca39a0efd02d7011dd879733cf09555538300b9a37fce1f1bcf905912c1
Opcode Fuzzy Hash: b604d9214dc9c2833cff0962c4b9c6e4782b607adc9a1c76a19973df2060f913
Instruction Fuzzy Hash: A2C1BF74E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063CABC0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3fbc32939e7b982391c57ed0a58b2b6518409d27df4118d4fe7243279caead
Instruction ID: 15405e0a34e15f8be7fee3a34fe3c00a73b03f32bb0317e84267b07cd8c6c666
Opcode Fuzzy Hash: ad3fbc32939e7b982391c57ed0a58b2b6518409d27df4118d4fe7243279caead
Instruction Fuzzy Hash: 8DC1B174E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063CB018 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1864ef75188a5ee0b82ca1f060e2642138a7d345d8c801b587dfdcecfbd0f8de
Instruction ID: 2354b3dcdb4b40254c4566086e9f1a0c9834d88b43d87cca0a20c991037f4531
Opcode Fuzzy Hash: 1864ef75188a5ee0b82ca1f060e2642138a7d345d8c801b587dfdcecfbd0f8de
Instruction Fuzzy Hash: 5CC1C274E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D409AB354DB355E81CF50

Function 063C7CB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5939b2b29be50aa303f8908edf350af1c7e2a59edb2e02b68eae7b3e2ed92c
Instruction ID: 5a49735930c93da3e004dd0da60149fc4f7269d1f305109380043d49867b8790
Opcode Fuzzy Hash: 8c5939b2b29be50aa303f8908edf350af1c7e2a59edb2e02b68eae7b3e2ed92c
Instruction Fuzzy Hash: 0DC1B074E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063CB8C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b592ddf31f50546be1b1c47e45beab8ad4d3ecdd25fed90cb66f2d1feee1ee4d
Instruction ID: b06ee5008f05ac8df6a5808b02d2a46f35ab1ce538e1abea4d9f46bb0797e876
Opcode Fuzzy Hash: b592ddf31f50546be1b1c47e45beab8ad4d3ecdd25fed90cb66f2d1feee1ee4d
Instruction Fuzzy Hash: 02C1B074E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063CBD20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6dd1062f983c7600f0574813bcbfa6ce2351c1250217c9d206fbf8df3c60f7
Instruction ID: 8923a39e57e1b898b848c8472dda56b98dcbda8f7ae778beb60206f613cb7430
Opcode Fuzzy Hash: 8e6dd1062f983c7600f0574813bcbfa6ce2351c1250217c9d206fbf8df3c60f7
Instruction Fuzzy Hash: 63C1C174E00258CFDB54DFA5D994BADBBB2BF88304F2090A9D809AB354DB359E81CF50

Function 063C8110 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269fdb040a2e8812ca4a21f0a41bba21240c41fc4536a4901efa765558358b34
Instruction ID: 71519c3175984ba62af8d9f8f6271e9629fc2952a651e232cad4a99fc71afb34
Opcode Fuzzy Hash: 269fdb040a2e8812ca4a21f0a41bba21240c41fc4536a4901efa765558358b34
Instruction Fuzzy Hash: 65C1B074E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063C8568 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531e972495c60597d5886ec14c825118bcd183306f339f01ae4e8317b7fece89
Instruction ID: c2d398f61b9a1d0c79b94f7893537e2d333e3fa40b7f2d0c62d11c4afede21e0
Opcode Fuzzy Hash: 531e972495c60597d5886ec14c825118bcd183306f339f01ae4e8317b7fece89
Instruction Fuzzy Hash: E0C1BF74E00258CFDB54DFA5D994BADBBB2BF88314F2080A9D809AB354DB359E85CF50

Function 063C89C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2733146839.00000000063C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63c0000_HUSDGHCE23ED.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfea3f0f435852d930c74458449ade915fdbee29ff1138fbe05f63d76e7fbbb
Instruction ID: 953e6773ae960f720eb1224c65478bc5162bbdefc81fd929313283425a988892
Opcode Fuzzy Hash: acfea3f0f435852d930c74458449ade915fdbee29ff1138fbe05f63d76e7fbbb
Instruction Fuzzy Hash: 76C1B074E00258CFDB54DFA5D994BADBBB2BF88304F2080A9D809AB354DB359E85CF50

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HUSDGHCE23ED.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
HUSDGHCE23ED.exe

Function 0554BF60 Relevance: 1.9, Strings: 1, Instructions: 619
COMMON

Function 015CAD48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 0554CA96 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Function 0554CAA0 Relevance: 1.6, APIs: 1, Instructions: 137
processCOMMON

Function 055418E4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 055418F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 015C4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 015C590D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 05544050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0554BC48 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 0554BC50 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 015CB730 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 0554BB72 Relevance: 1.6, APIs: 1, Instructions: 64
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre