Edit tour

Windows Analysis Report
SHROsQyiAd.exe

Overview

General Information

Sample name:	SHROsQyiAd.exe renamed because original name is a hash value
Original sample name:	7119698425e2056d404e97b12ed5ca37.exe
Analysis ID:	1578616
MD5:	7119698425e2056d404e97b12ed5ca37
SHA1:	47ebc0744e88fbe12876471b49f4df80195f428a
SHA256:	f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3
Tags:	exeRATRemcosRATuser-abuse_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops large PE files

Injects a PE file into a foreign processes

Installs a global keyboard hook

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

SHROsQyiAd.exe (PID: 2308 cmdline: "C:\Users\user\Desktop\SHROsQyiAd.exe" MD5: 7119698425E2056D404E97B12ED5CA37)

SHROsQyiAd.exe (PID: 3472 cmdline: "C:\Users\user\Desktop\SHROsQyiAd.exe" MD5: 7119698425E2056D404E97B12ED5CA37)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["newstaticfreepoint24.ddns-ip.net:3020:0"], "Assigned name": "ROSAS", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "kljjbdlcjbavhbiluiewliuwqerlib-DDZVN3", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "registros.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Capturas de pantalla", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "data", "Keylog file max size": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
Process Memory Space: SHROsQyiAd.exe PID: 2308	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 2308	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 2308	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 2308	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xbba62:$a1: Remcos restarted by watchdog! 0x13aa8e:$a1: Remcos restarted by watchdog! 0xbbfbf:$a3: %02i:%02i:%02i:%03i 0xbc377:$a3: %02i:%02i:%02i:%03i 0x13afe8:$a3: %02i:%02i:%02i:%03i 0x13b3a0:$a3: %02i:%02i:%02i:%03i
Process Memory Space: SHROsQyiAd.exe PID: 3472	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 3472	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 3472	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: SHROsQyiAd.exe PID: 3472	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x9a8bd:$a1: Remcos restarted by watchdog! 0x9ae17:$a3: %02i:%02i:%02i:%03i 0x9b1cf:$a3: %02i:%02i:%02i:%03i
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.SHROsQyiAd.exe.1130000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
2.2.SHROsQyiAd.exe.1130000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
2.2.SHROsQyiAd.exe.1130000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
6.2.SHROsQyiAd.exe.c70000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
2.2.SHROsQyiAd.exe.11c0000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
2.2.SHROsQyiAd.exe.11c0000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
2.2.SHROsQyiAd.exe.11c0000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
2.2.SHROsQyiAd.exe.1130000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
6.2.SHROsQyiAd.exe.c70000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.SHROsQyiAd.exe.c70000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
6.2.SHROsQyiAd.exe.c70000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
6.2.SHROsQyiAd.exe.c70000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Favorites\VS Code\user-data\Code.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SHROsQyiAd.exe, ProcessId: 2308, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VSCode

Suricata Signatures

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T23:42:33.005441+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.6	49773	181.131.217.244	3020	TCP

ET MALWARE Remcos 3.x Unencrypted Server Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T23:42:34.257170+0100	2032777	1	Malware Command and Control Activity Detected	181.131.217.244	3020	192.168.2.6	49773	TCP
2024-12-19T23:44:52.538251+0100	2032777	1	Malware Command and Control Activity Detected	181.131.217.244	3020	192.168.2.6	49773	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T23:42:36.056369+0100	2803304	3	Unknown Traffic	192.168.2.6	49780	178.237.33.50	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["newstaticfreepoint24.ddns-ip.net:3020:0"], "Assigned name": "ROSAS", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "kljjbdlcjbavhbiluiewliuwqerlib-DDZVN3", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "registros.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Capturas de pantalla", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "data", "Keylog file max size": ""}

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CA293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

6_2_00CA293A

Source: SHROsQyiAd.exe, 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_e7140f15-5

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C76764 _wcslen,CoGetObject,

6_2_00C76764

Source: SHROsQyiAd.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: SHROsQyiAd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Sources\foobar2000-2.24\foobar2000\Release\foobar2000.pdb source: SHROsQyiAd.exe, Code.exe.2.dr

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C7B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_00C7B335
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C8B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_00C8B42F
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CBD5E9 FindFirstFileExA,	6_2_00CBD5E9
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C7B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_00C7B53A
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C789A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_00C789A9
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C76AC2 FindFirstFileW,FindNextFileW,	6_2_00C76AC2
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C77A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_00C77A8C
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C88C69 FindFirstFileW,FindNextFileW,FindNextFileW,	6_2_00C88C69
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C78DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_00C78DA7

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C76F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_2_00C76F06

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.6:49773 -> 181.131.217.244:3020
Source: Network traffic	Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 181.131.217.244:3020 -> 192.168.2.6:49773

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: newstaticfreepoint24.ddns-ip.net

Source: global traffic

TCP traffic: 192.168.2.6:49773 -> 181.131.217.244:3020

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 181.131.217.244 181.131.217.244
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49780 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C7455B WaitForSingleObject,SetEvent,recv,

6_2_00C7455B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: newstaticfreepoint24.ddns-ip.net
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: http://forums.foobar2000.org/
Source: SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/8
Source: SHROsQyiAd.exe, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: SHROsQyiAd.exe, 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpH
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpz
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=Replaygain
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://help.foobar2000.org/
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://help.foobar2000.org/~rbvrb
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.foobar2000.org/
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.foobar2000.org/download
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens
Source: Code.exe.2.dr	String found in binary or memory: https://www.foobar2000.org/license
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.radio-browser.info/
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.radio-browser.info/CountryLanguageTagNameLoading...No
Source: SHROsQyiAd.exe, Code.exe.2.dr	String found in binary or memory: https://www.radio-browser.info/history/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C799E4 SetWindowsHookExA 0000000D,00C799D0,00000000

6_2_00C799E4

Installs a global keyboard hook

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SHROsQyiAd.exe

Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C859C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

6_2_00C859C6

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C859C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

6_2_00C859C6

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C859C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

6_2_00C859C6

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C79B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

6_2_00C79B10

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C8BB77 SystemParametersInfoW,

6_2_00C8BB77

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Drops large PE files

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

File dump: Code.exe.2.dr 959567331

Jump to dropped file

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C858B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,

6_2_00C858B9

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CC20D2	6_2_00CC20D2
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CAD098	6_2_00CAD098
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C8D071	6_2_00C8D071
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA61AA	6_2_00CA61AA
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA7150	6_2_00CA7150
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C96254	6_2_00C96254
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA1377	6_2_00CA1377
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C8E5DF	6_2_00C8E5DF
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C967CB	6_2_00C967CB
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CBC739	6_2_00CBC739
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CAC9DD	6_2_00CAC9DD
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA2A49	6_2_00CA2A49
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CACC0C	6_2_00CACC0C
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA4D22	6_2_00CA4D22
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C96E73	6_2_00C96E73
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CB0E20	6_2_00CB0E20
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CACE3B	6_2_00CACE3B
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C96FAD	6_2_00C96FAD
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C82F45	6_2_00C82F45
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CC2F00	6_2_00CC2F00

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: String function: 00CA3FB0 appears 55 times
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: String function: 00C71F66 appears 49 times
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: String function: 00C720E7 appears 42 times
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: String function: 00CA38A5 appears 41 times

Source: SHROsQyiAd.exe	Binary or memory string: OriginalFilename vs SHROsQyiAd.exe
Source: SHROsQyiAd.exe, 00000002.00000000.2189394833.0000000000B52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefoobar2000.exeN vs SHROsQyiAd.exe
Source: SHROsQyiAd.exe, 00000002.00000002.2444703943.0000000003236000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefoobar2000.exeN vs SHROsQyiAd.exe
Source: SHROsQyiAd.exe, 00000006.00000000.2386746274.0000000000B52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefoobar2000.exeN vs SHROsQyiAd.exe
Source: SHROsQyiAd.exe	Binary or memory string: OriginalFilenamefoobar2000.exeN vs SHROsQyiAd.exe

Source: SHROsQyiAd.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@3/3@2/2

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C86AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

6_2_00C86AB7

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C7E219 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

6_2_00C7E219

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C8A63F FindResourceA,LoadResource,LockResource,SizeofResource,

6_2_00C8A63F

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C89BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_2_00C89BC4

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

File created: C:\Users\user\Favorites\VS Code

Jump to behavior

Source: SHROsQyiAd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SHROsQyiAd.exe, 00000002.00000002.2444703943.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000002.00000002.2442948453.0000000000675000.00000002.00000001.01000000.00000003.sdmp, SHROsQyiAd.exe, 00000002.00000000.2189298046.0000000000675000.00000002.00000001.01000000.00000003.sdmp, SHROsQyiAd.exe, 00000006.00000002.4640929809.0000000000675000.00000002.00000001.01000000.00000003.sdmp, Code.exe.2.dr	Binary or memory string: SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?;
Source: SHROsQyiAd.exe, 00000002.00000002.2444703943.0000000002AF0000.00000004.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000002.00000002.2442948453.0000000000675000.00000002.00000001.01000000.00000003.sdmp, SHROsQyiAd.exe, 00000002.00000000.2189298046.0000000000675000.00000002.00000001.01000000.00000003.sdmp, SHROsQyiAd.exe, 00000006.00000002.4640929809.0000000000675000.00000002.00000001.01000000.00000003.sdmp, Code.exe.2.dr	Binary or memory string: UPDATE metadb SET lastseen = ? WHERE rowid IN (SELECT rowid FROM temp.gc_present_items);

Source: SHROsQyiAd.exe	String found in binary or memory: /add <list-of-files> - appends the specified files to the current playlist instead of replacing the playlist content and playing them immediately
Source: SHROsQyiAd.exe	String found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
Source: SHROsQyiAd.exe	String found in binary or memory: /play, /pause, /playpause, /prev, /next, /rand, /stop - playback controls
Source: SHROsQyiAd.exe	String found in binary or memory: " /add "%1"
Source: SHROsQyiAd.exe	String found in binary or memory: @" "addplaynow.icoicons\generic.icoSoftware\Classesfoobar2000.url.foobar2000.SOFTWARE\Classes\CLSID\{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}\InprocServer32/CommandDelegateExecute{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}Directory\shellex\ContextMenuHandlers\Fb2kShellExtPlay in foobar2000PlayerMultiSelectModel" "%1"{0A35F9F4-F4BE-471A-890D-E09FFA6B38AD}Enqueue in foobar2000" /add "%1"AudioCD\shell\play\commandbckupAudioCDAudioCDbckupAudioCD(9D
Source: SHROsQyiAd.exe	String found in binary or memory: /install
Source: SHROsQyiAd.exe	String found in binary or memory: /stop
Source: SHROsQyiAd.exe	String found in binary or memory: /stop
Source: SHROsQyiAd.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: SHROsQyiAd.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: SHROsQyiAd.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: SHROsQyiAd.exe	String found in binary or memory: BThis playlist is already an autoplaylistThis playlist is not an autoplaylistPlaylist could not be lockedautoplaylist workerAutoplaylist provider missingCould not restore autoplaylist : Multiple wildcard levels not supported./immediate/add/playnow/help/?ErrorUnknown commandline parameter: /nogui/noresume/quiet/safe/install/hardreset/keepcomponents/nocrashinfo/playlist:/config/play/pause/playpause/prev/next/rand/stop/autoquit/exit/quit/show/hideCommand-line Help/command:/playlist_command:/playing_command:/context_command:
Source: SHROsQyiAd.exe	String found in binary or memory: /addcomponent
Source: SHROsQyiAd.exe	String found in binary or memory: VersionChecking for Updates UTC)ModuleAbout Install ComponentComponent maintenance failureAnother instance of this component already exists in your foobar2000 application folder; you need to remove it manually before you can update this component automatically.foobar2000 components\|foo_.zip;.fb2k-componentCould not load component "": Component removal failure(unknown - please apply changes to load)/addcomponentComponentsChecks for updated versions of installed components.Check for updated componentswww.foobar2000.orgInvalid responsechallengecomponent-updatesfingerprint5www.foobar2000.org/update-componentsmax_downloadSignature mismatchx-foobar2000-signature suppressed by user settingsComponent update: .zipComponent update of failed: Download corrupted (updated from Released on

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

File read: C:\Users\user\Desktop\SHROsQyiAd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SHROsQyiAd.exe "C:\Users\user\Desktop\SHROsQyiAd.exe"
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Process created: C:\Users\user\Desktop\SHROsQyiAd.exe "C:\Users\user\Desktop\SHROsQyiAd.exe"
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Process created: C:\Users\user\Desktop\SHROsQyiAd.exe "C:\Users\user\Desktop\SHROsQyiAd.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: crowdstrikeceoisextragay.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: sentinelisabadedrtrynexttimemaybe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: SHROsQyiAd.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SHROsQyiAd.exe

Static file information: File size 8779776 > 1048576

Source: SHROsQyiAd.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x273200
Source: SHROsQyiAd.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x53d400

Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SHROsQyiAd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SHROsQyiAd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SHROsQyiAd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Sources\foobar2000-2.24\foobar2000\Release\foobar2000.pdb source: SHROsQyiAd.exe, Code.exe.2.dr

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C8BCE3 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

6_2_00C8BCE3

Source: SHROsQyiAd.exe	Static PE information: section name: _RDATA
Source: Code.exe.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CC67E0 push eax; ret	6_2_00CC67FE
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CCB9DD push esi; ret	6_2_00CCB9E6
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CC5EAF push ecx; ret	6_2_00CC5EC2
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA3FF6 push ecx; ret	6_2_00CA4009

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C76128 ShellExecuteW,URLDownloadToFileW,

6_2_00C76128

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

File created: C:\Users\user\Favorites\VS Code\user-data\Code.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C89BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_2_00C89BC4

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VSCode			Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VSCode			Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

6_2_00C8BCE3

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C7E54F Sleep,ExitProcess,

6_2_00C7E54F

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

6_2_00C898C2

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Window / User API: threadDelayed 925	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Window / User API: threadDelayed 8591	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Window / User API: foregroundWindowGot 1755	Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Dropped PE file which has not been started: C:\Users\user\Favorites\VS Code\user-data\Code.exe

Jump to dropped file

Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 7104	Thread sleep count: 230 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 7104	Thread sleep time: -115000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 3620	Thread sleep count: 925 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 3620	Thread sleep time: -2775000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 3620	Thread sleep count: 8591 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SHROsQyiAd.exe TID: 3620	Thread sleep time: -25773000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C7B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_2_00C7B335
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C8B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	6_2_00C8B42F
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CBD5E9 FindFirstFileExA,	6_2_00CBD5E9
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C7B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_2_00C7B53A
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C789A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	6_2_00C789A9
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C76AC2 FindFirstFileW,FindNextFileW,	6_2_00C76AC2
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C77A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	6_2_00C77A8C
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C88C69 FindFirstFileW,FindNextFileW,FindNextFileW,	6_2_00C88C69
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00C78DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	6_2_00C78DA7

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C76F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_2_00C76F06

Source: SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F51000.00000004.00000800.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWkm
Source: SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F51000.00000004.00000800.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

API call chain: ExitProcess graph end node

graph_6-47610

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CAA65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00CAA65D

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

6_2_00C8BCE3

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CB2554 mov eax, dword ptr fs:[00000030h]

6_2_00CB2554

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CBE92E GetProcessHeap,

6_2_00CBE92E

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Process created: C:\Users\user\Desktop\SHROsQyiAd.exe "C:\Users\user\Desktop\SHROsQyiAd.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA4168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00CA4168
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CAA65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00CAA65D
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA3B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00CA3B44
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: 6_2_00CA3CD7 SetUnhandledExceptionFilter,	6_2_00CA3CD7

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Memory written: C:\Users\user\Desktop\SHROsQyiAd.exe base: C70000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

6_2_00C80F36

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C88754 mouse_event,

6_2_00C88754

Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/12/19 17:42:52 Program Manager]
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerneer1
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managera\data
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerl
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerc300cf
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerU
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managera\data8
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [%04i/%02i/%02i %02i:%02i:%02i Program Manager]
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/12/19 17:42:32 Program Manager]
Source: SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [2024/12/19 17:42:45 Program Manager]

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CA3E0A cpuid

6_2_00CA3E0A

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoA,	6_2_00C7E679
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: EnumSystemLocalesW,	6_2_00CB70AE
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoW,	6_2_00CC10BA
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00CC11E3
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoW,	6_2_00CC12EA
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00CC13B7
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoW,	6_2_00CB7597
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_00CC0A7F
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: EnumSystemLocalesW,	6_2_00CC0CF7
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: EnumSystemLocalesW,	6_2_00CC0DDD
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: EnumSystemLocalesW,	6_2_00CC0D42
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00CC0E6A

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 2_2_00644383 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00644383

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00C8A7A2 GetUserNameW,

6_2_00C8A7A2

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: 6_2_00CB800F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_2_00CB800F

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

6_2_00C7B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		6_2_00C7B335
Source: C:\Users\user\Desktop\SHROsQyiAd.exe	Code function: \key3.db		6_2_00C7B335

Remote Access Functionality

Yara detected Remcos RAT

Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.11c0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.SHROsQyiAd.exe.1130000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.SHROsQyiAd.exe.c70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 2308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SHROsQyiAd.exe PID: 3472, type: MEMORYSTR

Source: C:\Users\user\Desktop\SHROsQyiAd.exe

Code function: cmd.exe

6_2_00C75042

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	1 Bypass User Account Control	LSA Secrets	22 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SHROsQyiAd.exe	11%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		high
newstaticfreepoint24.ddns-ip.net	181.131.217.244	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
newstaticfreepoint24.ddns-ip.net	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gpH	SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.foobar2000.org/http://forums.foobar2000.org/AboutOpens	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
http://wiki.hydrogenaudio.org/index.php?title=Replaygain	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.radio-browser.info/	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
http://geoplugin.net/json.gp/C	SHROsQyiAd.exe, 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpl	SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://forums.foobar2000.org/	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.foobar2000.org/license	Code.exe.2.dr	false	unknown
https://help.foobar2000.org/~rbvrb	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
http://geoplugin.net/8	SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F31000.00000004.00000800.00020000.00000000.sdmp	false	high
https://help.foobar2000.org/	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.foobar2000.org/download	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.foobar2000.org/downloadcomponent_manager::on_app_initPre	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
http://geoplugin.net/json.gpz	SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.radio-browser.info/CountryLanguageTagNameLoading...No	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.foobar2000.org/	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
http://geoplugin.net/json.gpSystem32	SHROsQyiAd.exe, 00000006.00000002.4642099333.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, SHROsQyiAd.exe, 00000006.00000003.2425767584.0000000000F14000.00000004.00000800.00020000.00000000.sdmp	false	high
http://wiki.hydrogenaudio.org/index.php?title=ReplaygainSet	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown
https://www.radio-browser.info/history/	SHROsQyiAd.exe, Code.exe.2.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
181.131.217.244	newstaticfreepoint24.ddns-ip.net	Colombia		13489	EPMTelecomunicacionesSAESPCO	false
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578616
Start date and time:	2024-12-19 23:41:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SHROsQyiAd.exe renamed because original name is a hash value
Original Sample Name:	7119698425e2056d404e97b12ed5ca37.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@3/3@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 76% Number of executed functions: 37 Number of non-executed functions: 180
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.53.21, 13.107.246.63, 20.223.36.55, 2.16.158.192, 4.175.87.197, 150.171.27.10, 92.122.16.236, 23.218.208.109
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SHROsQyiAd.exe, PID 2308 because there are no executed function
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SHROsQyiAd.exe

Simulations

Behavior and APIs

Time	Type	Description
17:43:04	API Interceptor	5990579x Sleep call for process: SHROsQyiAd.exe modified
23:42:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run VSCode C:\Users\user\Favorites\VS Code\user-data\Code.exe
23:42:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run VSCode C:\Users\user\Favorites\VS Code\user-data\Code.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.131.217.244	nikDoCvpJa.exe	Get hash	malicious	Remcos	Browse
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse
	IXCbn4ZcdS.exe	Get hash	malicious	Remcos	Browse
	4JwhvqLe8n.exe	Get hash	malicious	Unknown	Browse
	d7gXUPUl38.exe	Get hash	malicious	Remcos	Browse
	fIPSLgT0lO.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	nikDoCvpJa.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	geoplugin.net/json.gp
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
newstaticfreepoint24.ddns-ip.net	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
geoplugin.net	nikDoCvpJa.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EPMTelecomunicacionesSAESPCO	nikDoCvpJa.exe	Get hash	malicious	Remcos	Browse	181.131.217.244
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	190.250.82.196
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	201.233.155.11
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	201.233.213.88
	arm5.nn-20241218-1651.elf	Get hash	malicious	Mirai, Okiru	Browse	201.232.1.208
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	181.134.107.144
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	181.130.255.187
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	181.140.1.158
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	181.135.96.108
	arm5.elf	Get hash	malicious	Unknown	Browse	191.94.11.254
ATOM86-ASATOM86NL	nikDoCvpJa.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17346150108fd59162a7f50db4b74cc85f1873b39cc8eaeab355e353b3b8b18e8e21fd369d493.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	178.237.33.50
	greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta	Get hash	malicious	Cobalt Strike, Remcos, DBatLoader	Browse	178.237.33.50
	RFQ NO 65-58003.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	SwiftCopy_PaymtRecpt121228.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	BBVA S.A..vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50

Process:	C:\Users\user\Desktop\SHROsQyiAd.exe
File Type:	data
Category:	dropped
Size (bytes):	488
Entropy (8bit):	3.3388163144619414
Encrypted:	false
SSDEEP:	12:6lJGkKecmlJGlfIbWFe5UlJGGlJGSbWFe5UlJGelJGRqbW+:6jGkTcmjG+WqUjGGjG2WqUjGejG4W+
MD5:	87C1EF97411850B115A267CAB2B9E743
SHA1:	5923EB59F4A1A6719BCDD0DC5CD6D893DB8478A2
SHA-256:	C59A93D2D4A70B209154C00EA59861702B6384320AF50B3940A76D3BB5FD389D
SHA-512:	3C0A7B88B0B653FB83BE94077DE9E4FC77734A79A978150D71E9A83BF17A874AF5F466D2058376211604FA49E98010D3F1F68F80BA38145DB0A51A56AF6FC1A0
Malicious:	false
Reputation:	low
Preview:	....[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.3.1. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.3.2. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.4.0. .R.u.n.].........[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.4.5. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.4.8. .R.u.n.].........[.2.0.2.4./.1.2./.1.9. .1.7.:.4.2.:.5.2. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Users\user\Desktop\SHROsQyiAd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.018384957371898
Encrypted:	false
SSDEEP:	12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
MD5:	C9BB4D5FD5C8A01D20EBF8334B62AE54
SHA1:	D38895F4CBB44CB10B6512A19034F14A2FC40359
SHA-256:	767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
SHA-512:	2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\Favorites\VS Code\user-data\Code.exe

Download File

Process:	C:\Users\user\Desktop\SHROsQyiAd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	959567331
Entropy (8bit):	0.11874123808649341
Encrypted:	false
SSDEEP:
MD5:	D66446D0DCEFEB7DE2A8C3FE7B6C5201
SHA1:	474DF7663BDB1A203A387F9F23F079B0C1641DD6
SHA-256:	540663033BFCEAA7D93AE6D93A4BC58ABFFF2349D1DC0170B391241119048887
SHA-512:	E01C5CA852D8D7365AE00E98EF476C00C4DF2B8EF364029A3F406EE6C5F1DECE08A188F503E255EA161DABF6FB864D605F9B4638191A1864D8417F8B3BF031DE
Malicious:	false
Reputation:	low
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........,...........h........~.............~......~.......~..........'..~...d..~......~......~......~......~......~..........'..~^...'.......l....'..~...Rich...................PE..L.....`g.........."......2'...^......>$......P'...@.......................................@.................................l.........2...S...................5.@...<..p..........................0m'.@............P'.....(...@....................text....@'......2'................. ..`.rdata.......P'..v...6'.............@..@.data............L..................@..._RDATA...0....0..,..../.............@..@.rsrc.....S...2...S..$2.............@..@........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.38784602956759
TrID:	Win32 Executable (generic) a (10002005/4) 98.19% foobar 2000 generic component (102126/2) 1.00% foobar 2000 Diskwriter output component (78126/2) 0.77% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	SHROsQyiAd.exe
File size:	8'779'776 bytes
MD5:	7119698425e2056d404e97b12ed5ca37
SHA1:	47ebc0744e88fbe12876471b49f4df80195f428a
SHA256:	f3646ac33546540137231400c43e90525e2bc6fad1ba2c27cb56466c65bd58b3
SHA512:	817eb34af541cd6b7b0a67e8d09668014c3fe9e43cb4df355840a2f7529853a8e34ca6d9af3e9b35137c7e13a6de98874dff50b962dc1d10b4e2a3041a9efede
SSDEEP:	98304:Gnbgpe4NdaEMybVR/XfJca1tzZdBTXuOMehkf9O:WUpe4qiJdxcg/
TLSH:	BB966A72E102C846D92501BFE829EAFC42196F38CB3795CB56C8FE1E3173AE20575A57
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........,..............h........~...............~.......~.......~............'..~....d..~.......~.......~.......~.......~.......~...

File Icon


Icon Hash:	334de0b2926d330e

Static PE Info

General

Entrypoint:	0x643e93
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67600E9F [Mon Dec 16 11:27:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d0efa8288bc8fcf1ae384debe93de6ac

Entrypoint Preview

Instruction
call 00007FF34487C18Dh
jmp 00007FF34487BACFh
push 00000010h
push 006E65C0h
call 00007FF34487C0DCh
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
mov byte ptr [ebp-19h], bl
mov dword ptr [ebp-04h], ebx
cmp ebx, dword ptr [ebp+14h]
je 00007FF34487BC73h
push dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+18h]
call dword ptr [00675B18h]
mov ecx, dword ptr [ebp+08h]
call dword ptr [ebp+18h]
mov eax, dword ptr [ebp+10h]
add dword ptr [ebp+08h], eax
add dword ptr [ebp+0Ch], eax
inc ebx
mov dword ptr [ebp-20h], ebx
jmp 00007FF34487BC2Ch
mov al, 01h
mov byte ptr [ebp-19h], al
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FF34487BC6Dh
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
retn 0018h
mov ebx, dword ptr [ebp-20h]
mov al, byte ptr [ebp-19h]
test al, al
jne 00007FF34487BC61h
push dword ptr [ebp+1Ch]
push ebx
push dword ptr [ebp+10h]
push dword ptr [ebp+08h]
call 00007FF34487B6C4h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF344644410h
push 006E66B4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF34487C35Bh
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FF344643863h
push 006E6608h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FF34487C33Eh
int3
push ebp
mov ebp, esp
and dword ptr [00701C04h], 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e826c	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32e000	0x53d400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x350000	0x2c140	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2a823c	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2a82c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x276d30	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x275000	0xb18	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2e8128	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x274000	0x273200	4bedbb2e9551e79fae7694bacea5282c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x275000	0x78000	0x77600	2a4704a587240261914c1de80110ddb1	False	0.3565792702879581	data	5.125253402867627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2ed000	0x1e000	0x14c00	0b15f16cdaeb2ade44ddb62497a9e5fb	False	0.22939806099397592	DOS executable (block device driver @\273\)	5.393205596281875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x30b000	0x23000	0x22c00	241f50e9d164772437fd3eebd88a3edb	False	0.16984459307553956	data	5.38723924085817	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x32e000	0x53d400	0x53d400	61b74e85afa3a3cabfd1c9e29fae61de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x32faf8	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fafc	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb00	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb04	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb08	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb0c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb10	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb14	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb18	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb1c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb20	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb24	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb28	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb2c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb30	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb34	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb38	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb3c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb40	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb44	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb48	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb4c	0x2	data	English	United States	5.0
AFX_DIALOG_LAYOUT	0x32fb50	0x2	data	English	United States	5.0
PNG	0x32fb54	0x5366	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004215456674472
RT_BITMAP	0x334ebc	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.5298930868509605
RT_BITMAP	0x3a78e0	0x72a24	Device independent bitmap graphic, 500 x 313 x 24, image size 469500, resolution 3780 x 3780 px/m			0.6542041146654172
RT_BITMAP	0x41a304	0x1d4e8	Device independent bitmap graphic, 200 x 200 x 24, image size 120000, resolution 3780 x 3780 px/m			0.651882705764745
RT_BITMAP	0x4377ec	0x1d4e8	Device independent bitmap graphic, 200 x 200 x 24, image size 120000, resolution 3780 x 3780 px/m			0.5804481839386871
RT_BITMAP	0x454cd4	0x27a18	Device independent bitmap graphic, 966 x 42 x 32, image size 162288, resolution 3582 x 3582 px/m			0.20433936227884283
RT_BITMAP	0x47c6ec	0x242a	Device independent bitmap graphic, 48 x 48 x 32, image size 9218, resolution 2834 x 2834 px/m			0.3424065672931519
RT_BITMAP	0x47eb18	0x242a	Device independent bitmap graphic, 48 x 48 x 32, image size 9218, resolution 2834 x 2834 px/m			0.3844242817023115
RT_ICON	0x480f44	0xc5c0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8094974715549936
RT_ICON	0x48d504	0x145a0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8880158349328215
RT_ICON	0x4a1aa4	0xcce6	PC bitmap, Windows 3.x format, 6861 x 2 x 35, image size 53283, cbSize 52454, bits offset 54			0.5655812712090593
RT_ICON	0x4ae78c	0x44028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144			0.18652178283219897
RT_ICON	0x4f27b4	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016			0.2241696447340761
RT_ICON	0x4fbc5c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.0825742339997634
RT_ICON	0x50c484	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.33630393996247654
RT_ICON	0x50d52c	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.29319526627218934
RT_ICON	0x50ef94	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.258298755186722
RT_ICON	0x51153c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.20896315540859708
RT_ICON	0x515764	0x5cd2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9988216480094269
RT_ICON	0x51b438	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5301418439716312
RT_ICON	0x51b8a0	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.4511627906976744
RT_ICON	0x51bf58	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.41270491803278686
RT_MENU	0x51c8e0	0x31a	data			0.7506297229219143
RT_DIALOG	0x51cbfc	0x35c	data	English	United States	0.436046511627907
RT_DIALOG	0x51cf58	0x502	data	English	United States	0.3962558502340094
RT_DIALOG	0x51d45c	0x248	data	English	United States	0.4828767123287671
RT_DIALOG	0x51d6a4	0x2c2	data	English	United States	0.4730878186968839
RT_DIALOG	0x51d968	0x630	data	English	United States	0.4116161616161616
RT_DIALOG	0x51df98	0x1e8	data	English	United States	0.5368852459016393
RT_DIALOG	0x51e180	0x828	data	English	United States	0.4051724137931034
RT_DIALOG	0x51e9a8	0x36c	data	English	United States	0.45662100456621
RT_DIALOG	0x51ed14	0x188	data	English	United States	0.5586734693877551
RT_DIALOG	0x51ee9c	0x1e8	data	English	United States	0.5430327868852459
RT_DIALOG	0x51f084	0x4a8	data	English	United States	0.42533557046979864
RT_DIALOG	0x51f52c	0x278	data	English	United States	0.44936708860759494
RT_DIALOG	0x51f7a4	0xc8	data	English	United States	0.675
RT_DIALOG	0x51f86c	0x634	data	English	United States	0.4275818639798489
RT_DIALOG	0x51fea0	0x4d2	data	English	United States	0.3987034035656402
RT_DIALOG	0x520374	0x2b0	data	English	United States	0.4738372093023256
RT_DIALOG	0x520624	0xd0	data	English	United States	0.6586538461538461
RT_DIALOG	0x5206f4	0x124	data	English	United States	0.589041095890411
RT_DIALOG	0x520818	0x30e	data	English	United States	0.4322250639386189
RT_DIALOG	0x520b28	0x174	data	English	United States	0.5698924731182796
RT_DIALOG	0x520c9c	0x220	data	English	United States	0.48713235294117646
RT_DIALOG	0x520ebc	0x2d2	data	English	United States	0.4695290858725762
RT_DIALOG	0x521190	0xec	data	English	United States	0.673728813559322
RT_DIALOG	0x52127c	0x1e0	data	English	United States	0.5229166666666667
RT_DIALOG	0x52145c	0x1b0	data	English	United States	0.5532407407407407
RT_DIALOG	0x52160c	0x1a4	data	English	United States	0.5333333333333333
RT_DIALOG	0x5217b0	0x100	data	English	United States	0.62890625
RT_DIALOG	0x5218b0	0x60	data	English	United States	0.7291666666666666
RT_DIALOG	0x521910	0x4ac	data	English	United States	0.3804347826086957
RT_DIALOG	0x521dbc	0x326	data	English	United States	0.4640198511166253
RT_DIALOG	0x5220e4	0x1f8	data	English	United States	0.5515873015873016
RT_DIALOG	0x5222dc	0xe0	data	English	United States	0.6607142857142857
RT_DIALOG	0x5223bc	0xe4	data	English	United States	0.6798245614035088
RT_DIALOG	0x5224a0	0x1c4	data	English	United States	0.5575221238938053
RT_DIALOG	0x522664	0x104	data	English	United States	0.573076923076923
RT_DIALOG	0x522768	0xaa	data	English	United States	0.7411764705882353
RT_DIALOG	0x522814	0x1f4	data	English	United States	0.492
RT_DIALOG	0x522a08	0x12c	data	English	United States	0.5966666666666667
RT_DIALOG	0x522b34	0x7c	data	English	United States	0.7903225806451613
RT_DIALOG	0x522bb0	0x40	data	English	United States	0.765625
RT_DIALOG	0x522bf0	0x228	data	English	United States	0.519927536231884
RT_DIALOG	0x522e18	0xa4	data	English	United States	0.6829268292682927
RT_DIALOG	0x522ebc	0xb8	data	English	United States	0.6739130434782609
RT_DIALOG	0x522f74	0x228	data	English	United States	0.5018115942028986
RT_DIALOG	0x52319c	0xa8	data	English	United States	0.6607142857142857
RT_DIALOG	0x523244	0x11c	data	English	United States	0.5845070422535211
RT_DIALOG	0x523360	0x1c8	data	English	United States	0.4868421052631579
RT_DIALOG	0x523528	0x32c	data	English	United States	0.45689655172413796
RT_DIALOG	0x523854	0x90	data	English	United States	0.6944444444444444
RT_DIALOG	0x5238e4	0xc6	data	English	United States	0.6919191919191919
RT_DIALOG	0x5239ac	0x224	data	English	United States	0.5547445255474452
RT_DIALOG	0x523bd0	0x224	data	English	United States	0.5602189781021898
RT_DIALOG	0x523df4	0x120	data	English	United States	0.5972222222222222
RT_DIALOG	0x523f14	0x5d4	data	English	United States	0.4175603217158177
RT_DIALOG	0x5244e8	0x17e	data	English	United States	0.5837696335078534
RT_DIALOG	0x524668	0x19e	data	English	United States	0.5217391304347826
RT_DIALOG	0x524808	0x1e0	data	English	United States	0.51875
RT_DIALOG	0x5249e8	0x3f8	data	English	United States	0.43799212598425197
RT_DIALOG	0x524de0	0x6e	data	English	United States	0.7181818181818181
RT_DIALOG	0x524e50	0x7c	data	English	United States	0.7338709677419355
RT_DIALOG	0x524ecc	0x3e0	data	English	United States	0.4254032258064516
RT_DIALOG	0x5252ac	0x94	data	English	United States	0.7905405405405406
RT_DIALOG	0x525340	0x246	data	English	United States	0.49140893470790376
RT_DIALOG	0x525588	0x1e8	data	English	United States	0.4959016393442623
RT_DIALOG	0x525770	0xfc	data	English	United States	0.6626984126984127
RT_DIALOG	0x52586c	0x160	data	English	United States	0.6051136363636364
RT_DIALOG	0x5259cc	0x4ec	data	English	United States	0.44047619047619047
RT_DIALOG	0x525eb8	0x2f0	data	English	United States	0.4654255319148936
RT_DIALOG	0x5261a8	0x1ac	data	English	United States	0.5677570093457944
RT_DIALOG	0x526354	0x142	data	English	United States	0.5869565217391305
RT_DIALOG	0x526498	0x1ae	data	English	United States	0.5511627906976744
RT_ACCELERATOR	0x526648	0x20	data	English	United States	0.96875
RT_ACCELERATOR	0x526668	0x28	data	English	United States	0.95
RT_RCDATA	0x526690	0x4e550	Delphi compiled form 'TBaseFrame'			0.3885578217723034
RT_RCDATA	0x574be0	0x7cf06	Delphi compiled form 'TFilePropertiesForm2'			0.299847581827064
RT_RCDATA	0x5f1ae8	0xf7ece	Delphi compiled form 'TfPNGMessage'			0.09640946054266757
RT_RCDATA	0x6e99b8	0xf7ece	Delphi compiled form 'TfPNGMessage'			0.16799277598665488
RT_RCDATA	0x7e1888	0x1b681	Delphi compiled form 'TMsgBoxForm'			0.6012988054197066
RT_MESSAGETABLE	0x7fcf0c	0x2840	data			0.3316187888198758
RT_GROUP_ICON	0x7ff74c	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x7ff7c4	0x30c	data	English	United States	0.44358974358974357
RT_ANIICON	0x7ffad0	0x6b92e	PC bitmap, Windows 3.x format, 55213 x 2 x 37, image size 441441, cbSize 440622, bits offset 54			0.7761573412131033

Imports

DLL	Import
COMCTL32.dll	ImageList_Destroy, ImageList_Create, ImageList_Add
WINMM.dll	timeGetTime, timeBeginPeriod, timeEndPeriod
SHLWAPI.dll	SHAutoComplete, StrCmpLogicalW, SHDeleteKeyW
UxTheme.dll	IsThemePartDefined, OpenThemeData, GetThemePartSize, SetWindowTheme, DrawThemeBackground, EnableThemeDialogTexture, CloseThemeData
KERNEL32.dll	GetSystemPowerStatus, VerifyVersionInfoW, VerSetConditionMask, GlobalFree, SystemTimeToFileTime, LocalFileTimeToFileTime, ResumeThread, GetLocaleInfoW, GetNumberFormatW, GlobalSize, DecodePointer, Sleep, SetErrorMode, LoadLibraryW, CreateEventW, FindResourceW, FindResourceExW, LoadResource, LockResource, SizeofResource, SetEndOfFile, GetFileTime, FlushFileBuffers, CreateFileW, GetDiskFreeSpaceExW, FindFirstFileW, DeleteFileW, RemoveDirectoryW, GetFileAttributesW, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, InitializeCriticalSectionAndSpinCount, LoadLibraryExA, GetCurrentThreadId, VirtualAlloc, IsProcessorFeaturePresent, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, EncodePointer, InitOnceComplete, InitOnceBeginInitialize, SystemTimeToTzSpecificLocalTime, MoveFileExW, NormalizeString, TryEnterCriticalSection, GetVolumeNameForVolumeMountPointW, GetVolumePathNameW, DeviceIoControl, SetFileTime, SetFilePointer, DosDateTimeToFileTime, GetFileSizeEx, FileTimeToSystemTime, GetSystemTimeAsFileTime, ReadDirectoryChangesW, GetThreadPriority, GetThreadId, GetFileInformationByHandle, TerminateProcess, GetCurrentProcess, DuplicateHandle, WriteFile, CancelIo, GetOverlappedResult, ReadFile, WideCharToMultiByte, MultiByteToWideChar, WaitForMultipleObjects, FormatMessageW, GlobalUnlock, GlobalLock, GlobalAlloc, GetCommandLineW, LoadLibraryExW, lstrlenW, GetNativeSystemInfo, GetVersionExW, PowerCreateRequest, PowerClearRequest, PowerSetRequest, SetLastError, EnterCriticalSection, SetThreadPriority, OutputDebugStringW, LeaveCriticalSection, GetTickCount64, DeleteCriticalSection, GetFileAttributesExW, FindNextFileW, FindClose, GetCurrentThread, SetEvent, ResetEvent, GetExitCodeThread, GetCurrentProcessId, VirtualQuery, VirtualProtect, GetSystemInfo, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, ReleaseSRWLockShared, AcquireSRWLockShared, CopyFileW, IsDebuggerPresent, FreeLibrary, SetDllDirectoryW, CloseHandle, WaitForSingleObject, GetModuleHandleW, GetProcAddress, GetTickCount, GetProcessHeap, HeapAlloc, CreateMutexW, InitializeCriticalSection, QueryPerformanceCounter, QueryPerformanceFrequency, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, MulDiv, InitializeCriticalSectionEx, GetLastError, RaiseException, VirtualFree
USER32.dll	SetDlgItemTextW, MapVirtualKeyW, GetDlgItem, SendMessageW, ShowWindow, EnableWindow, SetWindowTextW, DestroyWindow, UnregisterClassW, CreateDialogParamW, SetWindowLongW, SendDlgItemMessageW, GetActiveWindow, GetWindowLongW, GetClientRect, ClientToScreen, GetWindowRect, SetWindowPos, SetLayeredWindowAttributes, CharUpperW, GetComboBoxInfo, GetSystemMetrics, EnumThreadWindows, GetWindowPlacement, IsIconic, AdjustWindowRect, DrawEdge, SetClipboardData, CloseClipboard, OpenClipboard, FillRect, AdjustWindowRectEx, GetWindowTextLengthW, GetWindowTextW, NotifyWinEvent, RedrawWindow, IsRectEmpty, DrawTextW, TrackMouseEvent, InflateRect, FrameRect, UnhookWindowsHookEx, SetWindowsHookExW, CallNextHookEx, GetNextDlgTabItem, InvalidateRgn, SystemParametersInfoW, ScrollWindowEx, SetScrollPos, UpdateWindow, SetScrollInfo, SetRectEmpty, SetGestureConfig, CloseGestureInfoHandle, GetGestureInfo, GetScrollInfo, MapDialogRect, IsZoomed, SetMenuItemInfoW, GetMenuItemInfoW, GetMenu, GetWindow, GetDC, BeginPaint, EndPaint, InvalidateRect, IsWindowEnabled, PostMessageW, CreateWindowExW, ScreenToClient, IntersectRect, MonitorFromWindow, LoadIconW, RegisterClipboardFormatW, wsprintfW, AllowSetForegroundWindow, EnumWindows, GetClassNameW, GetWindowThreadProcessId, WindowFromPoint, CheckMenuRadioItem, RegisterShellHookWindow, DeregisterShellHookWindow, RegisterWindowMessageW, RegisterClassW, GetClipboardData, IsCharAlphaW, IsClipboardFormatAvailable, DispatchMessageW, TranslateMessage, LoadImageW, GetDesktopWindow, PostQuitMessage, GetMessageW, MsgWaitForMultipleObjects, OffsetRect, CopyRect, MonitorFromRect, CharLowerW, EndDeferWindowPos, BeginDeferWindowPos, DeferWindowPos, EmptyClipboard, IsWindowVisible, MoveWindow, IsChild, PeekMessageW, SetTimer, DrawTextExW, SetForegroundWindow, PtInRect, DefWindowProcW, GetCursorPos, SetFocus, KillTimer, SetCapture, SetCursor, LoadCursorW, IsDialogMessageW, RegisterClassExW, GetClassInfoExW, CallWindowProcW, GetWindowDC, ReleaseDC, DrawFrameControl, GetParent, GetKeyState, GetMessagePos, AppendMenuW, TrackPopupMenu, CreatePopupMenu, MonitorFromPoint, GetMonitorInfoW, DestroyMenu, MessageBoxW, EndDialog, DialogBoxParamW, MessageBeep, SetActiveWindow, EnumChildWindows, MapWindowPoints, SetMenuDefaultItem, TrackPopupMenuEx, GetDlgCtrlID, GetSysColor, GetFocus, TranslateAcceleratorW, LoadAcceleratorsW, DestroyAcceleratorTable, RegisterHotKey, UnregisterHotKey
GDI32.dll	GetStockObject, SelectObject, CreateCompatibleDC, CreateCompatibleBitmap, ExtTextOutW, SetBkColor, SetTextColor, DeleteDC, DeleteObject, GetObjectW, CreateFontIndirectW, SetBkMode, CreateRectRgnIndirect, CreateRectRgn, GetTextExtentPoint32W, GetTextColor, GetBkColor, GetCurrentObject, SetDCBrushColor, CreatePen, GetDeviceCaps, GetTextMetricsW, LPtoDP, SaveDC, RestoreDC, OffsetWindowOrgEx, SetWindowOrgEx, IntersectClipRect, CreatePolygonRgn, FrameRgn, FillRgn, SetViewportOrgEx, BitBlt, CombineRgn, SetDCPenColor, LineTo, MoveToEx, OffsetRgn
ADVAPI32.dll	CryptImportKey, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegOpenKeyW, RegCreateKeyW, RegDeleteValueW, CryptGetHashParam, CryptVerifySignatureW, CryptHashData, CryptCreateHash, RegGetValueW, CryptDestroyKey, CryptDestroyHash, CryptReleaseContext, RegEnumValueW, CryptAcquireContextW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW
SHELL32.dll	SHOpenFolderAndSelectItems, SHGetFolderPathW, SHCreateItemFromIDList, DragAcceptFiles, ShellExecuteExW, SHGetDesktopFolder, DragFinish
ole32.dll	CoCreateInstance, OleSetClipboard, OleGetClipboard, CoTaskMemFree, PropVariantClear, CLSIDFromString, CoTaskMemAlloc, ReleaseStgMedium, CoCreateGuid, DoDragDrop, CoUninitialize, RegisterDragDrop, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, RevokeDragDrop
OLEAUT32.dll	VariantClear, VariantInit, SysAllocString
OLEACC.dll	AccessibleObjectFromWindow, LresultFromObject
CRYPT32.dll	CertVerifyRevocation, CertVerifyCertificateChainPolicy, CertGetCertificateChain, CertVerifyTimeValidity, CertCloseStore, CertFreeCertificateChain, CertFreeCertificateContext

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T23:42:33.005441+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.6	49773	181.131.217.244	3020	TCP
2024-12-19T23:42:34.257170+0100	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	181.131.217.244	3020	192.168.2.6	49773	TCP
2024-12-19T23:42:36.056369+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49780	178.237.33.50	80	TCP
2024-12-19T23:44:52.538251+0100	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	1	181.131.217.244	3020	192.168.2.6	49773	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 23:42:32.861991882 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:32.981590986 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:32.982827902 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:33.005440950 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:33.125046968 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:34.257169962 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:34.303256989 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:34.425097942 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:34.492746115 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:34.612951994 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:34.692225933 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:42:34.811904907 CET	80	49780	178.237.33.50	192.168.2.6
Dec 19, 2024 23:42:34.812011003 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:42:34.812305927 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:42:34.933470964 CET	80	49780	178.237.33.50	192.168.2.6
Dec 19, 2024 23:42:36.056298018 CET	80	49780	178.237.33.50	192.168.2.6
Dec 19, 2024 23:42:36.056369066 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:42:36.174133062 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:36.293732882 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:37.055639029 CET	80	49780	178.237.33.50	192.168.2.6
Dec 19, 2024 23:42:37.055702925 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:42:52.276170969 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:42:52.277363062 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:42:52.397197008 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:43:22.367377043 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:43:22.368509054 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:43:22.488035917 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:43:52.398148060 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:43:52.402360916 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:43:52.522624016 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:44:22.447581053 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:44:22.453505039 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:44:22.573074102 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:44:24.535968065 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:24.975891113 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:25.660010099 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:26.972548962 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:29.472493887 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:34.472512007 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:44.175939083 CET	49780	80	192.168.2.6	178.237.33.50
Dec 19, 2024 23:44:52.538250923 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:44:52.547180891 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:44:52.666826963 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:45:22.585927010 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:45:22.592022896 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:45:22.711642027 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:45:52.686440945 CET	3020	49773	181.131.217.244	192.168.2.6
Dec 19, 2024 23:45:52.688266039 CET	49773	3020	192.168.2.6	181.131.217.244
Dec 19, 2024 23:45:52.807832003 CET	3020	49773	181.131.217.244	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 23:42:32.372544050 CET	56637	53	192.168.2.6	1.1.1.1
Dec 19, 2024 23:42:32.779983997 CET	53	56637	1.1.1.1	192.168.2.6
Dec 19, 2024 23:42:34.546252966 CET	55879	53	192.168.2.6	1.1.1.1
Dec 19, 2024 23:42:34.685386896 CET	53	55879	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 23:42:32.372544050 CET	192.168.2.6	1.1.1.1	0xfcf5	Standard query (0)	newstaticfreepoint24.ddns-ip.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:42:34.546252966 CET	192.168.2.6	1.1.1.1	0x8321	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 23:42:32.779983997 CET	1.1.1.1	192.168.2.6	0xfcf5	No error (0)	newstaticfreepoint24.ddns-ip.net		181.131.217.244	A (IP address)	IN (0x0001)	false
Dec 19, 2024 23:42:34.685386896 CET	1.1.1.1	192.168.2.6	0x8321	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49780	178.237.33.50	80	3472	C:\Users\user\Desktop\SHROsQyiAd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 23:42:34.812305927 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Dec 19, 2024 23:42:36.056298018 CET	1171	IN	HTTP/1.1 200 OK date: Thu, 19 Dec 2024 22:42:35 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	2
Start time:	17:42:11
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\SHROsQyiAd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHROsQyiAd.exe"
Imagebase:	0x400000
File size:	8'779'776 bytes
MD5 hash:	7119698425E2056D404E97B12ED5CA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.2444408397.0000000001130000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000002.00000002.2444502567.00000000011C0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:42:31
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\SHROsQyiAd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SHROsQyiAd.exe"
Imagebase:	0x400000
File size:	8'779'776 bytes
MD5 hash:	7119698425E2056D404E97B12ED5CA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.8%
Total number of Nodes:	1321
Total number of Limit Nodes:	51

Executed Functions

Function 00C8BCE3 Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,00C7D783), ref: 00C8BCF8
GetProcAddress.KERNEL32(00000000), ref: 00C8BD01
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,00C7D783), ref: 00C8BD18
GetProcAddress.KERNEL32(00000000), ref: 00C8BD1B
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,00C7D783), ref: 00C8BD2D
GetProcAddress.KERNEL32(00000000), ref: 00C8BD30
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,00C7D783), ref: 00C8BD41
GetProcAddress.KERNEL32(00000000), ref: 00C8BD44
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,00C7D783), ref: 00C8BD55
GetProcAddress.KERNEL32(00000000), ref: 00C8BD58
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,00C7D783), ref: 00C8BD65
GetProcAddress.KERNEL32(00000000), ref: 00C8BD68
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,00C7D783), ref: 00C8BD75
GetProcAddress.KERNEL32(00000000), ref: 00C8BD78
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,00C7D783), ref: 00C8BD85
GetProcAddress.KERNEL32(00000000), ref: 00C8BD88
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,00C7D783), ref: 00C8BD99
GetProcAddress.KERNEL32(00000000), ref: 00C8BD9C
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,00C7D783), ref: 00C8BDA9
GetProcAddress.KERNEL32(00000000), ref: 00C8BDAC
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,00C7D783), ref: 00C8BDBD
GetProcAddress.KERNEL32(00000000), ref: 00C8BDC0
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,00C7D783), ref: 00C8BDD1
GetProcAddress.KERNEL32(00000000), ref: 00C8BDD4
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,00C7D783), ref: 00C8BDE5
GetProcAddress.KERNEL32(00000000), ref: 00C8BDE8
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,00C7D783), ref: 00C8BDF5
GetProcAddress.KERNEL32(00000000), ref: 00C8BDF8
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,00C7D783), ref: 00C8BE06
GetProcAddress.KERNEL32(00000000), ref: 00C8BE09
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,00C7D783), ref: 00C8BE16
GetProcAddress.KERNEL32(00000000), ref: 00C8BE19
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,00C7D783), ref: 00C8BE2B
GetProcAddress.KERNEL32(00000000), ref: 00C8BE2E
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,00C7D783), ref: 00C8BE3B
GetProcAddress.KERNEL32(00000000), ref: 00C8BE3E
LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,00C7D783), ref: 00C8BE50
GetProcAddress.KERNEL32(00000000), ref: 00C8BE53
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,00C7D783), ref: 00C8BE60
GetProcAddress.KERNEL32(00000000), ref: 00C8BE63

Strings

ntdll, xrefs: 00C8BD50, 00C8BE20, 00C8BE2A, 00C8BE3A
Shell32, xrefs: 00C8BD8F
EnumDisplayMonitors, xrefs: 00C8BDC2
NtSuspendProcess, xrefs: 00C8BE1B
Kernel32, xrefs: 00C8BD13
NtUnmapViewOfSection, xrefs: 00C8BD4B
IsUserAnAdmin, xrefs: 00C8BD8A
Shlwapi, xrefs: 00C8BDFC
IsWow64Process, xrefs: 00C8BD6A
NtResumeProcess, xrefs: 00C8BE30
GetComputerNameExW, xrefs: 00C8BD7A
Psapi, xrefs: 00C8BCF3
Iphlpapi, xrefs: 00C8BE45, 00C8BE4F, 00C8BE5A
EnumDisplayDevicesW, xrefs: 00C8BDAE
SetProcessDEPPolicy, xrefs: 00C8BD9E
kernel32, xrefs: 00C8BD5F, 00C8BD64, 00C8BD6F, 00C8BD7F, 00C8BDA3, 00C8BDEF, 00C8BE10
user32, xrefs: 00C8BD3C, 00C8BDB3, 00C8BDC7, 00C8BDDB
GetSystemTimes, xrefs: 00C8BDEA
shcore, xrefs: 00C8BD28
GetConsoleWindow, xrefs: 00C8BE0B
GetMonitorInfoW, xrefs: 00C8BDD6
GetExtendedTcpTable, xrefs: 00C8BE40
GetExtendedUdpTable, xrefs: 00C8BE55
GetProcessImageFileNameW, xrefs: 00C8BCED, 00C8BCF2, 00C8BD12
GlobalMemoryStatusEx, xrefs: 00C8BD5A
SetProcessDpiAwareness, xrefs: 00C8BD22, 00C8BD27, 00C8BD3B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 384173800-625181639
Opcode ID: 40ce0173f7360088a4dfb35494d116b9900633fa9f8a5060d8385cc8d0183216
Instruction ID: f0dc4e311d2beedeb72904c771e7a71706122ab6b214ca74e1ce2362208890a6
Opcode Fuzzy Hash: 40ce0173f7360088a4dfb35494d116b9900633fa9f8a5060d8385cc8d0183216
Instruction Fuzzy Hash: FE31BDA4E4039CFADA107BF65C8DF5F7E9CD944B943020927B6059B751DFB8AD008EA8

Function 00C799E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00C79A01
SetWindowsHookExA.USER32(0000000D,00C799D0,00000000), ref: 00C79A0F
GetLastError.KERNEL32 ref: 00C79A1B

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00C79A6B
TranslateMessage.USER32(?), ref: 00C79A7A
DispatchMessageA.USER32(?), ref: 00C79A85

Strings

`#v, xrefs: 00C79A01
Keylogger initialization failure: error , xrefs: 00C79A32

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error $`#v
API String ID: 3219506041-3226811161
Opcode ID: 9b93a82d5725e5acb79b900fff90500f7a7bfc923e3dd6f85c44a952260512a9
Instruction ID: 3cc81d99ecdb011be53e16356296da574efae269d0c0793c2e97b6aeca6a8eee
Opcode Fuzzy Hash: 9b93a82d5725e5acb79b900fff90500f7a7bfc923e3dd6f85c44a952260512a9
Instruction Fuzzy Hash: AC119471904201AFD710BB7ADC4AE6B77ECEB94725B04462EFC59C2150EB30DA01DBA2

Function 00C79B10 Relevance: 12.1, APIs: 8, Instructions: 108
keyboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(?,?,00CE40F8), ref: 00C79B3F
GetWindowThreadProcessId.USER32(00000000,?), ref: 00C79B4B
GetKeyboardLayout.USER32(00000000), ref: 00C79B52
GetKeyState.USER32(00000010), ref: 00C79B5C
GetKeyboardState.USER32(?,?,00CE40F8), ref: 00C79B67
ToUnicodeEx.USER32(00CE414C,?,?,?,00000010,00000000,00000000), ref: 00C79B8A
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00C79BE3
ToUnicodeEx.USER32(00CE414C,?,?,?,00000010,00000000,00000000), ref: 00C79C1C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: 24c1aebe355dc68eb237c55c2c6eca8d1a167fdf86853835c42a67bc3f5474c9
Instruction ID: 8395e89756b2a8f05cff5284cdfab233a2d976922947698a0a201c2f5e6e17a8
Opcode Fuzzy Hash: 24c1aebe355dc68eb237c55c2c6eca8d1a167fdf86853835c42a67bc3f5474c9
Instruction Fuzzy Hash: 1431CF72104348AFD710DB90DC85FDFBBECEB88714F00492AF645D61A0D7B1A9489BA2

Function 00C7E54F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C824B7: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,?), ref: 00C824D7
Part of subcall function 00C824B7: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,00000000,?,00CE42F8), ref: 00C824F5
Part of subcall function 00C824B7: RegCloseKey.KERNELBASE(?), ref: 00C82500

Sleep.KERNELBASE(00000BB8), ref: 00C7E603
ExitProcess.KERNEL32 ref: 00C7E672

Strings

5.3.0 Pro, xrefs: 00C7E5DE, 00C7E64B
pth_unenc, xrefs: 00C7E565, 00C7E5AC, 00C7E619
override, xrefs: 00C7E574

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 5.3.0 Pro$override$pth_unenc
API String ID: 2281282204-531312966
Opcode ID: 45ddc12b185f28f616192a291eb3973e2c2620a52a93d15bbb97285e805fe409
Instruction ID: 11ad480718e75f937955652b1199304e3cd169a4cf32132f2d7cb178f4526852
Opcode Fuzzy Hash: 45ddc12b185f28f616192a291eb3973e2c2620a52a93d15bbb97285e805fe409
Instruction Fuzzy Hash: B5210A72F002046BD60876B98C1FA3F359A9B95728F84802DFD19573C7EE258E0093E7

Function 00C7455B Relevance: 4.5, APIs: 3, Instructions: 28synchronizationnetworkCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,00C7460E,00000000,?,?), ref: 00C7456A
SetEvent.KERNEL32(?,?,?,00C7460E,00000000,?,?), ref: 00C74588
recv.WS2_32(?,?,?,00000000), ref: 00C7459F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitrecv
String ID:
API String ID: 311754179-0
Opcode ID: 8c7fa08e6bd9a99e1dbdc9ec8faa9b230f3f846875420b6173f4da3b003047c4
Instruction ID: 9d363bb1dd062edfb934de5e61eefc2ea67418888b40bd0561348768308cbd8c
Opcode Fuzzy Hash: 8c7fa08e6bd9a99e1dbdc9ec8faa9b230f3f846875420b6173f4da3b003047c4
Instruction Fuzzy Hash: 5DF08236108212FFD7058B14EC08F0AFF62FB88720F21C61AF514522A08771AC20DF51

Function 00C8A7A2 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,00C7DFC3), ref: 00C8A7D7

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 7659614b6bbdda5a7733c08e161de1e4b02512f661d0e34b4c3a10e1a3f48f32
Instruction ID: d48d29047c88c9886b4c90b18c769a483d0f704c5698fa9eba6bd4d74141374d
Opcode Fuzzy Hash: 7659614b6bbdda5a7733c08e161de1e4b02512f661d0e34b4c3a10e1a3f48f32
Instruction Fuzzy Hash: 92014B7290011CABDB00EB90DC49EDDB7BCEF44310F004166B806B3191EFB0AB89AB98

Function 00C7E679 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(00000800,0000005A,00000000,00000003,?,?,?,00C845AD,00CE3EE8,00CE4A10,00CE3EE8,00000000,00CE3EE8,?,00CE3EE8,5.3.0 Pro), ref: 00C7E68D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e63f35031c09b9cc87b33bc9367de3adeadc0ffbb690981aad141828956cfdb2
Instruction ID: 3a0f9a59ca8ce5a7626d185af8b4f12b4836182841b829bb4a34a25a090a3387
Opcode Fuzzy Hash: e63f35031c09b9cc87b33bc9367de3adeadc0ffbb690981aad141828956cfdb2
Instruction Fuzzy Hash: DFD05E607002187BEA109285CC0AF9A7AACE700B61F000151FA01D72C0E9A0AF008BE1

Function 00C7D767 Relevance: 46.3, APIs: 13, Strings: 13, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C8BCE3: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,00C7D783), ref: 00C8BCF8
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD01
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,00C7D783), ref: 00C8BD18
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD1B
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,00C7D783), ref: 00C8BD2D
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD30
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,00C7D783), ref: 00C8BD41
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD44
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,00C7D783), ref: 00C8BD55
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD58
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,00C7D783), ref: 00C8BD65
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD68
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,00C7D783), ref: 00C8BD75
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD78
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,00C7D783), ref: 00C8BD85
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD88
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,00C7D783), ref: 00C8BD99
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BD9C
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,00C7D783), ref: 00C8BDA9
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BDAC
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,00C7D783), ref: 00C8BDBD
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BDC0
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,00C7D783), ref: 00C8BDD1
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BDD4
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,00C7D783), ref: 00C8BDE5
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BDE8
Part of subcall function 00C8BCE3: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,00C7D783), ref: 00C8BDF5
Part of subcall function 00C8BCE3: GetProcAddress.KERNEL32(00000000), ref: 00C8BDF8
Part of subcall function 00C8BCE3: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,00C7D783), ref: 00C8BE06

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SHROsQyiAd.exe,00000104), ref: 00C7D790

Part of subcall function 00C7FCBA: __EH_prolog.LIBCMT ref: 00C7FCBF

Strings

exepath, xrefs: 00C7DC34, 00C7DCDE
del, xrefs: 00C7E094, 00C7E0F4
license_code.txt, xrefs: 00C7D7EF
User, xrefs: 00C7E038
del, xrefs: 00C7E078
licence, xrefs: 00C7DD25
Access Level: , xrefs: 00C7E047
C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C7D788, 00C7DBB1
Inj, xrefs: 00C7D977, 00C7D98E
Administrator, xrefs: 00C7E02C
Exe, xrefs: 00C7D8B1
Software\, xrefs: 00C7D865
Remcos Agent initialized, xrefs: 00C7DD8C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: Access Level: $Administrator$C:\Users\user\Desktop\SHROsQyiAd.exe$Exe$Inj$Remcos Agent initialized$Software\$User$del$del$exepath$licence$license_code.txt
API String ID: 2830904901-2389145350
Opcode ID: 6baeb9621b0d91450cc278836759fcfb5bbad96f5f13d1ad2dd62f3f6c805c1b
Instruction ID: 1d641b2aee19c6877b5df9900b288e45b09319a1f5400ac1f8960d05ac50eedd
Opcode Fuzzy Hash: 6baeb9621b0d91450cc278836759fcfb5bbad96f5f13d1ad2dd62f3f6c805c1b
Instruction Fuzzy Hash: 2C320661B043806BDF29B7799C5BB7E269A8F91740F08C42DFD4A5B2C3DE648D04E362

Function 00C83FD4 Relevance: 32.3, APIs: 5, Strings: 13, Instructions: 813
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000029,00CE42F8,?,00000000), ref: 00C84028
WSAGetLastError.WS2_32 ref: 00C84249
Sleep.KERNEL32(00000000,00000002), ref: 00C84B88

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

Strings

Connecting | , xrefs: 00C841C0
Connection Error: , xrefs: 00C8425A
| , xrefs: 00C841CA, 00C84310
Disconnected, xrefs: 00C84AF8
hlight, xrefs: 00C84447
5.3.0 Pro, xrefs: 00C8457C
TLS On , xrefs: 00C841A1
TLS Off, xrefs: 00C84193, 00C841A6
Connection Error: Unable to create socket, xrefs: 00C842A4
C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C84474
Connected | , xrefs: 00C8430B
%I64u, xrefs: 00C843AD
name, xrefs: 00C8441A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Sleep$ErrorLastLocalTime
String ID: | $%I64u$5.3.0 Pro$C:\Users\user\Desktop\SHROsQyiAd.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$TLS Off$TLS On $hlight$name
API String ID: 524882891-3736032578
Opcode ID: 7c119fdf251e611ca00355e7855cfc916629c232bc6760d75e70c640b778902c
Instruction ID: 3f11a79d875a9249b358635f477331c8c84f7b234c0579e22302ca94689b987b
Opcode Fuzzy Hash: 7c119fdf251e611ca00355e7855cfc916629c232bc6760d75e70c640b778902c
Instruction Fuzzy Hash: 8852B032A001145BDB19F774DDA6AEE73799FA0700F1480ADF80EA7192EF305F89EA55

Function 00C7428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(?,?,?), ref: 00C742A5
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,00C7192B), ref: 00C743CB
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,00C7192B), ref: 00C743D5
WSAGetLastError.WS2_32(?,?,?,00C7192B), ref: 00C743E7

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

Strings

TLS Error 1, xrefs: 00C742FC
Connection Failed: , xrefs: 00C7440C
Connection Refused, xrefs: 00C7443E
TLS Handshake... | , xrefs: 00C742C9
TLS Error 3, xrefs: 00C7439D
TLS Error 2, xrefs: 00C7431A
TLS Authentication Failed, xrefs: 00C7435E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-2151626615
Opcode ID: 0df28570756f5d2f3d3594519b72959e423aa3e1e7e16915eaba29d72f941aa1
Instruction ID: bea87b25dbeb33e229b9c51d59a6c687cfc619c0961289b6aa32169c2478ff55
Opcode Fuzzy Hash: 0df28570756f5d2f3d3594519b72959e423aa3e1e7e16915eaba29d72f941aa1
Instruction Fuzzy Hash: 2D416C61F00601BBDB0CB7BD8D4B93D7A69AB41320B44811AF91947793EF51AE20E7E3

Function 00C7A3F4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 00C7A456
Sleep.KERNELBASE(000001F4), ref: 00C7A461
GetForegroundWindow.USER32 ref: 00C7A467
GetWindowTextLengthW.USER32(00000000), ref: 00C7A470
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 00C7A4A4
Sleep.KERNEL32(000003E8), ref: 00C7A574

Part of subcall function 00C79D58: SetEvent.KERNEL32(?,?,00000000,00C7A91C,00000000), ref: 00C79D84

Strings

[, xrefs: 00C7A50E
], xrefs: 00C7A508
minutes }, xrefs: 00C7A59F
{ User has been idle for , xrefs: 00C7A5AB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: 23bcba198cffa4712b46400de6aa84a91fd9ab81498308c9d794641c9c3580b3
Instruction ID: 39516bbfdc970acfabc32ca0e605bb263e22a6bbc0b0e0913c105f8e70a4ec49
Opcode Fuzzy Hash: 23bcba198cffa4712b46400de6aa84a91fd9ab81498308c9d794641c9c3580b3
Instruction Fuzzy Hash: 9A5110726086805BC724FB34CC5AB6EB794AFC4314F44892EF84A862D2DF709E44E793

Function 00C7C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 00C7CA04

Strings

ProgramFiles, xrefs: 00C7C9D8
\SysWOW64, xrefs: 00C7C96A
WinDir, xrefs: 00C7C905, 00C7C927, 00C7C979
AppData, xrefs: 00C7C9BB
\system32, xrefs: 00C7C918
SystemDrive, xrefs: 00C7C8FB
UserProfile, xrefs: 00C7C9C2
Temp, xrefs: 00C7C8D0
ProgramData, xrefs: 00C7C9C9

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: 9b4e8215a3d4674bcb61481f1c4782c6bf946ba461720cd1f37d41becb3e8d48
Instruction ID: 693d138afb294cf17cce3a20fae97a783f9b97ae9348c511bcd5cc62efcad285
Opcode Fuzzy Hash: 9b4e8215a3d4674bcb61481f1c4782c6bf946ba461720cd1f37d41becb3e8d48
Instruction Fuzzy Hash: 184186321042019BC314FB25DC97CAFB7A8AF50764F14853EF95E921E2EF609A49F653

Function 00C8A51B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C8A53E
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 00C8A554
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 00C8A56D
InternetCloseHandle.WININET(00000000), ref: 00C8A5B3
InternetCloseHandle.WININET(00000000), ref: 00C8A5B6

Strings

http://geoplugin.net/json.gp, xrefs: 00C8A54E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 9d5e6feffc20ac6c4b5f255e1c2ca4d04c3540e731003bf42cb336df2c72f0d9
Instruction ID: 3baa3473f390cd182aa108ed596734a36c58fc383c46b1cbac49f9e9ce1ae1b6
Opcode Fuzzy Hash: 9d5e6feffc20ac6c4b5f255e1c2ca4d04c3540e731003bf42cb336df2c72f0d9
Instruction Fuzzy Hash: 5B1191312092126BD228EA65DC59EAF7FECEF86765F00053DF90992181DB649D48CAB2

Function 00C8A463 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C8B15B: GetCurrentProcess.KERNEL32(?,?,?,00C7C914,WinDir,00000000,00000000), ref: 00C8B16C

Part of subcall function 00C82513: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00C82537
Part of subcall function 00C82513: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00C82554
Part of subcall function 00C82513: RegCloseKey.KERNELBASE(?), ref: 00C8255F

StrToIntA.SHLWAPI(00000000,00CDBC48,?,00000000,00000000,00CE4358,00000003,Exe,00000000,0000000E,00000000,00CD556C,00000003,00000000), ref: 00C8A4D9

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00C8A477, 00C8A481, 00C8A4BF
(32 bit), xrefs: 00C8A501
(64 bit), xrefs: 00C8A506, 00C8A510
CurrentBuildNumber, xrefs: 00C8A4BA
ProductName, xrefs: 00C8A472

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 1866151309-2070987746
Opcode ID: 3fb6c931e57c1dc2e160d72f1c77fb190a7091271dee5f3f15970d3f19787a3d
Instruction ID: e771f7c7cd329b77c359d060a2f58726a62f0ab993bbdaaf589c5f5f3b6017e3
Opcode Fuzzy Hash: 3fb6c931e57c1dc2e160d72f1c77fb190a7091271dee5f3f15970d3f19787a3d
Instruction Fuzzy Hash: 65116FA0A001415BDB05B3A8DC5FE7F765DABD0300F444439F916973D2EF609E46A3A1

Function 00C79E48 Relevance: 9.2, APIs: 6, Instructions: 163
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00C79E62

Part of subcall function 00C79D97: CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00C79E6F), ref: 00C79DCD
Part of subcall function 00C79D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00C79E6F), ref: 00C79DDC
Part of subcall function 00C79D97: Sleep.KERNEL32(00002710,?,?,?,00C79E6F), ref: 00C79E09
Part of subcall function 00C79D97: CloseHandle.KERNELBASE(00000000,?,?,?,00C79E6F), ref: 00C79E10

CreateDirectoryW.KERNELBASE(00000000,00000000), ref: 00C79E9E
GetFileAttributesW.KERNELBASE(00000000), ref: 00C79EAF
SetFileAttributesW.KERNELBASE(00000000,00000080), ref: 00C79EC6
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 00C79F40

Part of subcall function 00C8B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00CD5900,?,00000000,00000000,00000000,00000000,00000000), ref: 00C7A049

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID:
API String ID: 3795512280-0
Opcode ID: a091cece9f9d8556fa4d7a592cc43c281f72884ff18e1d14c0897e503b5c5b90
Instruction ID: 642291e83c15a2091e51ddd4298706405df468efc13eb7c7bb87206961ec2449
Opcode Fuzzy Hash: a091cece9f9d8556fa4d7a592cc43c281f72884ff18e1d14c0897e503b5c5b90
Instruction Fuzzy Hash: 4B51D4716043405BCB18FB78C86AABF7799AFD1700F08852CFD9A971D2DF259E08A652

Function 00C798A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,00C799A9,?,00000000,00000000), ref: 00C7992A
CreateThread.KERNEL32(00000000,00000000,00C79993,?,00000000,00000000), ref: 00C7993A
CreateThread.KERNEL32(00000000,00000000,00C799B5,?,00000000,00000000), ref: 00C79946

Part of subcall function 00C7A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 00C7A884
Part of subcall function 00C7A876: wsprintfW.USER32 ref: 00C7A905

Strings

Offline Keylogger Started, xrefs: 00C798C7, 00C798CE, 00C798FB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 533524b1a947aefe7642d41eea873161e69c63c313a15ac615da86a2506f05fe
Instruction ID: e7247ee264cd00be0065073db6bf51843683929dc6c89469105f0f17037f9899
Opcode Fuzzy Hash: 533524b1a947aefe7642d41eea873161e69c63c313a15ac615da86a2506f05fe
Instruction Fuzzy Hash: AA11CAB15002087EE624BA79CC87CBF7A6CDA813A4B44452DFD4D02182EA605E14D6F3

Function 00C74915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(00000001,00CE3EE8,00CE45A8,00000000,?,?,?,?,?,00C84D8A,?,00000001), ref: 00C74946
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00CE3EE8,00CE45A8,00000000,?,?,?,?,?,00C84D8A,?,00000001), ref: 00C74994
CreateThread.KERNEL32(00000000,00000000,00C74B1D,?,00000000,00000000), ref: 00C749A7

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00C7495C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: fcde041fa15d1873a815995bfbff31b2d21523fcbfb9a8643cc97e8f338d1f7e
Instruction ID: 9b7b4c4d343549c442ee29f96cea087e82d2fcb07678a184e59d59fbd7a74613
Opcode Fuzzy Hash: fcde041fa15d1873a815995bfbff31b2d21523fcbfb9a8643cc97e8f338d1f7e
Instruction Fuzzy Hash: 941106319042647BCB15B77A8C49FDF7FAC9F16364F04801AF51942141C7749444CBF2

Function 00C826D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 00C826E1
RegSetValueExA.KERNELBASE(?,00CD6748,00000000,?,00000000,00000000,00CE42F8,?,?,00C7E5FB,00CD6748,5.3.0 Pro), ref: 00C82709
RegCloseKey.KERNELBASE(?,?,?,00C7E5FB,00CD6748,5.3.0 Pro), ref: 00C82714

Strings

pth_unenc, xrefs: 00C826D6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: 9ce92f0e5d53af3ab1d9ffa71dd48e0640ffd30fc47ec475e0409e95e8dd34af
Instruction ID: bc3677c979219fcbaa55ef8cd9ec8fd005d1eaedd2a93557f4b6f5eab5e01bf3
Opcode Fuzzy Hash: 9ce92f0e5d53af3ab1d9ffa71dd48e0640ffd30fc47ec475e0409e95e8dd34af
Instruction Fuzzy Hash: 68F03A72540118FBDB01AFA1DC59FEE376CEF14790F108219FD16A6161EB319E04EB60

Function 00C74688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00C74778
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00C7478C
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00C74797
CloseHandle.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 00C747A0

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 16e2bbf31bada6de7799290fa26876171aed1b89f8c949698d6315c0b765c47f
Instruction ID: c1cb9c8e5913fad0b2cc93aa276d7c280f6da32349c5bd66f215d55c4fcbe3d9
Opcode Fuzzy Hash: 16e2bbf31bada6de7799290fa26876171aed1b89f8c949698d6315c0b765c47f
Instruction Fuzzy Hash: 84418271608340ABC714FB64CC55E7FB7EDEF95710F048A1DF89A92191DB20DA08EB62

Function 00C8B58F Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00CD5900,00000000,00000000,00C7C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 00C8B5CE
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 00C8B5EB
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00C8B5FF
CloseHandle.KERNELBASE(00000000), ref: 00C8B60C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 197e135489d09e46cdb9c51c53480e7ba6f7a824cc8779d54cd48a7acc184ff6
Instruction ID: 80ffd0ce6f630dfff9d381a976cf245e36db904025efc47579b6e29d9107ca8f
Opcode Fuzzy Hash: 197e135489d09e46cdb9c51c53480e7ba6f7a824cc8779d54cd48a7acc184ff6
Instruction Fuzzy Hash: 3801D2B12086157FE6146E29DC89F7B739CEB42368F180729F571D21D0D7319E068B38

Function 00C79D97 Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00C79E6F), ref: 00C79DCD
GetFileSize.KERNEL32(00000000,00000000,?,?,?,00C79E6F), ref: 00C79DDC
Sleep.KERNEL32(00002710,?,?,?,00C79E6F), ref: 00C79E09
CloseHandle.KERNELBASE(00000000,?,?,?,00C79E6F), ref: 00C79E10

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID:
API String ID: 1958988193-0
Opcode ID: af5e35119c30276a2a80c0b70aefcf31094f2ca48f70867c971484c429742403
Instruction ID: 7bcb65e592366840571d3c1b12d4b319eebc110747e4a404b66b0eade70b027f
Opcode Fuzzy Hash: af5e35119c30276a2a80c0b70aefcf31094f2ca48f70867c971484c429742403
Instruction Fuzzy Hash: 2E115531640680AEEB34E728D8CDB2E7BAAEB92311F04850CF29A475A2D6306D919365

Function 00C74468 Relevance: 4.6, APIs: 3, Instructions: 92synchronizationnetworkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD
WaitForSingleObject.KERNEL32(?,00000000,00C84CE9,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000), ref: 00C7450E
SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000,?,?,?,?,?,00C84CE9), ref: 00C7453C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitsend
String ID:
API String ID: 3963590051-0
Opcode ID: 7dd39a439565d8761961796f58a239d9fa382c56c88908cebd6999f565fa6748
Instruction ID: dba69ab820c20dc419626f7e1e0946dcd1ba625643f33fccf977ae2f99827bf7
Opcode Fuzzy Hash: 7dd39a439565d8761961796f58a239d9fa382c56c88908cebd6999f565fa6748
Instruction Fuzzy Hash: DB213472900519ABDF05FBA4DC86DEE777CFF54354B048115F91AA2191EF34A908E6A0

Function 00C82513 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00C82537
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00C82554
RegCloseKey.KERNELBASE(?), ref: 00C8255F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 935a9b53fbaaf84c4e837db6e149fd516150756b6fc2ad6c03fb7ee9c4dbc605
Instruction ID: 5e04f03782be8cd2ed71ab1d7ab47370891536477e36fc22834597498088bd4f
Opcode Fuzzy Hash: 935a9b53fbaaf84c4e837db6e149fd516150756b6fc2ad6c03fb7ee9c4dbc605
Instruction Fuzzy Hash: 61F08C76A40128BBCB21ABA5DC48EEF7FBDEB44754F004165FA46E2100EB309F05DBA4

Function 00C8265D Relevance: 4.5, APIs: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00CE42F8), ref: 00C82679
RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000208,?), ref: 00C82692
RegCloseKey.KERNELBASE(00000000), ref: 00C8269D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: bc7cb64cb2adbff22a98ccc5cdbf6594dbbd38153eace35e175d97a730790495
Instruction ID: 942d030ae4af0ad49553ab06988b1e864921ad1ae6f676176b889c2ab25e71b7
Opcode Fuzzy Hash: bc7cb64cb2adbff22a98ccc5cdbf6594dbbd38153eace35e175d97a730790495
Instruction Fuzzy Hash: 48011436805129BBDF21AFA1DC49EEF7F39EF05354F008150FA1962160E7718AA5EBA4

Function 00C824B7 Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,?), ref: 00C824D7
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,00000000,?,00CE42F8), ref: 00C824F5
RegCloseKey.KERNELBASE(?), ref: 00C82500

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: d9514d225f29bc076fa5791b4a36694d225d75e6032267d2a8865b8662051cef
Instruction ID: 2d7305b55c13ba6e7db37e1611922c7fe9a198fbcbdcb501246d63564eaf03ea
Opcode Fuzzy Hash: d9514d225f29bc076fa5791b4a36694d225d75e6032267d2a8865b8662051cef
Instruction Fuzzy Hash: 4DF03A76940208BFDF11AFA0DC05FDEBBB8EB04748F1041A1FA05E6190D6709B14AF94

Function 00C8246E Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,?,00000000,?,?,00C7B996,00CD60E0), ref: 00C82485
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,00000000,00000000,?,?,00C7B996,00CD60E0), ref: 00C82499
RegCloseKey.KERNELBASE(?,?,?,00C7B996,00CD60E0), ref: 00C824A4

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 9b540aff5a7e0cfde7b5c954ee8d42faf76e7b8a03f8e4914295e905b0b7db65
Instruction ID: 3a68f38b948307d783b91e0553e5cc58f5421c886ca464e8976751b63053b988
Opcode Fuzzy Hash: 9b540aff5a7e0cfde7b5c954ee8d42faf76e7b8a03f8e4914295e905b0b7db65
Instruction Fuzzy Hash: AEE03931805124BA9B215BA2DC0DFDF7F6CEF567A4B004140FC09A2211D2218E40EBF4

Function 00C827D5 Relevance: 4.5, APIs: 3, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,00CD5554), ref: 00C827E3
RegSetValueExA.KERNELBASE(00CD5554,000000AF,00000000,00000004,00000001,00000004,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C827FE
RegCloseKey.ADVAPI32(00CD5554,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C82809

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: b4c70dbf56898de6eada8083d82187f0babf813ad53e833b2315fe772fdc6c1a
Instruction ID: 73d45eec7486a8120e6bf264aca25b81e78d046bdc0ead5448683d1321666a5f
Opcode Fuzzy Hash: b4c70dbf56898de6eada8083d82187f0babf813ad53e833b2315fe772fdc6c1a
Instruction Fuzzy Hash: 85E06D72600208BBEF119FA1DC0AFDE3BA8EB04B98F004150FB15E6190D271CE14EBA4

Function 00C8A945 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?), ref: 00C8A959

Strings

@, xrefs: 00C8A94F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 92d14effb3ce719d5df97bdb11c8a8af3c91c6b051a905659db2e2b19c33786a
Instruction ID: 2b145e9432105fdc5e59e5351cb7434ca7bdef59bfc379ce4fb8fcd78228a0c1
Opcode Fuzzy Hash: 92d14effb3ce719d5df97bdb11c8a8af3c91c6b051a905659db2e2b19c33786a
Instruction Fuzzy Hash: E8D067B99013189FCB20DFA8E945A8DBBF8FB48214F004569E946E3344E774E9058B94

Function 00C84B9B Relevance: 3.2, APIs: 2, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00C84BC0
GetTickCount.KERNEL32 ref: 00C84C3C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID:
API String ID: 180926312-0
Opcode ID: f263359c04baa644565313b207577263d7c8b911e2623af56b186e440eecd2f6
Instruction ID: 4e03d39bbe78aace4d313bcc65f1f9da05080620381d1007f8eba0c1587ec5e8
Opcode Fuzzy Hash: f263359c04baa644565313b207577263d7c8b911e2623af56b186e440eecd2f6
Instruction Fuzzy Hash: 5E51B3315042409BD328F774D8A6AFF73A96F91710F44892EF94E47192EF309E09E756

Function 00C741F1 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 00C74212

Part of subcall function 00C74262: WSAStartup.WS2_32(00000202,00000000), ref: 00C74277

CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00C74252

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CreateEventStartupsocket
String ID:
API String ID: 1953588214-0
Opcode ID: 51be26dd85bc39b111d125ea36dfedcc839e201112e2ebffe5960ee10db64533
Instruction ID: a996adcbb368dd9ae210d1386e053744b778787ab3ef467c8cf0a42fbabf14e1
Opcode Fuzzy Hash: 51be26dd85bc39b111d125ea36dfedcc839e201112e2ebffe5960ee10db64533
Instruction Fuzzy Hash: 9E015E714087809FD7398F38B84579A7FE0AB19314F048A5DF1DA87BA2C3B1A440DF10

Function 00C8AC52 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C8AC74
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C8AC87

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 5ef20d1d39ccc4c0d20e59db75d8bdf7f92f404eb3f7c1656075e96cac6aceae
Instruction ID: f4b8bf18aa7a2adbeff79eb93fd0100f6012e717b8294dd175bac7e7b37b3b16
Opcode Fuzzy Hash: 5ef20d1d39ccc4c0d20e59db75d8bdf7f92f404eb3f7c1656075e96cac6aceae
Instruction Fuzzy Hash: 96E08075A0031467FB20A764DC4EFDE776CD704704F040195F529D21C2E9B0DA44DBE5

Function 00C83F9A Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,00000000,00CE1B28,00CE4358,00000000,00C84240,00000000,00000001), ref: 00C83FBC
WSASetLastError.WS2_32(00000000), ref: 00C83FC1

Part of subcall function 00C83E37: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00C83E86
Part of subcall function 00C83E37: LoadLibraryA.KERNEL32(?), ref: 00C83EC8
Part of subcall function 00C83E37: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00C83EE8
Part of subcall function 00C83E37: FreeLibrary.KERNEL32(00000000), ref: 00C83EEF
Part of subcall function 00C83E37: LoadLibraryA.KERNEL32(?), ref: 00C83F27
Part of subcall function 00C83E37: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00C83F39
Part of subcall function 00C83E37: FreeLibrary.KERNEL32(00000000), ref: 00C83F40
Part of subcall function 00C83E37: GetProcAddress.KERNEL32(00000000,?), ref: 00C83F4F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
String ID:
API String ID: 1170566393-0
Opcode ID: 1ff209a406c23c14df6a5f8e1b4d2bb3729282957db1ad7643acd3e23663dc9c
Instruction ID: 6d2948127f06784d63f51ee80bd1076db53d8fff5452e29ad5cdc875045f621a
Opcode Fuzzy Hash: 1ff209a406c23c14df6a5f8e1b4d2bb3729282957db1ad7643acd3e23663dc9c
Instruction Fuzzy Hash: 8FD02B322000A12FA310735D9C40FBEB5DCCFA5B387050023F400D7150D6904D42C7A4

Function 00C7BED7 Relevance: 3.0, APIs: 2, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,00C7D9AA,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,00CD556C,00000003,00000000), ref: 00C7BEE6
GetLastError.KERNEL32 ref: 00C7BEF1

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 0acd17a0667a7227804d286cefdd64241e1781ff3e07b79208edbaf74ba28ae9
Instruction ID: 3c950800c824438ee059afc89640ca4181f957095c96f40cab5bd61d74e27f0d
Opcode Fuzzy Hash: 0acd17a0667a7227804d286cefdd64241e1781ff3e07b79208edbaf74ba28ae9
Instruction Fuzzy Hash: 94D012B0608201DBDB081774AC8EB2D3555E784702F040229F907C55D0CB6488505911

Function 00C79517 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C79531

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: e1491f8c5662bf51a92df618e6a5cc151834577157611f92b1b83a7da00b338d
Instruction ID: beaf8b739f6134235589f29f9146e8dd6d54bbdbd76120e86c21aa45b57240be
Opcode Fuzzy Hash: e1491f8c5662bf51a92df618e6a5cc151834577157611f92b1b83a7da00b338d
Instruction Fuzzy Hash: 22119A329002459FCB05EF68D8969EF7BB4EF25310B10842EFC56572D2EF30A955EB51

Function 00C79A97 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00CE40F8,?,?,?), ref: 00C79B02

Part of subcall function 00C7AD56: GetKeyState.USER32(00000011), ref: 00C7AD5B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CallHookNextState
String ID:
API String ID: 3280314413-0
Opcode ID: 534070d158f96ce642393120ed06b14f635033d1547f3ebbd02106f0675255e8
Instruction ID: eeb2171de42a4a3ebf9aae78df7383215e0c27a0206e3e903bf7cccc12d33a54
Opcode Fuzzy Hash: 534070d158f96ce642393120ed06b14f635033d1547f3ebbd02106f0675255e8
Instruction Fuzzy Hash: 33F0F4322052854BCB14AEBC9CD5D2F775AEBD5325F04C02DF50B46A62CAB5C818F722

Function 00C74262 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,00000000), ref: 00C74277

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 65d301aacf19d5b66d9103a6e390e0509e05ce4ef146f21550ed4d4726256b01
Instruction ID: e84493ec40608cb8c9e4454f1609d1b661a1027bafaace6d0ea9cd63fa865a0d
Opcode Fuzzy Hash: 65d301aacf19d5b66d9103a6e390e0509e05ce4ef146f21550ed4d4726256b01
Instruction Fuzzy Hash: 33D012325596484ED610ABB4AC0FEB87B5CD317611F0403BAACB5866D2E650662CC6B7

Function 00CB6AFF Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 562ee12cae557b3c405398a893e165f2fe6ddc3d3cc209720635d45c1fc8f51f
Instruction ID: aaeb119b45eddb4dd4292321c99653c6fcc8afd53b50593612b9031e233f434d
Opcode Fuzzy Hash: 562ee12cae557b3c405398a893e165f2fe6ddc3d3cc209720635d45c1fc8f51f
Instruction Fuzzy Hash: 4FE09B3160516557E6212B66DC01FEF7BA89F417B0F150120EC25D71D1DB68CD00B1E1

Non-executed Functions

Function 00C76F06 Relevance: 34.1, APIs: 10, Strings: 9, Instructions: 849filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00C76F28
GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00C76FF8
DeleteFileW.KERNEL32(00000000), ref: 00C77018

Part of subcall function 00C8B42F: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B489
Part of subcall function 00C8B42F: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B4BB
Part of subcall function 00C8B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B50C
Part of subcall function 00C8B42F: FindClose.KERNEL32(00000000,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B561
Part of subcall function 00C8B42F: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B568

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Part of subcall function 00C76BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00CD5454,?,?,00000000,00C77273,00000000,?,0000000A,00000000), ref: 00C76C38
Part of subcall function 00C76BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00C77273,00000000,?,0000000A,00000000), ref: 00C76C80
Part of subcall function 00C76BE9: CloseHandle.KERNEL32(00000000,?,?,00000000,00C77273,00000000,?,0000000A,00000000,00000000), ref: 00C76CC0
Part of subcall function 00C76BE9: MoveFileW.KERNEL32(00000000,00000000), ref: 00C76CDD

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

Part of subcall function 00C74468: WaitForSingleObject.KERNEL32(?,00000000,00C84CE9,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000), ref: 00C7450E
Part of subcall function 00C74468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000,?,?,?,?,?,00C84CE9), ref: 00C7453C

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00C77416
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00C774F5
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 00C7773A
DeleteFileA.KERNEL32(?), ref: 00C778CC

Part of subcall function 00C77A8C: __EH_prolog.LIBCMT ref: 00C77A91
Part of subcall function 00C77A8C: FindFirstFileW.KERNEL32(00000000,?,00CD5AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C77B4A
Part of subcall function 00C77A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C77B6E

Sleep.KERNEL32(000007D0), ref: 00C77976
StrToIntA.SHLWAPI(00000000,00000000), ref: 00C779BA

Part of subcall function 00C8BB77: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 00C8BC6C

Strings

Executing file: , xrefs: 00C7742F
open, xrefs: 00C77410
Unable to rename file!, xrefs: 00C7768F
Unable to delete: , xrefs: 00C77078
Deleted file: , xrefs: 00C7703A
Downloaded file: , xrefs: 00C772A8
Failed to download file: , xrefs: 00C77321
Browsing directory: , xrefs: 00C774B6
Downloading file: , xrefs: 00C771F3

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
String ID: Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$open
API String ID: 2918587301-1507758755
Opcode ID: e94ae932d5f9c019f84991aa2deb4cb68ba06a3f691a18622de4c57e0e9f10ed
Instruction ID: e657ab2c61e1395f27579a86bf36ab45f7983d51b841c7968a0bb8397dc01f80
Opcode Fuzzy Hash: e94ae932d5f9c019f84991aa2deb4cb68ba06a3f691a18622de4c57e0e9f10ed
Instruction Fuzzy Hash: ED42B6726083405BD618F778C86BAAE77A99F90710F448A1DFD4E571D2EF209B08E793

Function 00C75042 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 280pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C7508E

Part of subcall function 00CA34CF: EnterCriticalSection.KERNEL32(00CE0D18,00CE5D2C,?,00C7AEAC,00CE5D2C,00CC6D97,?,00000000,00000000), ref: 00CA34D9
Part of subcall function 00CA34CF: LeaveCriticalSection.KERNEL32(00CE0D18,?,00C7AEAC,00CE5D2C,00CC6D97,?,00000000,00000000), ref: 00CA350C

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

__Init_thread_footer.LIBCMT ref: 00C750CB
CreatePipe.KERNEL32(00CE5CEC,00CE5CD4,00CE5BF8,00000000,00CD556C,00000000), ref: 00C7515E
CreatePipe.KERNEL32(00CE5CD8,00CE5CF4,00CE5BF8,00000000), ref: 00C75174
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00CE5C08,00CE5CDC), ref: 00C751E7

Part of subcall function 00CA3519: EnterCriticalSection.KERNEL32(00CE0D18,?,00CE5D2C,?,00C7AE8B,00CE5D2C,?,00000000,00000000), ref: 00CA3524
Part of subcall function 00CA3519: LeaveCriticalSection.KERNEL32(00CE0D18,?,00C7AE8B,00CE5D2C,?,00000000,00000000), ref: 00CA3561

Sleep.KERNEL32(0000012C,00000093,?), ref: 00C7523F
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00C75264
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00C75291

Part of subcall function 00CA38A5: __onexit.LIBCMT ref: 00CA38AB

WriteFile.KERNEL32(00000000,00000000,?,00000000,00CE3F98,00CD5570,00000062,00CD5554), ref: 00C7538E
Sleep.KERNEL32(00000064,00000062,00CD5554), ref: 00C753A8
TerminateProcess.KERNEL32(00000000), ref: 00C753C1
CloseHandle.KERNEL32 ref: 00C753CD
CloseHandle.KERNEL32 ref: 00C753D5
CloseHandle.KERNEL32 ref: 00C753E7
CloseHandle.KERNEL32 ref: 00C753EF

Strings

SystemDrive, xrefs: 00C75109
cmd.exe, xrefs: 00C750F5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: SystemDrive$cmd.exe
API String ID: 3815868655-3633465311
Opcode ID: 67649a23e5180382a0630e7b23715b39d6daaf2ff2daed13ff8f407cc7a2e78c
Instruction ID: d735c3d08e854cdddb5b890ad4fbf8f8f9df2ed8798205f446085e49fba8e15a
Opcode Fuzzy Hash: 67649a23e5180382a0630e7b23715b39d6daaf2ff2daed13ff8f407cc7a2e78c
Instruction Fuzzy Hash: 11914BB0600785AFC704BF75ECA6F2E3BA9EB84348F50402DF9199B1A2DF719D049B61

Function 00C80F36 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00C80F45

Part of subcall function 00C827D5: RegCreateKeyA.ADVAPI32(80000001,00000000,00CD5554), ref: 00C827E3
Part of subcall function 00C827D5: RegSetValueExA.KERNELBASE(00CD5554,000000AF,00000000,00000004,00000001,00000004,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C827FE
Part of subcall function 00C827D5: RegCloseKey.ADVAPI32(00CD5554,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C82809

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00C80F81
CreateThread.KERNEL32(00000000,00000000,00C81637,00000000,00000000,00000000), ref: 00C80FE6

Part of subcall function 00C824B7: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,?), ref: 00C824D7
Part of subcall function 00C824B7: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,00000000,?,00CE42F8), ref: 00C824F5
Part of subcall function 00C824B7: RegCloseKey.KERNELBASE(?), ref: 00C82500

CloseHandle.KERNEL32(00000000), ref: 00C80F90

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00C8125A

Strings

Watchdog module activated, xrefs: 00C80FBF, 00C81210
rmclient.exe, xrefs: 00C81125
fsutil.exe, xrefs: 00C8114A
\system32\, xrefs: 00C81044
WinDir, xrefs: 00C81056, 00C810AB
Watchdog launch failed!, xrefs: 00C811BE
Remcos restarted by watchdog!, xrefs: 00C80F9B
\SysWOW64\, xrefs: 00C8109C
svchost.exe, xrefs: 00C81100
WDH, xrefs: 00C80FF0, 00C80FF6, 00C81260

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 65172268-13974260
Opcode ID: 5391162e8bab8372437ab25f1d3506cf481985f23c66fb899c28007468f340ef
Instruction ID: 839dcbed3f0b00a26262535ff36684a842ed44898e9f8ed0e9b2f6eaaa3c5948
Opcode Fuzzy Hash: 5391162e8bab8372437ab25f1d3506cf481985f23c66fb899c28007468f340ef
Instruction Fuzzy Hash: 5A71E53160424097C618FB75CC5BDAF73E8AF91724F44452DFC5A521D2EF209A09E7A7

Function 00C7B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 00C7B3B4
FindClose.KERNEL32(00000000), ref: 00C7B3CE
FindNextFileA.KERNEL32(00000000,?), ref: 00C7B4F1
FindClose.KERNEL32(00000000), ref: 00C7B517

Strings

\key3.db, xrefs: 00C7B47B
[Firefox StoredLogins not found], xrefs: 00C7B3D9
[Firefox StoredLogins Cleared!], xrefs: 00C7B504
UserProfile, xrefs: 00C7B365
\logins.json, xrefs: 00C7B439
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00C7B357

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: 0daf829e07310595bb58092054a465a6f63689a46fc6e842f0241f49876e7b63
Instruction ID: 26011230e2c17d38f188083a7e6ac85da3bb68b13ef23fa2a02a419a2ba7ae91
Opcode Fuzzy Hash: 0daf829e07310595bb58092054a465a6f63689a46fc6e842f0241f49876e7b63
Instruction Fuzzy Hash: 6F5170319041099BDB14FBF8DC5AEED7738AF20710F44816AFD0A661D2EF306A49DA90

Function 00C7B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 00C7B5B2
FindClose.KERNEL32(00000000), ref: 00C7B5CC
FindNextFileA.KERNEL32(00000000,?), ref: 00C7B68C
FindClose.KERNEL32(00000000), ref: 00C7B6B2
FindClose.KERNEL32(00000000), ref: 00C7B6D1

Strings

[Firefox cookies found, cleared!], xrefs: 00C7B6E0
UserProfile, xrefs: 00C7B563
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 00C7B555
[Firefox Cookies not found], xrefs: 00C7B5D7, 00C7B69F
\cookies.sqlite, xrefs: 00C7B62F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: 30e59e0464c1f03abbc36d4e5a277ec96160e1735177010ac5f0cef922de4a9a
Instruction ID: 3dcf81c49848a46f816f8c093435b10ddb7fcebafa06ee4108540867973e8ce3
Opcode Fuzzy Hash: 30e59e0464c1f03abbc36d4e5a277ec96160e1735177010ac5f0cef922de4a9a
Instruction Fuzzy Hash: DA41AF319042099BDB14F7B8DC5BEEE7778AF21710F44812AF90AA71D2EF305E49DA90

Function 00C859C6 Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C859C7
EmptyClipboard.USER32 ref: 00C859D5
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 00C859F5
GlobalLock.KERNEL32(00000000), ref: 00C859FE
GlobalUnlock.KERNEL32(00000000), ref: 00C85A34
SetClipboardData.USER32(0000000D,00000000), ref: 00C85A3D
CloseClipboard.USER32 ref: 00C85A5A
OpenClipboard.USER32 ref: 00C85A61
GetClipboardData.USER32(0000000D), ref: 00C85A71
GlobalLock.KERNEL32(00000000), ref: 00C85A7A
GlobalUnlock.KERNEL32(00000000), ref: 00C85A83
CloseClipboard.USER32 ref: 00C85A89

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID:
API String ID: 3520204547-0
Opcode ID: a5ec2ec0da636360bb97b8a4b24b60a84ea618c665f01f55b21c5352f9918ce3
Instruction ID: 922f9676845aa17dba755a0750f0d4b6f26cde5a58480bc50d37ee47a537f76a
Opcode Fuzzy Hash: a5ec2ec0da636360bb97b8a4b24b60a84ea618c665f01f55b21c5352f9918ce3
Instruction Fuzzy Hash: 7E2177722042409FD714BBB5DC5EFBE7769EF90711F08461DFC0A86162EF308945AB62

Function 00C7E219 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 212processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,00CE4358), ref: 00C7E233
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00CE4358), ref: 00C7E25E
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00C7E27A
Process32NextW.KERNEL32(00000000,0000022C), ref: 00C7E2FD
CloseHandle.KERNEL32(00000000,?,?,00CE4358), ref: 00C7E30C

Part of subcall function 00C827D5: RegCreateKeyA.ADVAPI32(80000001,00000000,00CD5554), ref: 00C827E3
Part of subcall function 00C827D5: RegSetValueExA.KERNELBASE(00CD5554,000000AF,00000000,00000004,00000001,00000004,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C827FE
Part of subcall function 00C827D5: RegCloseKey.ADVAPI32(00CD5554,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C82809

CloseHandle.KERNEL32(00000000,?,?,00CE4358), ref: 00C7E371

Strings

ieinstal.exe, xrefs: 00C7E3D6
Inj, xrefs: 00C7E515
C:\Program Files(x86)\Internet Explorer\, xrefs: 00C7E3BF
ielowutil.exe, xrefs: 00C7E417

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 726551946-1743721670
Opcode ID: 648a5688a2744c699c4ff6a816fb350bd8e44818babbd7bde4c8ac6969e3c5a5
Instruction ID: d40b91339808c099e5318c430a148a072464eba29b5101002c92f0667999a75e
Opcode Fuzzy Hash: 648a5688a2744c699c4ff6a816fb350bd8e44818babbd7bde4c8ac6969e3c5a5
Instruction Fuzzy Hash: A27193311083418BC724FB64D895EEE73A5BF95354F44892DFD9A431A2EF309A0DEB52

Function 00C88754 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON

Download Yara Rule

Strings

0, xrefs: 00C8877D
4, xrefs: 00C888DA
6, xrefs: 00C88935
1, xrefs: 00C887B6
7, xrefs: 00C8894C
2, xrefs: 00C88816
3, xrefs: 00C88876
5, xrefs: 00C8892B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: 4c7e308fc0597525c00a84433b2d15d991e3061214a40813edefd1599937d2e8
Instruction ID: b27993fad5dec0e55d022f8ca69d1a2257486ff18e6bb11aa3515e5f0a69d90b
Opcode Fuzzy Hash: 4c7e308fc0597525c00a84433b2d15d991e3061214a40813edefd1599937d2e8
Instruction Fuzzy Hash: BB618D30508341AFDB08EF20D892FAA77E5AF95750F848889F995576E2DF309E08E753

Function 00C76764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C76788
CoGetObject.OLE32(?,00000024,00CD59B0,00000000), ref: 00C767E9

Strings

$, xrefs: 00C767A2
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00C7677D, 00C76782, 00C767C1
[+] CoGetObject, xrefs: 00C767C8
[+] CoGetObject SUCCESS, xrefs: 00C767F8
[+] ucmAllocateElevatedObject, xrefs: 00C7676F
[-] CoGetObject FAILURE, xrefs: 00C767F1, 00C76800
Elevation:Administrator!new:, xrefs: 00C767A9

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: a21ce0bade6045c6abac3587e18ab34f992fa13d2bdc9d066dc9d07781b266cb
Instruction ID: f35eee87163fc5967f588eedfb5ae5fd1c02eb9f5e702cc646a1fbee63918145
Opcode Fuzzy Hash: a21ce0bade6045c6abac3587e18ab34f992fa13d2bdc9d066dc9d07781b266cb
Instruction Fuzzy Hash: FB11A1B2910518AEDB10EBA4CC86AEEB7BCDB44711F54407AFA08E3280D7749A04DAB4

Function 00C898C2 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,00CE48F8), ref: 00C898D8
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00C89927
GetLastError.KERNEL32 ref: 00C89935
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 00C8996D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: 767998c612b5b7b31f8fc345d76aed01e09d9cb52051db2792da06362698f7ce
Instruction ID: 0a75a9ec6ccb4eaccac945fb080d2ddd52b46dc21ec1beb0d186605b3d012a1f
Opcode Fuzzy Hash: 767998c612b5b7b31f8fc345d76aed01e09d9cb52051db2792da06362698f7ce
Instruction Fuzzy Hash: E5814E71108304AFC314FB20DC95EAFB7A8FF94754F50892EF99652191EF70AA05DB92

Function 00C8B42F Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B489
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B4BB
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B529
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B536

Part of subcall function 00C8B42F: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B50C

FindClose.KERNEL32(00000000,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B561
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B568
GetLastError.KERNEL32(?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B570
FindClose.KERNEL32(00000000,?,?,?,?,?,?,00CE42E0,00CE42F8), ref: 00C8B583

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 95b262621a840d5641ae79766a2fc1d7766394f3fd7c58aaedd5200bf5e0647d
Instruction ID: 247249ded4015701c13492f2021915160f152ffebc398c85f1c3426257737007
Opcode Fuzzy Hash: 95b262621a840d5641ae79766a2fc1d7766394f3fd7c58aaedd5200bf5e0647d
Instruction Fuzzy Hash: 3A315B7280912DAACB20EBB0DC49FEE77BCAF45309F440596F615D2051EB719B889F64

Function 00C82F45 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C8301A
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 00C83026

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 00C831ED
GetProcAddress.KERNEL32(00000000), ref: 00C831F4

Strings

Shlwapi.dll, xrefs: 00C831E8
SHDeleteKeyW, xrefs: 00C831E3

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: 63abc6d0cbf263269859401f023452fe4ea221ea08ee591ff87a24aa25269cf1
Instruction ID: 8520f68bd416e4e24017639f1163ed244e0b26bf62664faa52963f00ba9b410b
Opcode Fuzzy Hash: 63abc6d0cbf263269859401f023452fe4ea221ea08ee591ff87a24aa25269cf1
Instruction Fuzzy Hash: 5CB1E872A043406BCA28F778CC5B9BE76599F90758F44861DFD4A931D2EF209F04A793

Function 00C7B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 00C7B257
GetLastError.KERNEL32 ref: 00C7B261

Strings

[Chrome StoredLogins not found], xrefs: 00C7B27B
[Chrome StoredLogins found, cleared!], xrefs: 00C7B287
UserProfile, xrefs: 00C7B227
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 00C7B222

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: 6fc6868ef83a85a3d9955b383b7a945be2a01ab4997ea4951b91ab7d4e462ed7
Instruction ID: 40dc7c814297bdca44776dba8c77cc6b12c28127d23fa8b4320024c6754f476f
Opcode Fuzzy Hash: 6fc6868ef83a85a3d9955b383b7a945be2a01ab4997ea4951b91ab7d4e462ed7
Instruction Fuzzy Hash: B2012832A44105A78B05BBB9DD2FEBE3738AD21710B44811AF90E536D7FF519F08E681

Function 00C86AB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00C86AC4
OpenProcessToken.ADVAPI32(00000000), ref: 00C86ACB
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00C86ADD
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00C86AFC
GetLastError.KERNEL32 ref: 00C86B02

Strings

SeShutdownPrivilege, xrefs: 00C86AD7

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: bac5cd00893e0fa2852ecb5790d8cd75df992e5d5f70259362fba12b90446d60
Instruction ID: 7a6d38a14970f01403d0fab662d4746abd0eb1069475ff826590d9029130d42d
Opcode Fuzzy Hash: bac5cd00893e0fa2852ecb5790d8cd75df992e5d5f70259362fba12b90446d60
Instruction Fuzzy Hash: 77F0D4B5805129BBDB10ABA1DC0DFEFBEBCEF05655F010151F906A6151D6748A049BB1

Function 00CC2F00 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00CC3046

Strings

1#IND, xrefs: 00CC423E
1#QNAN, xrefs: 00CC424C
1#INF, xrefs: 00CC4253
1#SNAN, xrefs: 00CC4245

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f2be0555ed8e29155e779d2b802cd85edc8d5466f7f000084577109dfa88acad
Instruction ID: 8335d9b9c2325e340143a3a754bcaf270f9db7759984b4b3303c8ec9299e9f1b
Opcode Fuzzy Hash: f2be0555ed8e29155e779d2b802cd85edc8d5466f7f000084577109dfa88acad
Instruction Fuzzy Hash: D9C22872E086688BDB25CE68ED40BE9B7B5EB44305F1481EED85DE7240E774AF818F40

Function 00C789A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00C789AE

Part of subcall function 00C741F1: socket.WS2_32(?,00000001,00000006), ref: 00C74212

Part of subcall function 00C7428C: connect.WS2_32(?,?,?), ref: 00C742A5

FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00C78A8D
FindNextFileW.KERNEL32(00000000,?), ref: 00C78AE0
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00C78AF7

Part of subcall function 00C74468: WaitForSingleObject.KERNEL32(?,00000000,00C84CE9,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000), ref: 00C7450E
Part of subcall function 00C74468: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00CE3EE8,00CE45A8,00000000,?,?,?,?,?,00C84CE9), ref: 00C7453C

Part of subcall function 00C747EB: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C747FD
Part of subcall function 00C747EB: SetEvent.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74808
Part of subcall function 00C747EB: CloseHandle.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74811

__CxxThrowException@8.LIBVCRUNTIME ref: 00C78DA1

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
String ID:
API String ID: 4043647387-0
Opcode ID: b26e9a842ae472501d0e367f9e879fe231df2f5f75396a23821895c07f6da002
Instruction ID: aa5b2dcce1730b2d2cdc7cace0d39bdadeaad2df82c7103e64669baf9d52e857
Opcode Fuzzy Hash: b26e9a842ae472501d0e367f9e879fe231df2f5f75396a23821895c07f6da002
Instruction Fuzzy Hash: FAA1A2329001099BCB18FBA4DC96EED7779AF50710F50826AF91AA71D2EF345F48DB90

Function 00C89BC4 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,00C8981A,00000000,00000000), ref: 00C89BCD
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,00C8981A,00000000,00000000), ref: 00C89BE2
CloseServiceHandle.ADVAPI32(00000000,?,?,00C8981A,00000000,00000000), ref: 00C89BEF
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,00C8981A,00000000,00000000), ref: 00C89BFA
CloseServiceHandle.ADVAPI32(00000000,?,?,00C8981A,00000000,00000000), ref: 00C89C0C
CloseServiceHandle.ADVAPI32(00000000,?,?,00C8981A,00000000,00000000), ref: 00C89C0F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: fc5b7724d2949f6fc8d176b891760d7cf1f13bceac547401fefb99c04f3b7a30
Instruction ID: 6dfced92060c333edc2b29fd904c3ba35eaec90a16aed399ac90460d5c5bafdd
Opcode Fuzzy Hash: fc5b7724d2949f6fc8d176b891760d7cf1f13bceac547401fefb99c04f3b7a30
Instruction Fuzzy Hash: DCF0EC72504228AFE210AB35ECC8FBF2AACEF853A0B040419F842D3140CF64CD06ABB1

Function 00C858B9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C86AB7: GetCurrentProcess.KERNEL32(00000028,?), ref: 00C86AC4
Part of subcall function 00C86AB7: OpenProcessToken.ADVAPI32(00000000), ref: 00C86ACB
Part of subcall function 00C86AB7: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00C86ADD
Part of subcall function 00C86AB7: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00C86AFC
Part of subcall function 00C86AB7: GetLastError.KERNEL32 ref: 00C86B02

ExitWindowsEx.USER32(00000000,00000001), ref: 00C8595B
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 00C85970
GetProcAddress.KERNEL32(00000000), ref: 00C85977

Strings

SetSuspendState, xrefs: 00C85966
PowrProf.dll, xrefs: 00C8596B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: PowrProf.dll$SetSuspendState
API String ID: 1589313981-1420736420
Opcode ID: 1da1d40d245038721aee1c3ce8134317c8a8fcba26e435ae613589ae64ba20d6
Instruction ID: 7060b479d2ea9ee00b39b9daf8e9832b554f81dc10da7269505215198f4f5c5b
Opcode Fuzzy Hash: 1da1d40d245038721aee1c3ce8134317c8a8fcba26e435ae613589ae64ba20d6
Instruction Fuzzy Hash: D921D670608741D7CF24F7F4D85AABE326A9FA0744F48C82AB90A57282EFA5CD05E715

Function 00CC11E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00CC1502,?,00000000), ref: 00CC127C
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00CC1502,?,00000000), ref: 00CC12A5
GetACP.KERNEL32(?,?,00CC1502,?,00000000), ref: 00CC12BA

Strings

OCP, xrefs: 00CC1237
ACP, xrefs: 00CC1201

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 71a7e96915b8236a0538f3c93fd6ff25bbc6d5bb3527535e8760a900b15bd7b5
Instruction ID: 38d669b3c292fb887ad63eba2ca9e7d8fb0889c1b8c9ab15499dcd50bd389f24
Opcode Fuzzy Hash: 71a7e96915b8236a0538f3c93fd6ff25bbc6d5bb3527535e8760a900b15bd7b5
Instruction Fuzzy Hash: 2321A73AA04101A6EB348F57D900FAB73A6EB56B60B5E456CED19D7112F732DF40C790

Function 00C8A63F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 00C8A650
LoadResource.KERNEL32(00000000,?,?,00C7E183,00000000), ref: 00C8A664
LockResource.KERNEL32(00000000,?,?,00C7E183,00000000), ref: 00C8A66B
SizeofResource.KERNEL32(00000000,?,?,00C7E183,00000000), ref: 00C8A67A

Strings

SETTINGS, xrefs: 00C8A643

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: f9924e92ace794dc0d092d083afa6b2a16dc3caff776ae9d19195157fb43c595
Instruction ID: 7ed3f8b1034e1d7761d7c306e9413fe9f7c3be08c11774615e3c858bd9239aa0
Opcode Fuzzy Hash: f9924e92ace794dc0d092d083afa6b2a16dc3caff776ae9d19195157fb43c595
Instruction Fuzzy Hash: 7CE09A7A604351ABCB221BA5EC8CF4F7E39E7CAB627594126FA0596230DA358920DB50

Function 00CC13B7 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6F1E
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F2B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00CC14C3
IsValidCodePage.KERNEL32(00000000), ref: 00CC151E
IsValidLocale.KERNEL32(?,00000001), ref: 00CC152D
GetLocaleInfoW.KERNEL32(?,00001001,00CB3CEC,00000040,?,00CB3E0C,00000055,00000000,?,?,00000055,00000000), ref: 00CC1575
GetLocaleInfoW.KERNEL32(?,00001002,00CB3D6C,00000040), ref: 00CC1594

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 2fe338716b496efd3330513f492cececaa7ec4dfc1ed8eeece259f5f7fc4ccd9
Instruction ID: f6d4fd34d5d61ac87cdee64c20dc7461298904917af8410d9ae43886ce41706e
Opcode Fuzzy Hash: 2fe338716b496efd3330513f492cececaa7ec4dfc1ed8eeece259f5f7fc4ccd9
Instruction Fuzzy Hash: 33517F71A002099BDF24EFA6CC45FBE73B8EF06700F18456DED25EB192E7709A409B61

Function 00C77A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00C77A91
FindFirstFileW.KERNEL32(00000000,?,00CD5AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C77B4A
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C77B6E
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C77C76

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: 57ed8e2f4c174f313fcfae1ac98edb3dc040559e3bc38d17056cf44ced20c280
Instruction ID: 6fa274756613101af09ca323989f91d4c04b7186128146e58eceb87db5769009
Opcode Fuzzy Hash: 57ed8e2f4c174f313fcfae1ac98edb3dc040559e3bc38d17056cf44ced20c280
Instruction Fuzzy Hash: 6B5193329001099BCB14FBA4DD9A9ED7B78AF14360F548259FD0E93192EF349B49EB90

Function 00CB800F Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00CCD478), ref: 00CB8079
WideCharToMultiByte.KERNEL32(00000000,00000000,00CE179C,000000FF,00000000,0000003F,00000000,?,?), ref: 00CB80F1
WideCharToMultiByte.KERNEL32(00000000,00000000,00CE17F0,000000FF,?,0000003F,00000000,?), ref: 00CB811E
_free.LIBCMT ref: 00CB8067

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CB8233

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: f0a0c38dfe6b7572759cb6f7cfbc0c186a3f5426c2b699b52ee216dc7482c4dd
Instruction ID: 95c71be9b790452273e65cf0ae86212b0bdbd91dcaf850f4a8f7ed79f70d60a1
Opcode Fuzzy Hash: f0a0c38dfe6b7572759cb6f7cfbc0c186a3f5426c2b699b52ee216dc7482c4dd
Instruction Fuzzy Hash: 2C51EA71904259EBCB10EF69DC81EEEB7BCEF40750F15066AE82497291EB309F49EB50

Function 00C76128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00C76234
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00C76318

Strings

C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C7627F, 00C763A7
open, xrefs: 00C7622E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\user\Desktop\SHROsQyiAd.exe$open
API String ID: 2825088817-2934567557
Opcode ID: ba5053c48afdc75d6033156dd4ca4788a8163322fb7150a6ed10e8b198735e2b
Instruction ID: 9f8f7403f22f8de0106914801144545a6f6ddffce5f990d2b9bdfa73a0fe3c05
Opcode Fuzzy Hash: ba5053c48afdc75d6033156dd4ca4788a8163322fb7150a6ed10e8b198735e2b
Instruction Fuzzy Hash: 6261E271A0430057CB25FB79C85A9BE77A69B91750F04C91EFC4A572D2EF24CA04EB92

Function 00C8BB77 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 00C8BC6C

Part of subcall function 00C826D2: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 00C826E1
Part of subcall function 00C826D2: RegSetValueExA.KERNELBASE(?,00CD6748,00000000,?,00000000,00000000,00CE42F8,?,?,00C7E5FB,00CD6748,5.3.0 Pro), ref: 00C82709
Part of subcall function 00C826D2: RegCloseKey.KERNELBASE(?,?,?,00C7E5FB,00CD6748,5.3.0 Pro), ref: 00C82714

Strings

WallpaperStyle, xrefs: 00C8BBB7, 00C8BBEA, 00C8BC3A
Control Panel\Desktop, xrefs: 00C8BBB2, 00C8BBE5, 00C8BC35
TileWallpaper, xrefs: 00C8BC56

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: 7e6244e5865434c9d7ca7ec6c07addde78158661b44c990bb2b6f75e09eefcea
Instruction ID: 4518f44abfaafda5e566cb8967ba914dce0c4bf5f93308899a818634de866584
Opcode Fuzzy Hash: 7e6244e5865434c9d7ca7ec6c07addde78158661b44c990bb2b6f75e09eefcea
Instruction Fuzzy Hash: 3311B132B8020073D91831394E2FF7E2D129396B65F95012FF7062B7D6EA868F5013CA

Function 00CC0A7F Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00CB3CF3,?,?,?,?,00CB374A,?,00000004), ref: 00CC0B61
_wcschr.LIBVCRUNTIME ref: 00CC0BF1
_wcschr.LIBVCRUNTIME ref: 00CC0BFF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00CB3CF3,00000000,00CB3E13), ref: 00CC0CA2

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: ba1a5134b8c88da4919ffede18197e15ec7cec1cbde46a3190ccf76db40c5df6
Instruction ID: 9369f010fb21558b080750e75ba5a73b1cb687a77c5313ceb6f9ce09a8d16f39
Opcode Fuzzy Hash: ba1a5134b8c88da4919ffede18197e15ec7cec1cbde46a3190ccf76db40c5df6
Instruction Fuzzy Hash: 5061E471A00306EAD724AB75CC82FBA73A8EF45710F24052EF919DB182EB74EE45D761

Function 00C78DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00C78DAC
FindFirstFileW.KERNEL32(00000000,?), ref: 00C78E24
FindNextFileW.KERNEL32(00000000,?), ref: 00C78E4D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: FileFind$FirstH_prologNext
String ID:
API String ID: 301083792-0
Opcode ID: 8ac056b07a98974507b2e4084420589e4f1316e3d412d82d5b6081f23db5d0ac
Instruction ID: 962bbc96f1354816522057350e54efa2dc53b8ab8dc1021b4b66fc9281f98da5
Opcode Fuzzy Hash: 8ac056b07a98974507b2e4084420589e4f1316e3d412d82d5b6081f23db5d0ac
Instruction Fuzzy Hash: 9E7133328001199BCB15FBA4DC96DEDB778EF14350F14826AF91AA7191EF306F49EB90

Function 00CC0E6A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6F1E
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F2B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CC0EBE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CC0F0F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CC0FCF

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 52a239e1af185098affd454670b03648ce243392e271356895e20ccf19ae8fdc
Instruction ID: 05faf11d17361ea5d75560d5d2b065cfad93b6a022f1a2acca3c3c77db910a94
Opcode Fuzzy Hash: 52a239e1af185098affd454670b03648ce243392e271356895e20ccf19ae8fdc
Instruction Fuzzy Hash: 2761AD71940207DBDB289F25CC82FBA77A8EF05300F2841AEED15C6686E734DA81DB50

Function 00CAA65D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00CAA755
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00CAA75F
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00CAA76C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 78c793b6c183523f533f925fd26b072d023a5f0c540a72bc415c069cc1766cb6
Instruction ID: 35abee32be3a55db438755fca5e46febd978fdac75b67fdfa703118eb3f534ea
Opcode Fuzzy Hash: 78c793b6c183523f533f925fd26b072d023a5f0c540a72bc415c069cc1766cb6
Instruction Fuzzy Hash: 4531B37491121D9BCB21DF64D889B9DBBB8EF08310F5442DAE81CA7250E7709F818F45

Function 00CA293A Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,00CA26C2,00000024,?,?,?), ref: 00CA294C
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,00C9CBBE,?), ref: 00CA2962
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,00C9CBBE,?), ref: 00CA2974

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 1024d499c3a65a4dc852522fbcdfd04d07b55d53b0eb020813881c56e6483f2f
Instruction ID: 32566ca802ebf3ce916fa0e8cfa8457a72e8bfa6aeb66b3ba8bf4740da00dc70
Opcode Fuzzy Hash: 1024d499c3a65a4dc852522fbcdfd04d07b55d53b0eb020813881c56e6483f2f
Instruction Fuzzy Hash: E3E0923130C222BBEB310F3AFC0CF5B2B55EB86F74F200628F261E40E4C66148469B18

Function 00CB2554 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00CB252A,00000003,00CDDAE0,0000000C,00CB2681,00000003,00000002,00000000,?,00CB53F8,00000003), ref: 00CB2575
TerminateProcess.KERNEL32(00000000,?,00CB252A,00000003,00CDDAE0,0000000C,00CB2681,00000003,00000002,00000000,?,00CB53F8,00000003), ref: 00CB257C
ExitProcess.KERNEL32 ref: 00CB258E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c9b4359f20ae26826a4a1c9d24a3b9e7f60ed7277bdafb233415ded019a8e951
Instruction ID: daf294b0a4563b59570499c8d6b4a0b94c6ca43d450d3d1a99974f746c6e4266
Opcode Fuzzy Hash: c9b4359f20ae26826a4a1c9d24a3b9e7f60ed7277bdafb233415ded019a8e951
Instruction Fuzzy Hash: 95E0B631404148EFCF216F55DD19F8D3F69EB60792F004214F8068A131CB75DE86DA90

Function 00CBD5E9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00CBD77C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 156a0301923b94edc3d0ac4b357177983d58dd7070038e062e72dfd809014d54
Instruction ID: 7c72ca53e26d621ffa23d03eab83bfcea0d63d4342786944bf67ea7287293c4a
Opcode Fuzzy Hash: 156a0301923b94edc3d0ac4b357177983d58dd7070038e062e72dfd809014d54
Instruction Fuzzy Hash: CF31E371900209AFCB249E78CC84EEA7BBDDB86314F1405A8F82A97251F6309E448B60

Function 00CB7597 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00CB374A,?,00000004), ref: 00CB75EA

Strings

GetLocaleInfoEx, xrefs: 00CB75A8, 00CB75B2

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 9f8c21259ddb1b84770484ffdbc9c30a4e21fc0268814df55057fd999210a340
Instruction ID: ab3f5bb754b223d16962a8d14c537502c17ec2b1f1030003d6700b6d396878b0
Opcode Fuzzy Hash: 9f8c21259ddb1b84770484ffdbc9c30a4e21fc0268814df55057fd999210a340
Instruction Fuzzy Hash: CBF0F031A44208FBCB11AF64DC06FAEBB24EB44710F050268FC052A2A0CA718E10AAA5

Function 00CB0E20 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe4b2cb4502993dbea9aed901accaaf97bf6201a09a40e91719f5fde44f0d4f
Instruction ID: ca9ba938771c46c24daf44dd8df2628e5625038ea4055e0a600b419a490112eb
Opcode Fuzzy Hash: 5fe4b2cb4502993dbea9aed901accaaf97bf6201a09a40e91719f5fde44f0d4f
Instruction Fuzzy Hash: 31022C71E002199FDF14CFA9D8906EEB7F1EF88314F698269D929E7344D731AA41CB80

Function 00C88C69 Relevance: 3.2, APIs: 2, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00C88EBF
FindNextFileW.KERNEL32(00000000,?,?), ref: 00C88F8B

Part of subcall function 00C8B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID:
API String ID: 341183262-0
Opcode ID: 8bf50174551c45b09e607b15942f80ff2fefbc28fcabc47ca4e4e9b18f1fe040
Instruction ID: 8cff2ec8d2673a8de3bd19407ad1a0d3e17c98f78e977ca82a4ecc5b922d8c7a
Opcode Fuzzy Hash: 8bf50174551c45b09e607b15942f80ff2fefbc28fcabc47ca4e4e9b18f1fe040
Instruction Fuzzy Hash: 628162315042409BD728FB64C866EEFB3A9AFA0750F44892DF95A431D2EF309A09E756

Function 00C76AC2 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00C76ADD
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00C76BA5

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID:
API String ID: 4113138495-0
Opcode ID: 7f7cfbda5cbc2c27c5ce20592ca3bbf5ec02e8c2cb8cd5fed69cabe1f208ff83
Instruction ID: 9705f8d12cf0e50a08a5fd04e78c0fd2997427ac7b28c0e8d3edd7b799f32c99
Opcode Fuzzy Hash: 7f7cfbda5cbc2c27c5ce20592ca3bbf5ec02e8c2cb8cd5fed69cabe1f208ff83
Instruction Fuzzy Hash: 8D2164325043009BD714FB64DC95DAFB7ACAF91360F448A2DFD9A92191EF349A0CEA53

Function 00CC20D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CC20CD,?,?,00000008,?,?,00CC5412,00000000), ref: 00CC22FF

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 27186b5e6181b7b665b35473eb7075c0b3b4e862a85210b3ceb84d82bdf32093
Instruction ID: 529305eea53eff5212e950a6997dedc2ec002886e0d0002c429932a81b368fd9
Opcode Fuzzy Hash: 27186b5e6181b7b665b35473eb7075c0b3b4e862a85210b3ceb84d82bdf32093
Instruction Fuzzy Hash: 7AB12B315106499FDB19CF28C48AF647BE1FF45364F29865CE9A9CF2A1C335EA92CB40

Function 00CA2A49 Relevance: 1.8, Strings: 1, Instructions: 500COMMON

Download Yara Rule

Strings

0, xrefs: 00CA2A55

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: defdca1491d80a1dfb9f193988fabc4b1fec9e13e40a9936533af68ee2847aa8
Instruction ID: dcbbf39a03c93b45473dafdd13844351bb51f098b18ec3ac30398796339ed910
Opcode Fuzzy Hash: defdca1491d80a1dfb9f193988fabc4b1fec9e13e40a9936533af68ee2847aa8
Instruction Fuzzy Hash: A302B2327083118BD714DF39D85262FB3E2AFC8B58F15492EF8C9AB391DA34E9059A45

Function 00CC10BA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6F1E
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F2B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00CC110E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 7257ddc80028c8ac5bee263fcde499eb577a9f705b2908c7e0633656fc58fbb2
Instruction ID: 534b4467c6b058b4cdb091482fb02ce81d0e0be41856c9efcfac229aaadf4781
Opcode Fuzzy Hash: 7257ddc80028c8ac5bee263fcde499eb577a9f705b2908c7e0633656fc58fbb2
Instruction Fuzzy Hash: 44218332510206ABDB249E66DC86FBE73A8EB06310F18016EFE11C6242EB79DD44DB90

Function 00CC0D42 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

EnumSystemLocalesW.KERNEL32(00CC0E6A,00000001,00000000,?,00CB3CEC,?,00CC1497,00000000,?,?,?), ref: 00CC0DB4

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 572ee1770903de485f39508b1b8969107b39f2168e0652a5482a47f4c239199c
Instruction ID: 4d9cfa08f15757eff8b031ec7b0822e4ea4f4bd0b699fb708bd98dbd2b843571
Opcode Fuzzy Hash: 572ee1770903de485f39508b1b8969107b39f2168e0652a5482a47f4c239199c
Instruction Fuzzy Hash: 451129362007059FDB189F78C891BBAB791FF80319B28442CE99747740D371B942CB40

Function 00CC12EA Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00CC1088,00000000,00000000,?), ref: 00CC1316

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 5864e12c8825a354bfa3075de8fc126b03b273635fecfa31cc11a91677fcec58
Instruction ID: 5d1fbfd695802a3f33736a1d698b4490902d12d2ce90cbf26522aea3744fe8c3
Opcode Fuzzy Hash: 5864e12c8825a354bfa3075de8fc126b03b273635fecfa31cc11a91677fcec58
Instruction Fuzzy Hash: 6DF02D32500155FBDB286E66CC05FFA7758EB41758F1C042DEC15A3551EA34FE41C6D0

Function 00CC0DDD Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

EnumSystemLocalesW.KERNEL32(00CC10BA,00000001,?,?,00CB3CEC,?,00CC145B,00CB3CEC,?,?,?,?,?,00CB3CEC,?,?), ref: 00CC0E29

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: efa7d439a9e3d95a878d6318f8f690dab5a590a4972d5a4070afeb85d1db3598
Instruction ID: 593fe1ea9727368e8361e5d9f7cee2b70a547be58b4c9e0469f46c5cd84dfeec
Opcode Fuzzy Hash: efa7d439a9e3d95a878d6318f8f690dab5a590a4972d5a4070afeb85d1db3598
Instruction Fuzzy Hash: 39F022362003049FDB145F79D881F6A7B91EF81328B14842CFA458B781D271AD42C640

Function 00CB70AE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB4ACC: EnterCriticalSection.KERNEL32(-00062FAC,?,00CB225B,00000000,00CDDAC0,0000000C,00CB2216,?,?,?,00CB8739,?,?,00CB6F74,00000001,00000364), ref: 00CB4ADB

EnumSystemLocalesW.KERNEL32(00CB7068,00000001,00CDDC48,0000000C), ref: 00CB70E6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: cc482fa89cb9ef215fe90dfda7767ed99793c8b175723e87f0116d81fe838752
Instruction ID: d9be1d3e7d74367e631e0561d85f26eec3057107b714d985cbe49c460e83f3be
Opcode Fuzzy Hash: cc482fa89cb9ef215fe90dfda7767ed99793c8b175723e87f0116d81fe838752
Instruction Fuzzy Hash: F6F04F32A20201DFD700EF68DC46B8D77B0EB45711F10825AF810DF2E2CB7489419F51

Function 00CC0CF7 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

EnumSystemLocalesW.KERNEL32(00CC0C4E,00000001,?,?,?,00CC14B9,00CB3CEC,?,?,?,?,?,00CB3CEC,?,?,?), ref: 00CC0D2E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 65a1643583f7ce0b98e2bc86ce9855b70661024b1797ee154868615b03f6459f
Instruction ID: b0708c90acd486b6f30242720a075acf7208242f5339cb2288a97f4ba158e3d5
Opcode Fuzzy Hash: 65a1643583f7ce0b98e2bc86ce9855b70661024b1797ee154868615b03f6459f
Instruction Fuzzy Hash: 80F0553A30020597CB14AF75D845B6A7F94EFC1710B1A405CEA1A8B280C231A983C7A0

Function 00CA3CD7 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00033CE3,00CA39B1), ref: 00CA3CDC

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b71fa49e0d4fdde403139d6f599edde24a9c4cc202a11c404b4d2fe4b21a7923
Instruction ID: 472dd35dfc9f76ae7738b430e246202d826bc8636b02a306b150197b6a95d38a
Opcode Fuzzy Hash: b71fa49e0d4fdde403139d6f599edde24a9c4cc202a11c404b4d2fe4b21a7923
Instruction Fuzzy Hash:

Function 00CAC9DD Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

Offline Keylogger Started, xrefs: 00CACAE3

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: Offline Keylogger Started
API String ID: 0-4114347211
Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction ID: 251c094d088dd37bbf6e05d1f417e30d58b1bb03c247f8116e71a5d2bcb9f593
Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction Fuzzy Hash: C251657160060F9BDB34CA6895E77BE6389DB0330CF080509E8A39B692D6169F02B366

Function 00CACC0C Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00CACD7C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction ID: 3cd105b7c5dc04930b47349f4cae1c6d9a68807af4d8123dae5f7125473414ff
Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction Fuzzy Hash: 21518C31A0474B57DF38866C85D67FF2B959B0371CF18052AE4ABCB782C619DF01A355

Function 00C96E73 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

@, xrefs: 00C96EC4

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
Instruction ID: 7a65b4a2e66e761e6faacb2c81fdf551197b17468a9bc72e0897e3d64bccc393
Opcode Fuzzy Hash: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
Instruction Fuzzy Hash: 2D4134759187098BC314CF29C18475BFBE1FBC9354F148A2EF99693390D675EA808B82

Function 00CBE92E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00CBE92E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f358c6b5b1ff116e886506774e845c948fca13897ed2b375d8162248cbd01457
Instruction ID: b7ecbb6bcd64b706dba0313edbd29e87e213cdbef2c83398b7b0307cea521a38
Opcode Fuzzy Hash: f358c6b5b1ff116e886506774e845c948fca13897ed2b375d8162248cbd01457
Instruction Fuzzy Hash: 02A01230102141CB53004F31AF0531D3698A50018030480289405C4120D63040505B00

Function 00CBC739 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3236f3d17b0bebb2bb8d1212fe30135654e6924076feb5d6bf9619bde988abba
Instruction ID: 646b0efb88768115fc5b323aff6d7a881651a691254a56c818a5d5e301c44a55
Opcode Fuzzy Hash: 3236f3d17b0bebb2bb8d1212fe30135654e6924076feb5d6bf9619bde988abba
Instruction Fuzzy Hash: F6320232D29F414DD7239634D86233AA689AFB73C4F15D737E82AB59A9EB38C5C34100

Function 00C8E5DF Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c1f3f2d0e21dc0be012d9e2ae295b3203e3b343e115805c7e35ed64ad2b9558
Instruction ID: 1f09f35aa89db3f7671484d29f39295575a35ee887fcb27e133227687dc7e6b4
Opcode Fuzzy Hash: 9c1f3f2d0e21dc0be012d9e2ae295b3203e3b343e115805c7e35ed64ad2b9558
Instruction Fuzzy Hash: 0E32E6316087569FD715EF68C48076AB7E5BF8530CF044A2EF8A58B281E770DE05CB8A

Function 00C967CB Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec398e54331b7e5d10350fd6aa38733c890917363f1d5d1636520a276df48e66
Instruction ID: 91a0f1ea1dfff89ae638a8e6948b07bfec333789f32228a3c9f0c6ea17b830bc
Opcode Fuzzy Hash: ec398e54331b7e5d10350fd6aa38733c890917363f1d5d1636520a276df48e66
Instruction Fuzzy Hash: D2029F716056518FC718CF2EE89073EB7E2AF8D301746866AE495C7385EB34E926CB90

Function 00C96254 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbca1399793ab9516eeccba82301993ec5775d3b2cf3b3cd169a3163d963954
Instruction ID: a2bb059864cdcdcc797e25b7deab32b1f03f7a858b7c3f226d86073c0110126e
Opcode Fuzzy Hash: 4bbca1399793ab9516eeccba82301993ec5775d3b2cf3b3cd169a3163d963954
Instruction Fuzzy Hash: E8F138716142558FC714DF19E892A3EB3E1EB89301B460A1FF1C2D7392DB34EA1ADB51

Function 00CA1377 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4d0979f66ea803f5fbfe0607e5ffadaf71e909b62db8f938a7b3e4cefb321f
Instruction ID: 5b28ea475e657d7758665bbd0d021df5b2986943549da1f4baa9057a11608448
Opcode Fuzzy Hash: 3c4d0979f66ea803f5fbfe0607e5ffadaf71e909b62db8f938a7b3e4cefb321f
Instruction Fuzzy Hash: BED15D719083168BCB21DE68C88456EB7E4BF95398F481A2DFC96D7251EB34DE058B82

Function 00C8D071 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
Instruction ID: d0c44f71036c3d67b97782fc2bb23cf245b9843865bdce513145d5908c4949d7
Opcode Fuzzy Hash: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
Instruction Fuzzy Hash: E0B1913911429A8ADB05EF28C4913F63BA1EF6A300F4850B9EC9DCF757D3359906EB24

Function 00CAD098 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22bbf47a8cdfee452fd34d4c6c94808048783d3064c919ecf4faa7900aeb2967
Instruction ID: 1a4404d52501c0943ab26c3381ace88d0f73c96b2b452c94bad7374885f965e2
Opcode Fuzzy Hash: 22bbf47a8cdfee452fd34d4c6c94808048783d3064c919ecf4faa7900aeb2967
Instruction Fuzzy Hash: D061AC7160030B66DE385A388995BBF23A4EF0731CF24061AFA63DBE81DA51DF42D346

Function 00CACE3B Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b01befaabe980f6805e9cc4f6dd04a7ac6e62eb41a70708b23056ad1f5f649e
Instruction ID: b0da748cd3f986af33bd033709153b3d0b46cbff13a202bdb43905ffda0be1f0
Opcode Fuzzy Hash: 5b01befaabe980f6805e9cc4f6dd04a7ac6e62eb41a70708b23056ad1f5f649e
Instruction Fuzzy Hash: B1617971600B0B5ADF385AA84CD5BBEA396DB0370CF10091AF963DF6C1DA51DF429355

Function 00C96FAD Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a8b980d15524a9166ea1c1ad562ce51950159e1ba55b929a656d107737cc95
Instruction ID: 1d19dc5ab6c6c419edf5c9cf2707634130a45d104ddef187badcecb26dc8b4cd
Opcode Fuzzy Hash: e2a8b980d15524a9166ea1c1ad562ce51950159e1ba55b929a656d107737cc95
Instruction Fuzzy Hash: FF614B32A083019FC708DF34D585A5FB7E5EFD8714F554E2EF49A96191E730EA089B82

Function 00CA7150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5f08dbc190494c6852da6382e50cbd4072744dcfba81c4925378dadbea4751ab
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8211087724C18343EA24862DDCF45BEA7E5FAC732C76C437AD2694B758D1229B459500

Function 00C87F9F Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 324windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C87FB9
CreateCompatibleDC.GDI32(00000000), ref: 00C87FC4

Part of subcall function 00C88452: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00C88482

CreateCompatibleBitmap.GDI32(?,00000000), ref: 00C88045
DeleteDC.GDI32(?), ref: 00C8805D
DeleteDC.GDI32(00000000), ref: 00C88060
SelectObject.GDI32(00000000,00000000), ref: 00C8806B
StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00C88093
GetIconInfo.USER32(?,?), ref: 00C880CB
DeleteObject.GDI32(?), ref: 00C880FA
DeleteObject.GDI32(?), ref: 00C88107
DrawIcon.USER32(00000000,?,?,?), ref: 00C88114
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00660046), ref: 00C88144
GetObjectA.GDI32(?,00000018,?), ref: 00C88173
LocalAlloc.KERNEL32(00000040,00000028), ref: 00C881BC
LocalAlloc.KERNEL32(00000040,00000001), ref: 00C881DF
GlobalAlloc.KERNEL32(00000000,?), ref: 00C88248
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00C8826B
DeleteDC.GDI32(?), ref: 00C8827F
DeleteDC.GDI32(00000000), ref: 00C88282
DeleteObject.GDI32(00000000), ref: 00C88285
GlobalFree.KERNEL32(00CC0020), ref: 00C88290
DeleteObject.GDI32(00000000), ref: 00C88344
GlobalFree.KERNEL32(?), ref: 00C8834B
DeleteDC.GDI32(?), ref: 00C8835B
DeleteDC.GDI32(00000000), ref: 00C88366
DeleteDC.GDI32(?), ref: 00C88398
DeleteDC.GDI32(00000000), ref: 00C8839B
DeleteObject.GDI32(?), ref: 00C883A1

Strings

DISPLAY, xrefs: 00C87FB2

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconLocal$BitmapBitsDisplayDrawEnumInfoSelectSettingsStretch
String ID: DISPLAY
API String ID: 1765752176-865373369
Opcode ID: 2b1ed57f88da7f4856fe4508ef2f81ca8f88a69ec78906b7ecaa404cc9c4f170
Instruction ID: 74d3b0945c78358225ffb2fda91924e6e51e3f57c6de61a70723c51976718b5b
Opcode Fuzzy Hash: 2b1ed57f88da7f4856fe4508ef2f81ca8f88a69ec78906b7ecaa404cc9c4f170
Instruction Fuzzy Hash: B9C16831508340AFD720EB65CC48B6FBBE9FF88714F44491DF99A97660DB30A909CB56

Function 00C87245 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 290libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00C8728C
GetProcAddress.KERNEL32(00000000), ref: 00C8728F
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00C872A0
GetProcAddress.KERNEL32(00000000), ref: 00C872A3
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 00C872B4
GetProcAddress.KERNEL32(00000000), ref: 00C872B7
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00C872C8
GetProcAddress.KERNEL32(00000000), ref: 00C872CB
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00C8736C
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00C87384
GetThreadContext.KERNEL32(?,00000000), ref: 00C8739A
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 00C873C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00C87440
TerminateProcess.KERNEL32(?,00000000), ref: 00C87454
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00C8748B
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00C87558
SetThreadContext.KERNEL32(?,00000000), ref: 00C87575
ResumeThread.KERNEL32(?), ref: 00C87582
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00C8759A
GetCurrentProcess.KERNEL32(?), ref: 00C875A5
TerminateProcess.KERNEL32(?,00000000), ref: 00C875BF
GetLastError.KERNEL32 ref: 00C875C7

Strings

ntdll, xrefs: 00C87277, 00C87296, 00C872AA, 00C872BE
ZwCreateSection, xrefs: 00C87272
`#v, xrefs: 00C87266
ZwClose, xrefs: 00C872B9
ZwMapViewOfSection, xrefs: 00C87291
ZwUnmapViewOfSection, xrefs: 00C872A5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
API String ID: 4188446516-108836778
Opcode ID: 2481b8b9527069a3419617abc0c75dab5027f2f8231d87b15460052f6b88b506
Instruction ID: 33e5df2adfd6233f90dfa1395ca2c4a74a24462e0c10e86b59615e48a0598f27
Opcode Fuzzy Hash: 2481b8b9527069a3419617abc0c75dab5027f2f8231d87b15460052f6b88b506
Instruction Fuzzy Hash: 09A17CB1508305AFD710AF61DC84F6BBBE8FB88348F140A29F659C6260E771EA54CF65

Function 00C7C28E Relevance: 38.8, APIs: 6, Strings: 16, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81699: TerminateProcess.KERNEL32(00000000,pth_unenc,00C7E670), ref: 00C816A9
Part of subcall function 00C81699: WaitForSingleObject.KERNEL32(000000FF), ref: 00C816BC

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 00C7C38B
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 00C7C39E
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 00C7C3B7
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 00C7C3E7

Part of subcall function 00C7AFBA: TerminateThread.KERNEL32(00C799A9,00000000,00CE42F8,pth_unenc,00C7BF26,00CE42E0,00CE42F8,?,pth_unenc), ref: 00C7AFC9
Part of subcall function 00C7AFBA: UnhookWindowsHookEx.USER32(00CE40F8), ref: 00C7AFD5
Part of subcall function 00C7AFBA: TerminateThread.KERNEL32(00C79993,00000000,?,pth_unenc), ref: 00C7AFE3

Part of subcall function 00C8B58F: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00CD5900,00000000,00000000,00C7C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 00C8B5CE

ShellExecuteW.SHELL32(00000000,open,00000000,00CD5900,00CD5900,00000000), ref: 00C7C632
ExitProcess.KERNEL32 ref: 00C7C63E

Strings

"), xrefs: 00C7C443
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 00C7C56F
exepath, xrefs: 00C7C365
On Error Resume Next, xrefs: 00C7C427
Temp, xrefs: 00C7C3EE
wend, xrefs: 00C7C4F7
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 00C7C418
while fso.FileExists(", xrefs: 00C7C45A
fso.DeleteFile ", xrefs: 00C7C4A8
""", 0, xrefs: 00C7C555
open, xrefs: 00C7C62C
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 00C7C5E1
fso.DeleteFolder ", xrefs: 00C7C519
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00C7C330
\update.vbs, xrefs: 00C7C3E9
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00C7C2DF

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-1536747724
Opcode ID: a408c8ab1d5d8363f93acf32c36e57290e374bd5a289dca8e59f184e03bec30a
Instruction ID: cb04b91c5871eb020e8beea221dd87b3435103530c1353f692bea3225daac9cc
Opcode Fuzzy Hash: a408c8ab1d5d8363f93acf32c36e57290e374bd5a289dca8e59f184e03bec30a
Instruction Fuzzy Hash: 9D91D4716042405BC728FB24DCA6ABF77D99F91310F04853EF98E931A2EF209E49E752

Function 00C812B5 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 189synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00CE42F8,?,00000000), ref: 00C812D4
ExitProcess.KERNEL32 ref: 00C8151D

Part of subcall function 00C8265D: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00CE42F8), ref: 00C82679
Part of subcall function 00C8265D: RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000208,?), ref: 00C82692
Part of subcall function 00C8265D: RegCloseKey.KERNELBASE(00000000), ref: 00C8269D

Part of subcall function 00C8B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 00C8135B
OpenProcess.KERNEL32(00100000,00000000,00C7E154,?,?,?,?,00000000), ref: 00C8136A
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 00C81375
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00C8137C
GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 00C81382

Part of subcall function 00C827D5: RegCreateKeyA.ADVAPI32(80000001,00000000,00CD5554), ref: 00C827E3
Part of subcall function 00C827D5: RegSetValueExA.KERNELBASE(00CD5554,000000AF,00000000,00000004,00000001,00000004,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C827FE
Part of subcall function 00C827D5: RegCloseKey.ADVAPI32(00CD5554,?,?,?,00C7B94C,00CD60E0,00000001,000000AF,00CD5554), ref: 00C82809

PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 00C813B3
GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 00C8140F
GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00C81429
lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 00C8143B

Part of subcall function 00C8B58F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002), ref: 00C8B5EB
Part of subcall function 00C8B58F: WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00C8B5FF
Part of subcall function 00C8B58F: CloseHandle.KERNELBASE(00000000), ref: 00C8B60C

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00C81483
Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 00C814C4
OpenProcess.KERNEL32(00100000,00000000,00C7E154,?,?,?,?,00000000), ref: 00C814D9
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 00C814E4
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00C814EB
GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 00C814F1

Part of subcall function 00C8B58F: CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00CD5900,00000000,00000000,00C7C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 00C8B5CE

Strings

exepath, xrefs: 00C81308
.exe, xrefs: 00C8142F
open, xrefs: 00C8147D
temp_, xrefs: 00C8141D
WDH, xrefs: 00C81389, 00C814F8

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
String ID: .exe$WDH$exepath$open$temp_
API String ID: 4250697656-3088914985
Opcode ID: c338f594548baab6a7cf5ded97fbd6c177b4168ca89de719847f70785aa1a921
Instruction ID: ebca786b7264edca1a6536ac4440b548eb541515b2fae1cc0c85e87801c9a6dd
Opcode Fuzzy Hash: c338f594548baab6a7cf5ded97fbd6c177b4168ca89de719847f70785aa1a921
Instruction Fuzzy Hash: E451ED71A04219ABDB00BBA0DC4AFBE73ADDB44314F084265F916A72D1EF748E429F64

Function 00C8A1BB Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 00C8A2B2
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 00C8A2C6
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00CD5554), ref: 00C8A2EE
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00CE3EE8,00000000), ref: 00C8A2FF
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 00C8A340
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 00C8A358
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 00C8A36D
SetEvent.KERNEL32 ref: 00C8A38A
WaitForSingleObject.KERNEL32(000001F4), ref: 00C8A39B
CloseHandle.KERNEL32 ref: 00C8A3AB
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 00C8A3CD
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 00C8A3D7

Strings

play audio, xrefs: 00C8A2C1
stop audio, xrefs: 00C8A3C8
close audio, xrefs: 00C8A3D2
pause audio, xrefs: 00C8A33B
resume audio, xrefs: 00C8A353
alias audio, xrefs: 00C8A22E
status audio mode, xrefs: 00C8A368
stopped, xrefs: 00C8A373
open ", xrefs: 00C8A246
" type , xrefs: 00C8A24B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped
API String ID: 738084811-1354618412
Opcode ID: 6f96cdbfb6475086b2358cdbf25c827677a37d48804b5d76f0a55a9647ed0d35
Instruction ID: 5aab96a14f1d0761c81ef19added9318bc6017fa75796fce3b8e6088b939a07d
Opcode Fuzzy Hash: 6f96cdbfb6475086b2358cdbf25c827677a37d48804b5d76f0a55a9647ed0d35
Instruction Fuzzy Hash: 61511571204244AFD214B774DC86FBF3B9CDB80394F04452FF959471A2DF209E48A762

Function 00C7BF04 Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81699: TerminateProcess.KERNEL32(00000000,pth_unenc,00C7E670), ref: 00C816A9
Part of subcall function 00C81699: WaitForSingleObject.KERNEL32(000000FF), ref: 00C816BC

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,00CE42F8,?,pth_unenc), ref: 00C7C013
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 00C7C026
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,00CE42F8,?,pth_unenc), ref: 00C7C056
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00CE42F8,?,pth_unenc), ref: 00C7C065

Part of subcall function 00C7AFBA: TerminateThread.KERNEL32(00C799A9,00000000,00CE42F8,pth_unenc,00C7BF26,00CE42E0,00CE42F8,?,pth_unenc), ref: 00C7AFC9
Part of subcall function 00C7AFBA: UnhookWindowsHookEx.USER32(00CE40F8), ref: 00C7AFD5
Part of subcall function 00C7AFBA: TerminateThread.KERNEL32(00C79993,00000000,?,pth_unenc), ref: 00C7AFE3

Part of subcall function 00C8AB38: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00CD5900,00C7C07B,.vbs,?,?,?,?,?,00CE42F8), ref: 00C8AB5F

ShellExecuteW.SHELL32(00000000,open,00000000,00CD5900,00CD5900,00000000), ref: 00C7C280
ExitProcess.KERNEL32 ref: 00C7C287

Strings

"), xrefs: 00C7C11F
exepath, xrefs: 00C7BFEF
On Error Resume Next, xrefs: 00C7C102
Temp, xrefs: 00C7C0B4
wend, xrefs: 00C7C1D2
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 00C7C0F3
while fso.FileExists(", xrefs: 00C7C136
fso.DeleteFile ", xrefs: 00C7C183
.vbs, xrefs: 00C7C06F
open, xrefs: 00C7C27A
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 00C7C22F
fso.DeleteFolder ", xrefs: 00C7C1F8
pth_unenc, xrefs: 00C7BF0A
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00C7BFA6
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00C7BF55

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-3018399277
Opcode ID: c3fe09abbf5d601bb5fbec30731dfb81da204664e8cf6a229cc1d3f34fb24a96
Instruction ID: 5392cf9a7ce434e66dd1cc7ed7a1be200e5db7205fe0157f5861c46851f99e82
Opcode Fuzzy Hash: c3fe09abbf5d601bb5fbec30731dfb81da204664e8cf6a229cc1d3f34fb24a96
Instruction Fuzzy Hash: 088103316042405BC718FB24DCA6ABF77A89F90710F14853EF99A93292EF309E09E752

Function 00C71BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00C71C54
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00C71C7E
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00C71C8E
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00C71C9E
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00C71CAE
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00C71CBE
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00C71CCF
WriteFile.KERNEL32(00000000,00CE1B02,00000002,00000000,00000000), ref: 00C71CE0
WriteFile.KERNEL32(00000000,00CE1B04,00000004,00000000,00000000), ref: 00C71CF0
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00C71D00
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00C71D11
WriteFile.KERNEL32(00000000,00CE1B0E,00000002,00000000,00000000), ref: 00C71D22
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00C71D32
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00C71D42

Strings

fmt , xrefs: 00C71CA8
RIFF, xrefs: 00C71C78
data, xrefs: 00C71D2C
WAVE, xrefs: 00C71C98

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: e5fedb78d03f051284b9cd7112b3e05737fb14a2af8a8a828f1df436947e414b
Instruction ID: 786d9b557c8fe7963d55306390ae0be8de0371319225f6b4537799b181162041
Opcode Fuzzy Hash: e5fedb78d03f051284b9cd7112b3e05737fb14a2af8a8a828f1df436947e414b
Instruction Fuzzy Hash: E3415F71544218BBE210DE51DD86FBB7EECEB85B50F44041AFA44DA080D764A909DBB3

Function 00C764E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\SHROsQyiAd.exe,00000001,00C768B2,C:\Users\user\Desktop\SHROsQyiAd.exe,00000003,00C768DA,00CE42E0,00C76933), ref: 00C764F4
GetProcAddress.KERNEL32(00000000), ref: 00C764FD
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 00C7650E
GetProcAddress.KERNEL32(00000000), ref: 00C76511
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00C76522
GetProcAddress.KERNEL32(00000000), ref: 00C76525
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00C76536
GetProcAddress.KERNEL32(00000000), ref: 00C76539
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 00C7654A
GetProcAddress.KERNEL32(00000000), ref: 00C7654D
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 00C7655E
GetProcAddress.KERNEL32(00000000), ref: 00C76561

Strings

RtlReleasePebLock, xrefs: 00C76544
C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C764E1
NtAllocateVirtualMemory, xrefs: 00C76508
ntdll.dll, xrefs: 00C764E8, 00C764F3, 00C7650D, 00C76521, 00C76535, 00C76549, 00C7655D
NtFreeVirtualMemory, xrefs: 00C7651C
LdrEnumerateLoadedModules, xrefs: 00C76558
RtlAcquirePebLock, xrefs: 00C76530
RtlInitUnicodeString, xrefs: 00C764EE

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\user\Desktop\SHROsQyiAd.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-2048506329
Opcode ID: 732d267ed14395645ee93dbad843bffd3e6ec7e6251175c7ef5699179697347f
Instruction ID: e9769523ad90b5714e46f628f7ec2f48ea6460800292f234c756332059d8adbd
Opcode Fuzzy Hash: 732d267ed14395645ee93dbad843bffd3e6ec7e6251175c7ef5699179697347f
Instruction Fuzzy Hash: 6A017CF4E40B96669B22AB7B5C94E1FAEECDE503903084833B905E72A1FE74C5019E74

Function 00C7BC67 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C7BC75
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,00CE4358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 00C7BC8E
CopyFileW.KERNEL32(C:\Users\user\Desktop\SHROsQyiAd.exe,00000000,00000000,00000000,00000000,00000000,?,00CE4358,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 00C7BD3E
_wcslen.LIBCMT ref: 00C7BD54
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 00C7BDDC
CopyFileW.KERNEL32(C:\Users\user\Desktop\SHROsQyiAd.exe,00000000,00000000), ref: 00C7BDF2
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 00C7BE31
_wcslen.LIBCMT ref: 00C7BE34
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 00C7BE4B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CE4358,0000000E), ref: 00C7BE9B
ShellExecuteW.SHELL32(00000000,open,00000000,00CD5900,00CD5900,00000001), ref: 00C7BEB9
ExitProcess.KERNEL32 ref: 00C7BED0

Strings

C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C7BCFF, 00C7BD04, 00C7BD37, 00C7BDEC, 00C7BDF1, 00C7BDF8, 00C7BE59
open, xrefs: 00C7BEB2
6, xrefs: 00C7BD48
del, xrefs: 00C7BE63

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Users\user\Desktop\SHROsQyiAd.exe$del$open
API String ID: 1579085052-2670028600
Opcode ID: 338db18a07dcf8f9d01190a2d68b357387f6ab0c902a60fd4102018c92b9e516
Instruction ID: 9c53bbb357d355e4b286f43e694817845514bbc21d0a678bb74ecc5d26167786
Opcode Fuzzy Hash: 338db18a07dcf8f9d01190a2d68b357387f6ab0c902a60fd4102018c92b9e516
Instruction Fuzzy Hash: 245116616042416BD618B339EC57F7F2B989F81750F14842DFE4D872D2DF249E05A7A2

Function 00C8B1BB Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00C8B1D6
_memcmp.LIBVCRUNTIME ref: 00C8B1EE
lstrlenW.KERNEL32(?), ref: 00C8B207
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 00C8B242
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00C8B255
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 00C8B299
lstrcmpW.KERNEL32(?,?), ref: 00C8B2B4
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 00C8B2CC
_wcslen.LIBCMT ref: 00C8B2DB
FindVolumeClose.KERNEL32(?), ref: 00C8B2FB
GetLastError.KERNEL32 ref: 00C8B313
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 00C8B340
lstrcatW.KERNEL32(?,?), ref: 00C8B359
lstrcpyW.KERNEL32(?,?), ref: 00C8B368
GetLastError.KERNEL32 ref: 00C8B370

Strings

?, xrefs: 00C8B26D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: becbd2940a3c90e47b91f22b67ebe3421a5e8d12b3b7947ab73a23832e362ded
Instruction ID: 40772cafe2eac4dd730fb3a7ec806303965b78242b924cb4ee35ea8b0312581a
Opcode Fuzzy Hash: becbd2940a3c90e47b91f22b67ebe3421a5e8d12b3b7947ab73a23832e362ded
Instruction Fuzzy Hash: 27415F715083069BD720EFA1EC88EAFB7E8FB45718F44092AF555C2160EB70DE488B96

Function 00CBE20E Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBE2A0
_free.LIBCMT ref: 00CBE2C6
_free.LIBCMT ref: 00CBE2EF
_free.LIBCMT ref: 00CBE327
_free.LIBCMT ref: 00CBE358
_free.LIBCMT ref: 00CBE399
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00CBE41A
_free.LIBCMT ref: 00CBE433
_wcschr.LIBVCRUNTIME ref: 00CBE470
_free.LIBCMT ref: 00CBE4DC
_free.LIBCMT ref: 00CBE502
_free.LIBCMT ref: 00CBE52B
_free.LIBCMT ref: 00CBE560
_free.LIBCMT ref: 00CBE591
_free.LIBCMT ref: 00CBE5D2
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CBE657
_free.LIBCMT ref: 00CBE670

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: be32f858d8eb214b60ee682728abbd06ff07f2e20108ed0ea4f020314fc3ebbd
Instruction ID: 593da3aacb8620ac68599952a4c9023f47ab76f719f59949b6dce2dd93303c53
Opcode Fuzzy Hash: be32f858d8eb214b60ee682728abbd06ff07f2e20108ed0ea4f020314fc3ebbd
Instruction Fuzzy Hash: A8D13A72900714AFDF31AFB4DC817EE7BA89F01B24F08416DF915AB281EB359E059B91

Function 00C83E37 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00C83E86
LoadLibraryA.KERNEL32(?), ref: 00C83EC8
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00C83EE8
FreeLibrary.KERNEL32(00000000), ref: 00C83EEF
LoadLibraryA.KERNEL32(?), ref: 00C83F27
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00C83F39
FreeLibrary.KERNEL32(00000000), ref: 00C83F40
GetProcAddress.KERNEL32(00000000,?), ref: 00C83F4F
FreeLibrary.KERNEL32(00000000), ref: 00C83F66

Strings

getnameinfo, xrefs: 00C83E53
getaddrinfo, xrefs: 00C83E44, 00C83EE2, 00C83F33
\ws2_32, xrefs: 00C83EB0
\wship6, xrefs: 00C83F0F
freeaddrinfo, xrefs: 00C83E63

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-744132762
Opcode ID: 2fa7498c0a122c34158a29e4487c8d9f97a36d0793ddc94d86aec4e62374565f
Instruction ID: 8a866d73ae562fbb0c8b7a2a4f934c0992135361a66c21c2155bd8b86cf3d7b5
Opcode Fuzzy Hash: 2fa7498c0a122c34158a29e4487c8d9f97a36d0793ddc94d86aec4e62374565f
Instruction Fuzzy Hash: 7431E5B1905395ABC720AB64DC84E9FB7ECEF44B48F410A69FA5493240D774DF008BEA

Function 00C8B824 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 00C8B846
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00C8B88A
RegCloseKey.ADVAPI32(?), ref: 00C8BB54

Strings

InstallDate, xrefs: 00C8B925
DisplayName, xrefs: 00C8B8D1
UninstallString, xrefs: 00C8B939
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00C8B83C
Publisher, xrefs: 00C8B8E6
DisplayVersion, xrefs: 00C8B8FD
InstallLocation, xrefs: 00C8B911

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: 0d33a76dcbe86a36e712e79c3df1b67964a839af455b3574a10e23e7c73e04f1
Instruction ID: 9d89d09acf7b642d25123a8e0ff04844e301c4651ceee1909d2c6c0c1e0caa5d
Opcode Fuzzy Hash: 0d33a76dcbe86a36e712e79c3df1b67964a839af455b3574a10e23e7c73e04f1
Instruction Fuzzy Hash: B0814F311082459BD334EB14D855EEFB7E8EF94314F50892EF98A82195EF30AA49EB52

Function 00C8CA9E Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 00C8CAE9
GetCursorPos.USER32(?), ref: 00C8CAF8
SetForegroundWindow.USER32(?), ref: 00C8CB01
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 00C8CB1B
Shell_NotifyIconA.SHELL32(00000002,00CE3B50), ref: 00C8CB6C
ExitProcess.KERNEL32 ref: 00C8CB74
CreatePopupMenu.USER32 ref: 00C8CB7A
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 00C8CB8F

Strings

Close, xrefs: 00C8CB80

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: 7c242eaa466733c68ea879784931a1c7a2a791e39bdb33ae7b442be6a7ac446f
Instruction ID: 092558bd28de633e63f4bf332ad815306aaea450db8ade3e383c36cf33bc458c
Opcode Fuzzy Hash: 7c242eaa466733c68ea879784931a1c7a2a791e39bdb33ae7b442be6a7ac446f
Instruction Fuzzy Hash: AD211D31144189FFDB095FA5ED8EFBD3E65EB04705F044264F91295070D7B1AA50AF24

Function 00CB4F3D Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB4FAD
_free.LIBCMT ref: 00CB4FC3
_free.LIBCMT ref: 00CB4FD4
_free.LIBCMT ref: 00CB4FE5
_free.LIBCMT ref: 00CB4FFC
GetCPInfo.KERNEL32(?,?), ref: 00CB5044

Part of subcall function 00CC1C1B: _free.LIBCMT ref: 00CC1C86

_free.LIBCMT ref: 00CB51F0
_free.LIBCMT ref: 00CB5203
_free.LIBCMT ref: 00CB5211
_free.LIBCMT ref: 00CB521C
_free.LIBCMT ref: 00CB525E
_free.LIBCMT ref: 00CB5266
_free.LIBCMT ref: 00CB526E
_free.LIBCMT ref: 00CB5276
_free.LIBCMT ref: 00CB5284

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 5a4b03580376cf3a2eb9b79490d5c3fbdeec25814ee3e6ee7a4fb899c6d80f45
Instruction ID: f06d8aff8a004ebc608748f08096031026802c3be5b2402f52da557becaa6132
Opcode Fuzzy Hash: 5a4b03580376cf3a2eb9b79490d5c3fbdeec25814ee3e6ee7a4fb899c6d80f45
Instruction Fuzzy Hash: 52B1AF71900605AFDF20DFA8C881BEEBBF4BF09304F144069F9A9B7242DB759945DB60

Function 00CC006D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00CC00B1

Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF300
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF312
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF324
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF336
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF348
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF35A
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF36C
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF37E
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF390
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF3A2
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF3B4
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF3C6
Part of subcall function 00CBF2E3: _free.LIBCMT ref: 00CBF3D8

_free.LIBCMT ref: 00CC00A6

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CC00C8
_free.LIBCMT ref: 00CC00DD
_free.LIBCMT ref: 00CC00E8
_free.LIBCMT ref: 00CC010A
_free.LIBCMT ref: 00CC011D
_free.LIBCMT ref: 00CC012B
_free.LIBCMT ref: 00CC0136
_free.LIBCMT ref: 00CC016E
_free.LIBCMT ref: 00CC0175
_free.LIBCMT ref: 00CC0192
_free.LIBCMT ref: 00CC01AA

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2aae5990d015d73c291d995876a97e624d9aa81e62dfe42cf0d64f2cd7fa9095
Instruction ID: a2d838bdc08215482fb19b94cbf6664f3dc4054725e48824a044b7300a6f733c
Opcode Fuzzy Hash: 2aae5990d015d73c291d995876a97e624d9aa81e62dfe42cf0d64f2cd7fa9095
Instruction Fuzzy Hash: AC314D31600701EFDB21AA39DC45F9AB3E9AF00754F29842DF4A9E7151DF35AE94EB20

Function 00C77DEF Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 325fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00C77F4C
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00C77FC2
__aulldiv.LIBCMT ref: 00C77FE9
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00C7810D
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00C78128
CloseHandle.KERNEL32(00000000), ref: 00C78200
CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 00C7821A
CloseHandle.KERNEL32(00000000), ref: 00C78256

Strings

ReadFile error, xrefs: 00C7822E
Uploading file to Controller: , xrefs: 00C78077
SetFilePointerEx error, xrefs: 00C78266

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller:
API String ID: 1884690901-2596673759
Opcode ID: f78d3663daead44df13ddb629a81a9908221aedf93555e5bd9181fcded2ee4bb
Instruction ID: caf782bb6edd76b5e1d675435ea08a45dcf11a2ea08e9d38a0fd3262ddf719a2
Opcode Fuzzy Hash: f78d3663daead44df13ddb629a81a9908221aedf93555e5bd9181fcded2ee4bb
Instruction Fuzzy Hash: C0B19F316083409FD618FB64C896B6FB7E9AFC4710F40891DF88D52292EF349949DB97

Function 00CBF3E1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBF429
_free.LIBCMT ref: 00CBF44D
_free.LIBCMT ref: 00CBF45A
_free.LIBCMT ref: 00CBF47F
_free.LIBCMT ref: 00CBF48C
_free.LIBCMT ref: 00CBF495
_free.LIBCMT ref: 00CBF773
_free.LIBCMT ref: 00CBF77B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c9c941a49499e6e20185a684b50d3c8dc45aed449a6822b952d6a3dc801ef390
Instruction ID: f1a325c9f8a69020b7a7d867336ad13e04fc240f43cda334417e21839fe48232
Opcode Fuzzy Hash: c9c941a49499e6e20185a684b50d3c8dc45aed449a6822b952d6a3dc801ef390
Instruction Fuzzy Hash: 69C13372D40205AFEB20DBA8CC42FEE77F8AB19710F144169FE04FB282D6709E419B64

Function 00C747EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C747FD
SetEvent.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74808
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74811
closesocket.WS2_32(000000FF), ref: 00C7481F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74856
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00C74867
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C7486E
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C74880
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C74885
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C7488A
SetEvent.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C74895
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00C74B8E,?,?,?,00C74B26), ref: 00C7489A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID:
API String ID: 3658366068-0
Opcode ID: ecdde268955636ddf46a110a59ba85b8b314e827159f5e1b6f7ac25cedf8a03d
Instruction ID: 9774ad41022acf7daa0a83bd420ffb3a4ea76793d581f8584dd09e494754e083
Opcode Fuzzy Hash: ecdde268955636ddf46a110a59ba85b8b314e827159f5e1b6f7ac25cedf8a03d
Instruction Fuzzy Hash: 5A212931104B149FCA256B26DC49A1ABBE1EF40325B108B2DE1F642AF1CB72A851EF44

Function 00C81C81 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 479sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00C81C9A

Part of subcall function 00C8AB38: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00CD5900,00C7C07B,.vbs,?,?,?,?,?,00CE42F8), ref: 00C8AB5F

Part of subcall function 00C876B6: CloseHandle.KERNEL32(00C73AB9,?,?,00C73AB9,00CD5324), ref: 00C876CC
Part of subcall function 00C876B6: CloseHandle.KERNEL32(00CD5324,?,?,00C73AB9,00CD5324), ref: 00C876D5

Sleep.KERNEL32(0000000A,00CD5324), ref: 00C81DEC
Sleep.KERNEL32(0000000A,00CD5324,00CD5324), ref: 00C81E8E
Sleep.KERNEL32(0000000A,00CD5324,00CD5324,00CD5324), ref: 00C81F30
DeleteFileW.KERNEL32(00000000,00CD5324,00CD5324,00CD5324), ref: 00C81F91
DeleteFileW.KERNEL32(00000000,00CD5324,00CD5324,00CD5324), ref: 00C81FC8
DeleteFileW.KERNEL32(00000000,00CD5324,00CD5324,00CD5324), ref: 00C82004
Sleep.KERNEL32(000001F4,00CD5324,00CD5324,00CD5324), ref: 00C8201E
Sleep.KERNEL32(00000064), ref: 00C82060

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Strings

/stext ", xrefs: 00C81D77, 00C81E19, 00C81EBB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "
API String ID: 1223786279-3856184850
Opcode ID: bc1945e688aa07f128af02cb5da448500642561c2a12ae51019b23961c4f7406
Instruction ID: a8fb99cd95b0d21e262b6a51960d8507262e41fc90695e687374294dfa26b484
Opcode Fuzzy Hash: bc1945e688aa07f128af02cb5da448500642561c2a12ae51019b23961c4f7406
Instruction Fuzzy Hash: EF0241315083818BD328FB64D8A5AEFB3D5AFE0710F54892DF88E42192EF309A4DD756

Function 00CC4982 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CC4650: CreateFileW.KERNEL32(00000000,00000000,?,00CC4A2B,?,?,00000000,?,00CC4A2B,00000000,0000000C), ref: 00CC466D

GetLastError.KERNEL32 ref: 00CC4A96
__dosmaperr.LIBCMT ref: 00CC4A9D
GetFileType.KERNEL32(00000000), ref: 00CC4AA9
GetLastError.KERNEL32 ref: 00CC4AB3
__dosmaperr.LIBCMT ref: 00CC4ABC
CloseHandle.KERNEL32(00000000), ref: 00CC4ADC
CloseHandle.KERNEL32(?), ref: 00CC4C26
GetLastError.KERNEL32 ref: 00CC4C58
__dosmaperr.LIBCMT ref: 00CC4C5F

Strings

H, xrefs: 00CC4BE4

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 5c42e7af87dac217429057e0232bd45aca6ce2433e96c1110f3622d70372b6d9
Instruction ID: 8ba26753326421b041d6b64312b5b4eb0326aafa09f26ce42185896a324beb5a
Opcode Fuzzy Hash: 5c42e7af87dac217429057e0232bd45aca6ce2433e96c1110f3622d70372b6d9
Instruction Fuzzy Hash: 84A1F332A145548FDF1D9F68D8A2BAE7BB0EB06320F18425DF8219F3A1DA318D52DB51

Function 00C83C67 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

65535, xrefs: 00C83C6A
udp, xrefs: 00C83D17, 00C83D1F, 00C83D23

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: fe792295f6bc0582348b146f1d84a81a5358b2969f9c2ea76db549f4a35c5596
Instruction ID: 93fb3059c75570d530e12294c70f9f4052da6808621f7c94486ab7fa04477dfc
Opcode Fuzzy Hash: fe792295f6bc0582348b146f1d84a81a5358b2969f9c2ea76db549f4a35c5596
Instruction Fuzzy Hash: 4841E871605381ABD720BB29DD05B2B77D8EF44F48F04292EF8A197290D765CF409B6E

Function 00C7C66D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 00C81699: TerminateProcess.KERNEL32(00000000,pth_unenc,00C7E670), ref: 00C816A9
Part of subcall function 00C81699: WaitForSingleObject.KERNEL32(000000FF), ref: 00C816BC

Part of subcall function 00C8265D: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00CE42F8), ref: 00C82679
Part of subcall function 00C8265D: RegQueryValueExA.KERNELBASE(00000000,00000000,00000000,00000000,00000208,?), ref: 00C82692
Part of subcall function 00C8265D: RegCloseKey.KERNELBASE(00000000), ref: 00C8269D

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 00C7C6C7
ShellExecuteW.SHELL32(00000000,open,00000000,00CD5900,00CD5900,00000000), ref: 00C7C826
ExitProcess.KERNEL32 ref: 00C7C832

Strings

""", 0, xrefs: 00C7C74F
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 00C7C767
exepath, xrefs: 00C7C69F
.vbs, xrefs: 00C7C6CD
open, xrefs: 00C7C820
Temp, xrefs: 00C7C708
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 00C7C7D5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-2411266221
Opcode ID: a69eb8a23965363c9de6877a293a85752a4e5bfc85ce20c107aa675d62b55acf
Instruction ID: 313cf9dcce546fe0a03cbaf87f0453832ac4e818cd61674587ff3047634f726c
Opcode Fuzzy Hash: a69eb8a23965363c9de6877a293a85752a4e5bfc85ce20c107aa675d62b55acf
Instruction Fuzzy Hash: A9414F329001185BDB18F764DC96DFE7779AF60710F44817AF90AA3192EF306E86EB91

Function 00CA9361 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00C71AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00CA93B9
GetLastError.KERNEL32(?,?,00C71AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00CA93C6
__dosmaperr.LIBCMT ref: 00CA93CD
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00C71AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00CA93F9
GetLastError.KERNEL32(?,?,?,00C71AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00CA9403
__dosmaperr.LIBCMT ref: 00CA940A
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00C71AD8,?), ref: 00CA944D
GetLastError.KERNEL32(?,?,?,?,?,?,00C71AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00CA9457
__dosmaperr.LIBCMT ref: 00CA945E
_free.LIBCMT ref: 00CA946A
_free.LIBCMT ref: 00CA9471

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: c069a15075eb8315f091a5d7a6b65c1083386687ffa2c4f5dfe9fcf43206562e
Instruction ID: f38766f7cfde786f17811b4a23b68c972713f4656173224fb946e22019e938c8
Opcode Fuzzy Hash: c069a15075eb8315f091a5d7a6b65c1083386687ffa2c4f5dfe9fcf43206562e
Instruction Fuzzy Hash: 023185B140410ABBDF11AFA5CC46EEE7B78EF06368F144159F920562A1DB358D11EB61

Function 00C74E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00C74E71
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00C74F21
TranslateMessage.USER32(?), ref: 00C74F30
DispatchMessageA.USER32(?), ref: 00C74F3B
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00CE3F80), ref: 00C74FF3
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00C7502B

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Strings

CloseChat, xrefs: 00C74FBB
GetMessage, xrefs: 00C74FAA
DisplayMessage, xrefs: 00C74F9E

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: da8ec65e062ae08f82c3bce55b181387443535c23a3944a69fbb4755ae181193
Instruction ID: 915ad6ccfecd2c5696180928fccb66abb7f20866e2ad8f3c0c53b95259c40aaa
Opcode Fuzzy Hash: da8ec65e062ae08f82c3bce55b181387443535c23a3944a69fbb4755ae181193
Instruction Fuzzy Hash: 7C41C4726043409BCB14FBB8DC5AE6E77A9AB81710F048A1DFD1987191EF34DA04E752

Function 00C89C85 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89C94
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89CAB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89CB8
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89CC7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89CD8
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C895F8,00000000,00000000), ref: 00C89CDB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 2befdf50d16c3a9830da0bbee8b9afda35b8d9bcca1d7a5a84826531859418c4
Instruction ID: b83074dda2cd7cda388493281bed532bc36f9fe0e7d3c8830750390b628237cf
Opcode Fuzzy Hash: 2befdf50d16c3a9830da0bbee8b9afda35b8d9bcca1d7a5a84826531859418c4
Instruction Fuzzy Hash: 8711A532A01118AFD7116B65DC89FFF3BBCEB457A4B140116F916D2180DB648D06AFB1

Function 00CB6DCB Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB6DDF

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CB6DEB
_free.LIBCMT ref: 00CB6DF6
_free.LIBCMT ref: 00CB6E01
_free.LIBCMT ref: 00CB6E0C
_free.LIBCMT ref: 00CB6E17
_free.LIBCMT ref: 00CB6E22
_free.LIBCMT ref: 00CB6E2D
_free.LIBCMT ref: 00CB6E38
_free.LIBCMT ref: 00CB6E46

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b004990fbdd1b110696e9373d49494ae8cfd650a6beade0db05820535127fc70
Instruction ID: 0559bfb66256f6985b2fffc3a641a7e78785a7eac943e1d5a1ebedab9ec44667
Opcode Fuzzy Hash: b004990fbdd1b110696e9373d49494ae8cfd650a6beade0db05820535127fc70
Instruction Fuzzy Hash: CC116076500108AFCF01EF94CC42CD93BA9EF04754F55C4A5BA099F622DB35EA64BF80

Function 00C89128 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00C8912D
GdiplusStartup.GDIPLUS(00CE3AF0,?,00000000), ref: 00C8915F
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 00C891EB
Sleep.KERNEL32(000003E8), ref: 00C8926D
GetLocalTime.KERNEL32(?), ref: 00C8927C
Sleep.KERNEL32(00000000,00000018,00000000), ref: 00C89365

Strings

wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 00C8920E, 00C89229, 00C892A0
time_%04i%02i%02i_%02i%02i%02i, xrefs: 00C89213

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i
API String ID: 489098229-3790400642
Opcode ID: edb98a31c862c2ee5bc616b6925935f91b34135dfbcc3400b2323c8da4b90352
Instruction ID: b1ef6597c066cba5495030288524ec4276d832b6ec4cd1e9a8acdfc73b9faa40
Opcode Fuzzy Hash: edb98a31c862c2ee5bc616b6925935f91b34135dfbcc3400b2323c8da4b90352
Instruction Fuzzy Hash: FF51B071E002949ACF14FBB8CC5AAFE7BB9AB51304F484069F84AA7192EF344E45E751

Function 00CC5139 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00CC5DAF), ref: 00CC515C

Strings

exp, xrefs: 00CC5221, 00CC5283
asin, xrefs: 00CC52C8
pow, xrefs: 00CC5240, 00CC52EC, 00CC52FF
acos, xrefs: 00CC52D4
log10, xrefs: 00CC51A6, 00CC51F6
log, xrefs: 00CC5202, 00CC520E
sqrt, xrefs: 00CC52E0

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: cbf690dfd90a2697b4f0e939e390341ac5453b3e8a9b2a862d2b3a8cacdce6a2
Instruction ID: df45a42d516ec61274a6b37de4989fb12b434173bafb5e9ec1028154473d7f7b
Opcode Fuzzy Hash: cbf690dfd90a2697b4f0e939e390341ac5453b3e8a9b2a862d2b3a8cacdce6a2
Instruction Fuzzy Hash: F6517EB1900D49CBCF14DF59D94CBACBBB4FB49340F28028DD451AB264CB75AAA4CB18

Function 00C865FC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00C8665C

Part of subcall function 00C8B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633

Sleep.KERNEL32(00000064), ref: 00C86688
DeleteFileW.KERNEL32(00000000), ref: 00C866BC

Strings

temp, xrefs: 00C8660C
/t , xrefs: 00C8663B
open, xrefs: 00C86656
dxdiag, xrefs: 00C86651
\sysinfo.txt, xrefs: 00C86607

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: e3d13a1f1b0089b7ab78419c977fa7ba06bd1c5c132dc4568a818a3d780cea81
Instruction ID: 82daf44b9993252e927439ae1681e7a28161f5587f061c71b1c9fe627e515a76
Opcode Fuzzy Hash: e3d13a1f1b0089b7ab78419c977fa7ba06bd1c5c132dc4568a818a3d780cea81
Instruction Fuzzy Hash: A33165319001199BDB18FBA4DCA6EFE7778AF10714F048129F90A631D2EF305E8ADB94

Function 00C76616 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00CE4A28,00000000,00CE42E0,00003000,00000004,00000000,00000001), ref: 00C76647
GetCurrentProcess.KERNEL32(00CE4A28,00000000,00008000,?,00000000,00000001,00000000,00C768BB,C:\Users\user\Desktop\SHROsQyiAd.exe), ref: 00C76705

Strings

[-] NtAllocateVirtualMemory Error, xrefs: 00C766AA
explorer.exe, xrefs: 00C766BD, 00C766E2
PEB: %x, xrefs: 00C76716
\explorer.exe, xrefs: 00C7666A
windir, xrefs: 00C76654
[+] NtAllocateVirtualMemory Success, xrefs: 00C7667A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: a5c53be15534cb58bba4c88bb53513bc899c6ac323e3ce6b90b5cb3e022e1e00
Instruction ID: 584e08e2369bd77cd5a9c31987bca5060ed868704c582a81fa0256ccd0375db4
Opcode Fuzzy Hash: a5c53be15534cb58bba4c88bb53513bc899c6ac323e3ce6b90b5cb3e022e1e00
Instruction Fuzzy Hash: B53109B1650B40AFD300EFB5DC86F5E77B8FB04766F518529F5058B261EB70D800AB68

Function 00C8C96F Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00C8C988

Part of subcall function 00C8CA1F: RegisterClassExA.USER32(00000030), ref: 00C8CA6C
Part of subcall function 00C8CA1F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 00C8CA87
Part of subcall function 00C8CA1F: GetLastError.KERNEL32 ref: 00C8CA91

ExtractIconA.SHELL32(00000000,?,00000000), ref: 00C8C9BF
lstrcpynA.KERNEL32(00CE3B68,Remcos,00000080), ref: 00C8C9D9
Shell_NotifyIconA.SHELL32(00000000,00CE3B50), ref: 00C8C9EF
TranslateMessage.USER32(?), ref: 00C8C9FB
DispatchMessageA.USER32(?), ref: 00C8CA05
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00C8CA12

Strings

Remcos, xrefs: 00C8C9CA

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: 3de97cb023bc3d941783a31e8fd3aeb98f91f40d3eabe58296e7216787ca8357
Instruction ID: 2059999bc9e55fecc4fb47f1ab869d3b1b0921164b8c90624be03e3a676709f0
Opcode Fuzzy Hash: 3de97cb023bc3d941783a31e8fd3aeb98f91f40d3eabe58296e7216787ca8357
Instruction Fuzzy Hash: 9F012DB19042C8ABD7109FA6EC8CFAE7BBDEB85B04F004155F602D70A0D7B8A245DF24

Function 00CBB450 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4fbb3c880a245afd3f765ad9e59b1809990bac7fa8e020243db4a78b47e5230
Instruction ID: 46cf52fc9ac67c25d2c1abde7a3740c8a71c5271eb2bc682baa31d34b0fbcf12
Opcode Fuzzy Hash: a4fbb3c880a245afd3f765ad9e59b1809990bac7fa8e020243db4a78b47e5230
Instruction Fuzzy Hash: 07C1A370D042899FDF15DFA9C841BEDBBB4AF4A310F184159E424AB392CBB49E45CB71

Function 00CC2B2A Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00CC2E03,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00CC2BD6
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00CC2E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00CC2C59
__alloca_probe_16.LIBCMT ref: 00CC2C91
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00CC2E03,?,00CC2E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00CC2CEC
__alloca_probe_16.LIBCMT ref: 00CC2D3B
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00CC2E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00CC2D03

Part of subcall function 00CB6AFF: HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00CC2E03,00000000,00000000,?,00000001,?,?,?,?), ref: 00CC2D7F
__freea.LIBCMT ref: 00CC2DAA
__freea.LIBCMT ref: 00CC2DB6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocHeapInfo
String ID:
API String ID: 3256262068-0
Opcode ID: 91ad4cf650c70fef3d82a2aa55be39563b6eacf0a57a2db8e802cc81dae86767
Instruction ID: 42c4b05dd046d359f5d067cb8ce3bc93cfa3f1b0896e4664608bbb5902d8e9ca
Opcode Fuzzy Hash: 91ad4cf650c70fef3d82a2aa55be39563b6eacf0a57a2db8e802cc81dae86767
Instruction Fuzzy Hash: 9391C172E102169BDF248E64C8A1FEEBBB5EF19710F14065DE816E7281DB35DD80CBA0

Function 00CB43F9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6EBF: GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
Part of subcall function 00CB6EBF: _free.LIBCMT ref: 00CB6EF6
Part of subcall function 00CB6EBF: SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
Part of subcall function 00CB6EBF: _abort.LIBCMT ref: 00CB6F3D

_memcmp.LIBVCRUNTIME ref: 00CB46A3
_free.LIBCMT ref: 00CB4714
_free.LIBCMT ref: 00CB472D
_free.LIBCMT ref: 00CB475F
_free.LIBCMT ref: 00CB4768
_free.LIBCMT ref: 00CB4774

Strings

C, xrefs: 00CB4561

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 0d4a6412681c5f7cfd8b49ea717d4cba29a427daa29c85de4c49d61439140773
Instruction ID: 8ba5ebd64dea392b07457a1d045514a82f031887196c8aff1b690396489e8903
Opcode Fuzzy Hash: 0d4a6412681c5f7cfd8b49ea717d4cba29a427daa29c85de4c49d61439140773
Instruction Fuzzy Hash: 62B13A75A052299FDB28DF18C884BEDB7B4FF08304F1485AAE959A7351D731AE90CF40

Function 00C839C7 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

tcp, xrefs: 00C83B2B
udp, xrefs: 00C83B01

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: e5c7bb08fe22a728f569a9fbb5abf5dd1d5c6ae02e6a06a11b8e848e75b7666f
Instruction ID: 2f2f7508d6841f47fe89c7e08b2b2f3ba46bb43459c1e56c2fbcc42da4ae9e39
Opcode Fuzzy Hash: e5c7bb08fe22a728f569a9fbb5abf5dd1d5c6ae02e6a06a11b8e848e75b7666f
Instruction Fuzzy Hash: D671BF706083928FDB28EF55C44463BBAE4AF84B48F00152EF8A597251D774CF04DB9A

Function 00C80314 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 192COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00C80333
inet_ntoa.WS2_32(?), ref: 00C803CE

Strings

StopForward, xrefs: 00C804AF
GetDirectListeningPort, xrefs: 00C804D1
StartReverse, xrefs: 00C8049E
StopReverse, xrefs: 00C804C0
StartForward, xrefs: 00C80492

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse
API String ID: 3578746661-168337528
Opcode ID: 108b114f3f16223662d85a571bdfeba229534fa9b00b8a326fb82d56e910b41b
Instruction ID: a8b7bdcda1754a0c21f6c029866d9c55265456bfa8371c3a4777273337d41d7f
Opcode Fuzzy Hash: 108b114f3f16223662d85a571bdfeba229534fa9b00b8a326fb82d56e910b41b
Instruction Fuzzy Hash: 9D51F771A043409BCB55F778DC5AB6E36A5AF80704F58451AFC198B2D2DF309E08EB96

Function 00C86E27 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 107filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00CD5554), ref: 00C86F24
CloseHandle.KERNEL32(00000000), ref: 00C86F2D
DeleteFileA.KERNEL32(00000000), ref: 00C86F3C
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00C86EF0

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Strings

<, xrefs: 00C86ECB
@, xrefs: 00C86ED2
Temp, xrefs: 00C86E48

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
String ID: <$@$Temp
API String ID: 1107811701-1032778388
Opcode ID: 72352168dd7eb869ccdc1023fa77dda56aed71918de299372c9d092a2800443a
Instruction ID: 6a17cf8dc9c407b07e4bcf74e76ec5110ab6d64395561a8b24ea464acddab9db
Opcode Fuzzy Hash: 72352168dd7eb869ccdc1023fa77dda56aed71918de299372c9d092a2800443a
Instruction Fuzzy Hash: 7F31AD329002099BDB04FBA4DC56FFE7739AF50304F048268F90A660E1EF345E89DB90

Function 00C76BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00CD5454,?,?,00000000,00C77273,00000000,?,0000000A,00000000), ref: 00C76C38
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00C77273,00000000,?,0000000A,00000000), ref: 00C76C80

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

CloseHandle.KERNEL32(00000000,?,?,00000000,00C77273,00000000,?,0000000A,00000000,00000000), ref: 00C76CC0
MoveFileW.KERNEL32(00000000,00000000), ref: 00C76CDD
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00C76D08
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00C76D18

Part of subcall function 00C7455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,00C7460E,00000000,?,?), ref: 00C7456A
Part of subcall function 00C7455B: SetEvent.KERNEL32(?,?,?,00C7460E,00000000,?,?), ref: 00C74588

Strings

.part, xrefs: 00C76C0F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: e5e0c2d6218469e0f1877286533c795d8dffbe6569afb659bdc67d6afc4ecf81
Instruction ID: bf830084e67f6cda6e0b5be0178b3f7896a02da50b0a1a5255fb7a3f0e4e282a
Opcode Fuzzy Hash: e5e0c2d6218469e0f1877286533c795d8dffbe6569afb659bdc67d6afc4ecf81
Instruction Fuzzy Hash: 9931A0715083419FC310EF24DD49EAFB7A8FB84751F048A2EF9D992151DB30AE489B92

Function 00CB9950 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00CAD564,00CAD564,?,?,?,00CB9BA1,00000001,00000001,1AE85006), ref: 00CB99AA
__alloca_probe_16.LIBCMT ref: 00CB99E2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00CB9BA1,00000001,00000001,1AE85006,?,?,?), ref: 00CB9A30
__alloca_probe_16.LIBCMT ref: 00CB9AC7
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,1AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CB9B2A
__freea.LIBCMT ref: 00CB9B37

Part of subcall function 00CB6AFF: HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

__freea.LIBCMT ref: 00CB9B40
__freea.LIBCMT ref: 00CB9B65

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: 9b692909e8b7b5d7d8ac994ae05c342d5213bfde12afb57d9ef43bff90889f76
Instruction ID: 41e1c12650d8266c2a32beab8bef3ae92501a2284b120dd55281c95ab97c255c
Opcode Fuzzy Hash: 9b692909e8b7b5d7d8ac994ae05c342d5213bfde12afb57d9ef43bff90889f76
Instruction Fuzzy Hash: A151E072A10216AFEF258F64DC81FEB77AAEB80750F144628FE25E6150EB34DD40A660

Function 00C88ABE Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00C88B08
SendInput.USER32(00000001,?,0000001C), ref: 00C88B30
SendInput.USER32(00000001,0000001C,0000001C), ref: 00C88B57
SendInput.USER32(00000001,0000001C,0000001C), ref: 00C88B75
SendInput.USER32(00000001,0000001C,0000001C), ref: 00C88B95
SendInput.USER32(00000001,0000001C,0000001C), ref: 00C88BBA
SendInput.USER32(00000001,0000001C,0000001C), ref: 00C88BDC
SendInput.USER32(00000001,?,0000001C), ref: 00C88BFF

Part of subcall function 00C88AB1: MapVirtualKeyA.USER32(00000000,00000000), ref: 00C88AB7

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: InputSend$Virtual
String ID:
API String ID: 1167301434-0
Opcode ID: afc30ca0df7af9c6c22e606aa4863c4f3b8a38dbbf00d233c418ac7c00807d34
Instruction ID: b67a87ea2a2b97917a4f7521f1143e6de236d48c7b2e4d21885f9619ee008a00
Opcode Fuzzy Hash: afc30ca0df7af9c6c22e606aa4863c4f3b8a38dbbf00d233c418ac7c00807d34
Instruction Fuzzy Hash: 20319371248345AAE210EF65DC41F9FFBECAFC5B44F44080FB58497191DAA0894C97AB

Function 00C85A45 Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C85A46
EmptyClipboard.USER32 ref: 00C85A54
CloseClipboard.USER32 ref: 00C85A5A
OpenClipboard.USER32 ref: 00C85A61
GetClipboardData.USER32(0000000D), ref: 00C85A71
GlobalLock.KERNEL32(00000000), ref: 00C85A7A
GlobalUnlock.KERNEL32(00000000), ref: 00C85A83
CloseClipboard.USER32 ref: 00C85A89

Part of subcall function 00C74468: send.WS2_32(?,00000000,00000000,00000000), ref: 00C744FD

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID:
API String ID: 2172192267-0
Opcode ID: f8f5479e3649c31baa789c35161a9cbe612c69202720cde9d74c2ec494533599
Instruction ID: d8537429d2cda9c097c7826b8b56a4436ded42cb74d53762e62ea8ea8320f510
Opcode Fuzzy Hash: f8f5479e3649c31baa789c35161a9cbe612c69202720cde9d74c2ec494533599
Instruction Fuzzy Hash: E30171322082409FC714BBB5EC5AFAE77A9EF90711F48462EFD1A82171DF308945AB52

Function 00CB7E3A Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB7EBC
_free.LIBCMT ref: 00CB7EE0
_free.LIBCMT ref: 00CB8067
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00CCD478), ref: 00CB8079
WideCharToMultiByte.KERNEL32(00000000,00000000,00CE179C,000000FF,00000000,0000003F,00000000,?,?), ref: 00CB80F1
WideCharToMultiByte.KERNEL32(00000000,00000000,00CE17F0,000000FF,?,0000003F,00000000,?), ref: 00CB811E
_free.LIBCMT ref: 00CB8233

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 9deccb9b1f5fe9ba23ac6282c96debc3c36d7c07250278f6f9eb504547feae01
Instruction ID: 24952d0082e07ed978a93e58e02c4e8ff8ef3230c1d176b0fe2105442a290ae0
Opcode Fuzzy Hash: 9deccb9b1f5fe9ba23ac6282c96debc3c36d7c07250278f6f9eb504547feae01
Instruction Fuzzy Hash: CBC10771908245ABCB209F68DC41BFE7BBDEF81750F28429AEC549B291EB308F46D750

Function 00CBF806 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBF875
_free.LIBCMT ref: 00CBF883
_free.LIBCMT ref: 00CBF9B1
_free.LIBCMT ref: 00CBF9BC

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 09e1fc9560ab1c049b0fac3ba22c7dda4eac10fa2d24d396eedf65db06626a8f
Instruction ID: 8f04cd7a34d2a1cf4ecd9bca5068c06bc77aef68227967412e1d8cc30cbe1d17
Opcode Fuzzy Hash: 09e1fc9560ab1c049b0fac3ba22c7dda4eac10fa2d24d396eedf65db06626a8f
Instruction Fuzzy Hash: 5A617D71D00205AFDB20DF69CC41BDEBBB5AB45720F24417AE954EB391D7709A42AB90

Function 00CBA0C3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00CBA838,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 00CBA105
__fassign.LIBCMT ref: 00CBA180
__fassign.LIBCMT ref: 00CBA19B
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 00CBA1C1
WriteFile.KERNEL32(?,FF8BC35D,00000000,00CBA838,00000000,?,?,?,?,?,?,?,?,?,00CBA838,?), ref: 00CBA1E0
WriteFile.KERNEL32(?,?,00000001,00CBA838,00000000,?,?,?,?,?,?,?,?,?,00CBA838,?), ref: 00CBA219

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4a516627c2b9b9ab52c252f89ccdf2e3596a02c182a2b4d933eefd21d888e992
Instruction ID: a66cbb2e5cbc24ef13446f4f4778368093b9dd2a904e246994962fc26346ce6c
Opcode Fuzzy Hash: 4a516627c2b9b9ab52c252f89ccdf2e3596a02c182a2b4d933eefd21d888e992
Instruction Fuzzy Hash: 5751A3B1E042499FDB10CFA8DC85BEEBBF8EF09300F14415AE995E7291D7719A41CB62

Function 00CA7A80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00CA7AAB
___except_validate_context_record.LIBVCRUNTIME ref: 00CA7AB3
_ValidateLocalCookies.LIBCMT ref: 00CA7B41
__IsNonwritableInCurrentImage.LIBCMT ref: 00CA7B6C
_ValidateLocalCookies.LIBCMT ref: 00CA7BC1

Strings

csm, xrefs: 00CA7B56

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6d0ed01b1d072be14b920f7b9953d28cbe112458f732701458db94360f30c076
Instruction ID: 88f1ad66cddfe2fc47d76f4c2dfba7d28480a08c8e04b030cf9746c251905fe8
Opcode Fuzzy Hash: 6d0ed01b1d072be14b920f7b9953d28cbe112458f732701458db94360f30c076
Instruction Fuzzy Hash: 8B411470A0420BABCF10DF69DC85A9EBBB5BF4631CF148255E8255B392D731DE51CBA0

Function 00C71A8E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00C71AD3

Part of subcall function 00C71BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00C71C54

waveInUnprepareHeader.WINMM(00CE1AC0,00000020,00000000,?), ref: 00C71B85
waveInPrepareHeader.WINMM(00CE1AC0,00000020), ref: 00C71BC3
waveInAddBuffer.WINMM(00CE1AC0,00000020), ref: 00C71BD2

Strings

%Y-%m-%d %H.%M, xrefs: 00C71AC4
.wav, xrefs: 00C71AEC

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav
API String ID: 3809562944-3597965672
Opcode ID: f2bc6b4f66af0f0597c8f851fae05b678c93d2fdcb960a7bb1208b802ca2d55e
Instruction ID: d345e4f38fd8dc5ae6bd8a874b510f2c8b1661df1e5efe930758ad2247f4156b
Opcode Fuzzy Hash: f2bc6b4f66af0f0597c8f851fae05b678c93d2fdcb960a7bb1208b802ca2d55e
Instruction Fuzzy Hash: 263180715043409FC314EB24DC56FAE7BE4FB54310F48893DF95A861A1EF306A59EB52

Function 00C7B6EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00C82513: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 00C82537
Part of subcall function 00C82513: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 00C82554
Part of subcall function 00C82513: RegCloseKey.KERNELBASE(?), ref: 00C8255F

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 00C7B76C
PathFileExistsA.SHLWAPI(?), ref: 00C7B779

Strings

[IE cookies not found], xrefs: 00C7B741
Cookies, xrefs: 00C7B6FE
[IE cookies cleared!], xrefs: 00C7B7C6, 00C7B7E6
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 00C7B703

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: 9349083361b058e21e5c778a6d9f813ec54883d0f57eb25c14a8e49c0bf0bc1a
Instruction ID: f0f9531633de30685889a2eb69b94a188bc87fd28d6e42c6e0223d2ec0f174bb
Opcode Fuzzy Hash: 9349083361b058e21e5c778a6d9f813ec54883d0f57eb25c14a8e49c0bf0bc1a
Instruction Fuzzy Hash: FC217171940118ABCB04F7F4CC6BEEE7778AF91710F448119FA0A67282EF60AE09D791

Function 00CC5903 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef55f9c4d1566bae83594829fffa64cba2e0fe488cedddc21f35b6335fd58cb
Instruction ID: 4cbbee41248f52ddb2ee02475dd4648c0779ef5b3d9bbc71b09728fccf2fff12
Opcode Fuzzy Hash: 4ef55f9c4d1566bae83594829fffa64cba2e0fe488cedddc21f35b6335fd58cb
Instruction Fuzzy Hash: 24112471908605FBCB202F76CC05FAF7AACEF82370B100298F825C7251DA349841E6A0

Function 00CBFCDB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CBFA22: _free.LIBCMT ref: 00CBFA4B

_free.LIBCMT ref: 00CBFD29

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CBFD34
_free.LIBCMT ref: 00CBFD3F
_free.LIBCMT ref: 00CBFD93
_free.LIBCMT ref: 00CBFD9E
_free.LIBCMT ref: 00CBFDA9
_free.LIBCMT ref: 00CBFDB4

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
Instruction ID: d63b1c313aaca60c239516e5b70d5c67af608ef67317ad94ac601b4c2e87f0a7
Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
Instruction Fuzzy Hash: 52112171651B04BAEA24FBB0CC07FCB77DCAF04700F844C29B29EA6652EB69B5167750

Function 00C76815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\SHROsQyiAd.exe), ref: 00C76835

Part of subcall function 00C76764: _wcslen.LIBCMT ref: 00C76788
Part of subcall function 00C76764: CoGetObject.OLE32(?,00000024,00CD59B0,00000000), ref: 00C767E9

CoUninitialize.OLE32 ref: 00C7688E

Strings

[+] ShellExec success, xrefs: 00C76873
[+] before ShellExec, xrefs: 00C76856
[+] ucmCMLuaUtilShellExecMethod, xrefs: 00C7681A
C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C76815, 00C76818, 00C7686A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\user\Desktop\SHROsQyiAd.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-4010065956
Opcode ID: a237ccb06ae775de343a39d8735a7482bfae6d7b90eba028efb9677d3deeb0ab
Instruction ID: ee45165657831398c4f563285de616c7a379a4e342f584c595e548471712a6aa
Opcode Fuzzy Hash: a237ccb06ae775de343a39d8735a7482bfae6d7b90eba028efb9677d3deeb0ab
Instruction Fuzzy Hash: 84019E72345B116FE228AB21DC0AF7B6798DF41766F20812EF5599A2C1EA91AC005B62

Function 00C7B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 00C7B2E4
GetLastError.KERNEL32 ref: 00C7B2EE

Strings

[Chrome Cookies found, cleared!], xrefs: 00C7B314
UserProfile, xrefs: 00C7B2B4
\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 00C7B2AF
[Chrome Cookies not found], xrefs: 00C7B308

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: d4b6de6b9c4298b88c4cf86386e410c98400070be59d3b0272d39da8401e3080
Instruction ID: b9f836f6522af948fc499db40c9fa84232246605ff09a585c25d74e8f1d8f76a
Opcode Fuzzy Hash: d4b6de6b9c4298b88c4cf86386e410c98400070be59d3b0272d39da8401e3080
Instruction Fuzzy Hash: 370128326405049B8B04BBB8CD6FEBE3728AD21B14B44811AF91A532E2FF119F84E681

Function 00C8BEB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(00CE4358), ref: 00C8BEB9
ShowWindow.USER32(00000000,00000000), ref: 00C8BED2
SetConsoleOutputCP.KERNEL32(000004E4), ref: 00C8BEF7

Strings

5.3.0 Pro, xrefs: 00C8BF20
Remcos v, xrefs: 00C8BF12
CONOUT$, xrefs: 00C8BEE5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Console$AllocOutputShowWindow
String ID: Remcos v$5.3.0 Pro$CONOUT$
API String ID: 2425139147-2527699604
Opcode ID: f67afaca5a3101c94f35ed58a89cbce47a222bb6d498d4e890d5a11a5a65e7b2
Instruction ID: 259e82ec438bff63ec9bd344a8ef1618d3b926827b8dfa7ab7e061e2bffab67c
Opcode Fuzzy Hash: f67afaca5a3101c94f35ed58a89cbce47a222bb6d498d4e890d5a11a5a65e7b2
Instruction Fuzzy Hash: 960162B1990349BFDA00FBF18D4BFDE37AC9B14B04F540422B714A71D2DBA5EA049B25

Function 00C89F32 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 00C89F64
PlaySoundW.WINMM(00000000,00000000), ref: 00C89F72
Sleep.KERNEL32(00002710), ref: 00C89F79
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 00C89F82

Strings

`#v, xrefs: 00C89F64
Alarm triggered, xrefs: 00C89F3B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered$`#v
API String ID: 614609389-3049340936
Opcode ID: 3ff3f33f7771af285b6ac10839ddc26ce3147a9cf8dbf39a13aa30a31b0827fb
Instruction ID: 7b503d9eaa416634dd0aaa1fb2319080184ab981c3947b9d56e4d53b822c63e8
Opcode Fuzzy Hash: 3ff3f33f7771af285b6ac10839ddc26ce3147a9cf8dbf39a13aa30a31b0827fb
Instruction Fuzzy Hash: 5BE04F26F0412077952433BAAD0FE6F3E39DEC2B71745016FFA0856295EE4009019BF3

Function 00CA95FC Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00CA9789
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA97A5
__allrem.LIBCMT ref: 00CA97BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA97DA
__allrem.LIBCMT ref: 00CA97F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA980F

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 9c67cb4fed110ca44ac0cc586ac5e74db1fc7c48150eab0f41685f45472ef8a2
Instruction ID: 45590f2e4049219e99dab2934bf79fd17b63f4ea72e58727e730e5f381d63e38
Opcode Fuzzy Hash: 9c67cb4fed110ca44ac0cc586ac5e74db1fc7c48150eab0f41685f45472ef8a2
Instruction Fuzzy Hash: D6812A72A00B179BE7249E79CC43BAA73E8EF42728F24412DF521D66D1EB74DE019B50

Function 00CB4B3D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00CB4B69
__cftoe.LIBCMT ref: 00CB4B9B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: a68595126246a42a82befbfbded5dda6a509d9c4fbed4c44691bf013d94ff81c
Instruction ID: 61a80bde7dc5b1950287c81b4fc3a9b49951f14b7dca220b5d863b81a2bddc0e
Opcode Fuzzy Hash: a68595126246a42a82befbfbded5dda6a509d9c4fbed4c44691bf013d94ff81c
Instruction Fuzzy Hash: 0F513B32908205BBDF289B69CC81FEE77B9EF49724F244219F925D61C3DF35DA00A664

Function 00CB6159 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00CB6261
__freea.LIBCMT ref: 00CB630B
__freea.LIBCMT ref: 00CB6329

Strings

am/pm, xrefs: 00CB638C
a/p, xrefs: 00CB63F0

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: cc228bedcf82ad761f7ba50177770fab8d8f35db1a8ec7f6e140efe925e29350
Instruction ID: 477afbd5f345fd793aef176265756b5828f440f4dd5ea25638b564dbc5339cd2
Opcode Fuzzy Hash: cc228bedcf82ad761f7ba50177770fab8d8f35db1a8ec7f6e140efe925e29350
Instruction Fuzzy Hash: 31D10271910206CBDB388F69C995BFEB7B0FF05300F244169E921AB659D33D9E94CB61

Function 00C89DEC Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,00C89507,00000000,00000000), ref: 00C89DFC
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,00C89507,00000000,00000000), ref: 00C89E10
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00C89507,00000000,00000000), ref: 00C89E1D
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00C89507), ref: 00C89E52
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00C89507,00000000,00000000), ref: 00C89E64
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00C89507,00000000,00000000), ref: 00C89E67

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: 9b87ae731fb0eb2624edf67d1e126740e0058b37949cce2679b51d5edcdeb040
Instruction ID: 8f3a4b882e531e185b91674bb08e9570fd345a109935b52035ec0a8aeea80d60
Opcode Fuzzy Hash: 9b87ae731fb0eb2624edf67d1e126740e0058b37949cce2679b51d5edcdeb040
Instruction Fuzzy Hash: 4701D2311482147AD611A7299C4EF7F3E6CDB42374F180319F536961C0DA60CE0197A1

Function 00CA7E06 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00CA7DFD,00CA77B1), ref: 00CA7E14
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CA7E22
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CA7E3B
SetLastError.KERNEL32(00000000,?,00CA7DFD,00CA77B1), ref: 00CA7E8D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d45c08b73957634acb519572849bf0b7818114c8aa358c8464f5b084d7875442
Instruction ID: d2e9df8ed0789a820c38f9d21bdd89cbefce244455e55e26be3bae8dd581b9c4
Opcode Fuzzy Hash: d45c08b73957634acb519572849bf0b7818114c8aa358c8464f5b084d7875442
Instruction Fuzzy Hash: 9E01D43221C6175EEA2427B5AC8AB6F2A59FB4337CB3003AAF134450E1EF614D50A280

Function 00CB6EBF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00CB0A45,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6EC3
_free.LIBCMT ref: 00CB6EF6
_free.LIBCMT ref: 00CB6F1E
SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F2B
SetLastError.KERNEL32(00000000,?,00C8AB73,-00CE5D4C,?,?,?,?,00CD5900,00C7C07B,.vbs), ref: 00CB6F37
_abort.LIBCMT ref: 00CB6F3D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 8c60138ac77cfb34d1d83703729afd2aa9ceabb4310927b0f7c304604f87307d
Instruction ID: 3d8f4befeb3acc3a863d80e2871a64898203251e2b8e30ab9fcc3643fd6bc66a
Opcode Fuzzy Hash: 8c60138ac77cfb34d1d83703729afd2aa9ceabb4310927b0f7c304604f87307d
Instruction Fuzzy Hash: E1F02D3550870127C62273B4ED45FEF2619DBD17A1F240124F824A6292EF38CD426610

Function 00C89C20 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C2F
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C43
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C50
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C5F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C71
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C8979B,00000000,00000000), ref: 00C89C74

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: f2220d2dd431c12483cf0412e0eafdc7a059c372a9fdba9f6bda2e03d5a8fb3f
Instruction ID: 5abb350103a3bd15df1191912c9de97f2d6ed3991cdaf88b99ed330825868258
Opcode Fuzzy Hash: f2220d2dd431c12483cf0412e0eafdc7a059c372a9fdba9f6bda2e03d5a8fb3f
Instruction Fuzzy Hash: 23F06D325402187BD6116B69DC89FBF3B6CEB457A0B044115F90692181DB64CE469BB1

Function 00C89D87 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89D96
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89DAA
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89DB7
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89DC6
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89DD8
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89697,00000000,00000000), ref: 00C89DDB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 8b74e9e60acfe48aa5d1829e2696069f6768e4c46e6d7683d6270c1a7f5da721
Instruction ID: a5159c86be1c33cd1c7edfad6b1e7bfb6301eb89499b086a26eb9e2d86c93bb2
Opcode Fuzzy Hash: 8b74e9e60acfe48aa5d1829e2696069f6768e4c46e6d7683d6270c1a7f5da721
Instruction Fuzzy Hash: F9F06D725002187BD6117B69EC89FBF3A6CDB456A0B080116FE4AA2191DB64CE069BB4

Function 00C89D22 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D31
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D45
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D52
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D61
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D73
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00C89719,00000000,00000000), ref: 00C89D76

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: e8ea69585e40c6ea265805d54720fdc35658010bf7b018abd8e7feec13b4dc3e
Instruction ID: 7e9f9a02b5437751b9864818f759827c4e861facefadb16db8ced415af79942d
Opcode Fuzzy Hash: e8ea69585e40c6ea265805d54720fdc35658010bf7b018abd8e7feec13b4dc3e
Instruction Fuzzy Hash: 6DF06D729002287BD2116B69DC89FBF3B6CEB457A0B044116FE0AA2191DB64CE069BB4

Function 00CB26D4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\SHROsQyiAd.exe,00000104), ref: 00CB2714
_free.LIBCMT ref: 00CB27DF
_free.LIBCMT ref: 00CB27E9

Strings

5, xrefs: 00CB271A
C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00CB270B, 00CB2712, 00CB2741, 00CB2779

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\SHROsQyiAd.exe$5
API String ID: 2506810119-1592904007
Opcode ID: a0af12bb55787ae2d9acc69ed9fb3061cb7bd035e54828708640af00188d73a7
Instruction ID: 5a05f1205bcba2b9c648941b4a230e6256e104e7fb2c84a456b5025009fd40c6
Opcode Fuzzy Hash: a0af12bb55787ae2d9acc69ed9fb3061cb7bd035e54828708640af00188d73a7
Instruction Fuzzy Hash: D2319471A04258AFDB21DF99DC85EEEBBFCEB85710F144066F814AB211DB708E41EB91

Function 00C8A81D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00C82584: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 00C825A6
Part of subcall function 00C82584: RegQueryValueExW.ADVAPI32(?,00C7E0BA,00000000,00000000,?,00000400), ref: 00C825C5
Part of subcall function 00C82584: RegCloseKey.ADVAPI32(?), ref: 00C825CE

Part of subcall function 00C8B15B: GetCurrentProcess.KERNEL32(?,?,?,00C7C914,WinDir,00000000,00000000), ref: 00C8B16C

_wcslen.LIBCMT ref: 00C8A8F6

Strings

.exe, xrefs: 00C8A848
program files\, xrefs: 00C8A8DC, 00C8A8E3, 00C8A8F5
http\shell\open\command, xrefs: 00C8A82D
program files (x86)\, xrefs: 00C8A8F0

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCurrentOpenProcessQueryValue_wcslen
String ID: .exe$http\shell\open\command$program files (x86)\$program files\
API String ID: 37874593-4246244872
Opcode ID: 7b9f09eef18b959f1e5c66fc4b16d4d8c59a8fb73eaa21a74a7e096f152dfce8
Instruction ID: f0c321da5f110ee3c8e976263c27c6fd4f22993df862d7062c9f7e0b1eaf671a
Opcode Fuzzy Hash: 7b9f09eef18b959f1e5c66fc4b16d4d8c59a8fb73eaa21a74a7e096f152dfce8
Instruction Fuzzy Hash: 6B21C872B001046BDF08BAB88C9BDEE366D9B45364F15043DF806A72C3EE309D196765

Function 00C7A876 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 00C7A884
wsprintfW.USER32 ref: 00C7A905

Part of subcall function 00C79D58: SetEvent.KERNEL32(?,?,00000000,00C7A91C,00000000), ref: 00C79D84

Strings

], xrefs: 00C7A892
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 00C7A88D
Offline Keylogger Started, xrefs: 00C7A87D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: d7e1382a6e9c855af986bdbce2cb3e3762dd7fd6b35acf52245a9c4b80525bf2
Instruction ID: daca98dab78fa4eff7a079a59429efc5687cda6c9c5a8bb722ba6a5ba7bbb475
Opcode Fuzzy Hash: d7e1382a6e9c855af986bdbce2cb3e3762dd7fd6b35acf52245a9c4b80525bf2
Instruction Fuzzy Hash: BB118272504018AACB1CFB54EC56CFF77B8EE58361B00412AF80666191EF389A86E6A5

Function 00C8CA1F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 00C8CA6C
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 00C8CA87
GetLastError.KERNEL32 ref: 00C8CA91

Strings

0, xrefs: 00C8CA2D
MsgWindowClass, xrefs: 00C8CA28

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: c8b14774fa9d04413fe065b78bacbcda00d465aacf71f0731dc165f2797ecb13
Instruction ID: 955a64de1b81057d878f56b96b7268ce5953837de859d150ac1c0f2397cda7c6
Opcode Fuzzy Hash: c8b14774fa9d04413fe065b78bacbcda00d465aacf71f0731dc165f2797ecb13
Instruction Fuzzy Hash: 7001EDB1D1421EABCB00DFD6DCC4AEFBBBDFE49258B54062AE510B2140D7705A459F60

Function 00C769BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00C76A00
CloseHandle.KERNEL32(?), ref: 00C76A0F
CloseHandle.KERNEL32(?), ref: 00C76A14

Strings

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00C769F6
C:\Windows\System32\cmd.exe, xrefs: 00C769FB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 5691a1e7ecbe68a436d630ddb9a9aa573be0b9b6ccf996ad6521255df8ee9359
Instruction ID: 990db780f45343a90328b7ba2fd1d48697b9620d0043e06a1e4605f42d49645a
Opcode Fuzzy Hash: 5691a1e7ecbe68a436d630ddb9a9aa573be0b9b6ccf996ad6521255df8ee9359
Instruction Fuzzy Hash: 68F03AB69002A9BACB20ABD6DC0EFDF7F7CEBC2B10F00052AF615A6150D6706145CAB4

Function 00CB25D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CB258A,00000003,?,00CB252A,00000003,00CDDAE0,0000000C,00CB2681,00000003,00000002), ref: 00CB25F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CB260C
FreeLibrary.KERNEL32(00000000,?,?,?,00CB258A,00000003,?,00CB252A,00000003,00CDDAE0,0000000C,00CB2681,00000003,00000002,00000000), ref: 00CB262F

Strings

mscoree.dll, xrefs: 00CB25F2
CorExitProcess, xrefs: 00CB2604

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a5f588f18e9ab71259f3183149804bd0a6c699f5c6b008d5b67885552dfa585a
Instruction ID: d3598c2dae9b0557eec6261a8dd0ed07036b013bfe1cf00345ac6381c96d475a
Opcode Fuzzy Hash: a5f588f18e9ab71259f3183149804bd0a6c699f5c6b008d5b67885552dfa585a
Instruction Fuzzy Hash: E0F0FF31A54219FBCB159FA5DC4AFDDBFB8EB08755F1041A8F805A6150DF709E40CB94

Function 00C74AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00CE45A8,00C84DB5,00000000,00000000,00000001), ref: 00C74AED
SetEvent.KERNEL32(?), ref: 00C74AF9
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C74B04
CloseHandle.KERNEL32(?), ref: 00C74B0D

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

Strings

KeepAlive | Disabled, xrefs: 00C74AC6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 1f8f88f90bf51f8dbb21328517849a12c2e1ea17fb9a8e423195f0102406bb22
Instruction ID: c4d952da0067a7e1dd6518ed0b60244eb24185e780ce3ffb455743c5b70eef70
Opcode Fuzzy Hash: 1f8f88f90bf51f8dbb21328517849a12c2e1ea17fb9a8e423195f0102406bb22
Instruction Fuzzy Hash: 91F0B471908710AFDB1537B5DD0EF6E7FA8EB02321F048A5AF8A2826B1D6208C50DB52

Function 00C8BE6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,00C8BF02), ref: 00C8BE79
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,00C8BF02), ref: 00C8BE86
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,00C8BF02), ref: 00C8BE93
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,00C8BF02), ref: 00C8BEA6

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 00C8BE99

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: 241f649d6347e9528d94f6d8c2c6b1904ef11c00fb83a88a6439f718194bf9e9
Instruction ID: 8ab79d9e56c8e858ed36dfcabb1de6c2f003066102f7061fcbea25259f987275
Opcode Fuzzy Hash: 241f649d6347e9528d94f6d8c2c6b1904ef11c00fb83a88a6439f718194bf9e9
Instruction Fuzzy Hash: B1E04F62104248ABD31037F6EC4EEAF3B7CE784712B041615F616902929A7084448A70

Function 00C71430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00C7143A
GetProcAddress.KERNEL32(00000000), ref: 00C71441

Strings

`#v, xrefs: 00C7143A
User32.dll, xrefs: 00C71435
GetCursorInfo, xrefs: 00C71430

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetCursorInfo$User32.dll$`#v
API String ID: 1646373207-1032071883
Opcode ID: ec4aaea268c076fab9dbe80aaf97586af596db4173cc3625f67ad601daa3e0ee
Instruction ID: 77090538e2ca6e377209748d621994b0d5e2703de854638f2be376957a912b67
Opcode Fuzzy Hash: ec4aaea268c076fab9dbe80aaf97586af596db4173cc3625f67ad601daa3e0ee
Instruction Fuzzy Hash: C3B092B8549356DBCA205BA0ED0DF0D7A24EA04702301026AF247C5360CB704440BE24

Function 00CB016A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688bb62f90adb0688bbc24fd266b16eafbe07324e0a0927114b2e6858c9e0575
Instruction ID: 65f9dfdaa662eb3f1da85cd00fc22c68e0a8a39819e73f8ee74cd843dd3dd198
Opcode Fuzzy Hash: 688bb62f90adb0688bbc24fd266b16eafbe07324e0a0927114b2e6858c9e0575
Instruction Fuzzy Hash: 1B71C571900716DBCB218F99C888AFFB7B5FF51350F340269E821A7161D7709E45CBA1

Function 00C80B19 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C805B9: SetLastError.KERNEL32(0000000D,00C80B38,?,00000000), ref: 00C805BF

GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00C80B15), ref: 00C80BC4
GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00C80C2A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00C80C31
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C80D3F
SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00C80B15), ref: 00C80D69

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
String ID:
API String ID: 3525466593-0
Opcode ID: 59c81aa1727fdeec3c3a05764936e93379e2ea138924b56f1525edf536037d43
Instruction ID: bd6f6df1efcbbfc5fe96d0617afc88865b5e1c4a409f27d05ea9e364c74d9fc9
Opcode Fuzzy Hash: 59c81aa1727fdeec3c3a05764936e93379e2ea138924b56f1525edf536037d43
Instruction Fuzzy Hash: 4361F770201701ABDBA0BF65CD81B267BA5FF44708F24411AFD158B286D7B4ED48DBD9

Function 00CB3F7B Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB6AFF: HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

_free.LIBCMT ref: 00CB4086
_free.LIBCMT ref: 00CB409D
_free.LIBCMT ref: 00CB40BC
_free.LIBCMT ref: 00CB40D7
_free.LIBCMT ref: 00CB40EE

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: d62f3ed59bbe5c4e0a2ee8a1330a7d3d44c8b8dc17741afc536562fd596b447b
Instruction ID: cc2a008e2f2c66f21e72e712fdfca2751556ad0834096f8138e75e982ef9c273
Opcode Fuzzy Hash: d62f3ed59bbe5c4e0a2ee8a1330a7d3d44c8b8dc17741afc536562fd596b447b
Instruction Fuzzy Hash: 9E51E031A04204AFDB24EF69DC81BAA73F4EF54724F14416DE919D7292E731EE01DB80

Function 00C73DE7 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C73E8A

Part of subcall function 00C73FCD: __EH_prolog.LIBCMT ref: 00C73FD2

Strings

OpenCamera, xrefs: 00C73F48
GetFrame, xrefs: 00C73F65
CloseCamera, xrefs: 00C73F54
FreeFrame, xrefs: 00C73F76

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$OpenCamera
API String ID: 3469354165-3547787478
Opcode ID: 80fa5837db3279d1cac8d84f62757036c03ca1b9a038953506e6c386864bb1c1
Instruction ID: 5a3fd8edba8fce66d7080a7527fabb8be64b899c17e4ae0ff70ddd8fccbf228f
Opcode Fuzzy Hash: 80fa5837db3279d1cac8d84f62757036c03ca1b9a038953506e6c386864bb1c1
Instruction Fuzzy Hash: AB41E571A0429097CB14FBB8C85AB6D37616B81790F088559FC598B7D2EF30CF05E786

Function 00C7E6A3 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C8B15B: GetCurrentProcess.KERNEL32(?,?,?,00C7C914,WinDir,00000000,00000000), ref: 00C8B16C

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C7E6C1
Process32FirstW.KERNEL32(00000000,?), ref: 00C7E6E5
Process32NextW.KERNEL32(00000000,0000022C), ref: 00C7E6F4
CloseHandle.KERNEL32(00000000), ref: 00C7E8AB

Part of subcall function 00C8B187: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00C7E4D0,00000000,?,?,00CE4358), ref: 00C8B19C

Part of subcall function 00C8B37D: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 00C8B395
Part of subcall function 00C8B37D: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 00C8B3A8

Process32NextW.KERNEL32(00000000,0000022C), ref: 00C7E89C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 4269425633-0
Opcode ID: 320b3b022a764be626abc06fd7b1b353a92e48b3b8d0d704bac50ddc6c28d006
Instruction ID: 67b2c975ea67a85b37e4f8cc07fe5a9f78ca42fb1798bd0ca703bfe2cc6a6889
Opcode Fuzzy Hash: 320b3b022a764be626abc06fd7b1b353a92e48b3b8d0d704bac50ddc6c28d006
Instruction Fuzzy Hash: 8F4110321082405BD335FB64DC66BEFB3A8AFE4700F54852DF88E86191EF309A49DB56

Function 00CB3098 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB310A
_free.LIBCMT ref: 00CB312A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1315827a36a7e72a7bc0347db1c15fcc61a1b5c124dec98ae58acf4b47837f0f
Instruction ID: 175435f5b2d6e8089e7f924c6a9439d01c2cd03e529361cd11459b064b87ddb2
Opcode Fuzzy Hash: 1315827a36a7e72a7bc0347db1c15fcc61a1b5c124dec98ae58acf4b47837f0f
Instruction Fuzzy Hash: 0341C536E002449FCB24DF7CC881A9DB7A5EF85714F158569E915EB391DB31EE02DB80

Function 00CBFED3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00CAE3ED,?,00000000,?,00000001,?,?,00000001,00CAE3ED,?), ref: 00CBFF20
__alloca_probe_16.LIBCMT ref: 00CBFF58
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CBFFA9
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00CA99BF,?), ref: 00CBFFBB
__freea.LIBCMT ref: 00CBFFC4

Part of subcall function 00CB6AFF: HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: b7383f438ea4291220acdb331be2ca9cbf4a43f4fc4234a6c98cc2860521fe31
Instruction ID: fba5f2590223666dd8c729b10089262bfbc8b5ef7203217dc9709a432b6610d3
Opcode Fuzzy Hash: b7383f438ea4291220acdb331be2ca9cbf4a43f4fc4234a6c98cc2860521fe31
Instruction Fuzzy Hash: 8E31DE72A0021AABDF249FA4DC91EFE7BA5EB01350F05426DFC14D6250EB35DE61CBA0

Function 00C7196B Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00C7197B
waveInOpen.WINMM(00CE1AF8,000000FF,00CE1B00,Function_00001A8E,00000000,00000000,00000024), ref: 00C71A11
waveInPrepareHeader.WINMM(00CE1AC0,00000020,00000000), ref: 00C71A66
waveInAddBuffer.WINMM(00CE1AC0,00000020), ref: 00C71A75
waveInStart.WINMM ref: 00C71A81

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID:
API String ID: 1356121797-0
Opcode ID: bb8e0bfbe8e6b6b94ae2012517215bb1dfb61cfeb3ebcbf798e2acfe6c021d95
Instruction ID: b970da4212a168c6b4fc669f593b9b25b92596f0ffa61bb39883e6984f1e78d4
Opcode Fuzzy Hash: bb8e0bfbe8e6b6b94ae2012517215bb1dfb61cfeb3ebcbf798e2acfe6c021d95
Instruction Fuzzy Hash: 8E214FB1A01280DBC704DF6AED99B3E7AA5FB9875170C813AED15CF6B0E7744860EB14

Function 00C7FBEF Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C7FBFC
int.LIBCPMT ref: 00C7FC0F

Part of subcall function 00C7CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 00C7CEF1
Part of subcall function 00C7CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00C7CF0B

std::_Facet_Register.LIBCPMT ref: 00C7FC4B
std::_Lockit::~_Lockit.LIBCPMT ref: 00C7FC71
__CxxThrowException@8.LIBVCRUNTIME ref: 00C7FC8D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: 17b375315b72c7a572a400e697a9db2d0e7c3331b88cfe89a5bf4f2a7adbb1bc
Instruction ID: 9dabbab06e6495a88e942afe62ec89227af4ad0bec9c67d95218b33fdcd7cf6c
Opcode Fuzzy Hash: 17b375315b72c7a572a400e697a9db2d0e7c3331b88cfe89a5bf4f2a7adbb1bc
Instruction Fuzzy Hash: BD113332900459ABCF15FBA4E882DDDB779AF40318F204068F909A7281EF709F02E391

Function 00CBE13B Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CBE144
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CBE167

Part of subcall function 00CB6AFF: HeapAlloc.KERNEL32(00000000,00C7E5AC,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8,?,?,00CE42E0), ref: 00CB6B31

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00CBE18D
_free.LIBCMT ref: 00CBE1A0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CBE1AF

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: c5388bc572d2e759a878d3f10e817b829641b7da0d4133942dde3f4ec33885c6
Instruction ID: 31dfddd508f5846326c7a7301d1d46a15c5c08576ef5c1c7d43a3a82e0462888
Opcode Fuzzy Hash: c5388bc572d2e759a878d3f10e817b829641b7da0d4133942dde3f4ec33885c6
Instruction Fuzzy Hash: 5401D4B26012217F67215ABE9C8CDFF6A6DDEC2FA17280228FD14D6102DA708D02A5B0

Function 00C7FED2 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C7FEDF
int.LIBCPMT ref: 00C7FEF2

Part of subcall function 00C7CEE0: std::_Lockit::_Lockit.LIBCPMT ref: 00C7CEF1
Part of subcall function 00C7CEE0: std::_Lockit::~_Lockit.LIBCPMT ref: 00C7CF0B

std::_Facet_Register.LIBCPMT ref: 00C7FF2E
std::_Lockit::~_Lockit.LIBCPMT ref: 00C7FF54
__CxxThrowException@8.LIBVCRUNTIME ref: 00C7FF70

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: 3193682a3f9b742631dcf36b8af42191d14986c587e14da2c883368b941b6eee
Instruction ID: dd74efb04afd53d920de988eea4b8b0924ceb296c6d33da4360d26b367fe9a38
Opcode Fuzzy Hash: 3193682a3f9b742631dcf36b8af42191d14986c587e14da2c883368b941b6eee
Instruction Fuzzy Hash: FC110631900419ABCF05FBE4C8869DDB7B9AF81318B20406CF519A72C1EF709F06E791

Function 00CB6F43 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00C7E5AC,?,00CB5359,00CB6B42,00000000,?,00CA3627,00C7E5AC,?,00C72BE9,00CE42E0,00C72F1C,00000000,00CE42E0,00C784A8), ref: 00CB6F48
_free.LIBCMT ref: 00CB6F7D
_free.LIBCMT ref: 00CB6FA4
SetLastError.KERNEL32(00000000,?,00C7E5AC,00CE42E0), ref: 00CB6FB1
SetLastError.KERNEL32(00000000,?,00C7E5AC,00CE42E0), ref: 00CB6FBA

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c4394e3a9b289b932769b7c29b9bb3303bc1b7eb7e40559e2cb84fffcd0afcb3
Instruction ID: 01b2ba90b8b6eefbed5228e82d3861a3c12af5e8ffe534f36fd25a4fea11c7b4
Opcode Fuzzy Hash: c4394e3a9b289b932769b7c29b9bb3303bc1b7eb7e40559e2cb84fffcd0afcb3
Instruction Fuzzy Hash: EC01F93620C70067861263F5FC85FFF272DDBD1761F290228F925A2282EE78CD056960

Function 00CBF79D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CBF7B5

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CBF7C7
_free.LIBCMT ref: 00CBF7D9
_free.LIBCMT ref: 00CBF7EB
_free.LIBCMT ref: 00CBF7FD

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 45ed9c7a946e845909ae10d2aecad75de49a958967b6339f38dc9ced2eff761d
Instruction ID: 800ef49319834875ac0008de5e8b016a9634dd3b8542c075feeb32c2d8c102e4
Opcode Fuzzy Hash: 45ed9c7a946e845909ae10d2aecad75de49a958967b6339f38dc9ced2eff761d
Instruction Fuzzy Hash: AFF01232504240BB8A20DB68ECC5E9E73E9AB41B14F78481DF414FB651CB74FDD19EA4

Function 00CB32E7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB3305

Part of subcall function 00CB6AC5: HeapFree.KERNEL32(00000000,00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000), ref: 00CB6ADB
Part of subcall function 00CB6AC5: GetLastError.KERNEL32(00000000,?,00CBFA50,00000000,00000000,00000000,00000000,?,00CBFCF4,00000000,00000007,00000000,?,00CC0205,00000000,00000000), ref: 00CB6AED

_free.LIBCMT ref: 00CB3317
_free.LIBCMT ref: 00CB332A
_free.LIBCMT ref: 00CB333B
_free.LIBCMT ref: 00CB334C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9d449008ea9c56211e53354f14b58cbf4117aff65bd843e2281b5966e21603d3
Instruction ID: 2a36d12125f12965e638e68343ce9a132467463e557de74d4dc5854c308dc723
Opcode Fuzzy Hash: 9d449008ea9c56211e53354f14b58cbf4117aff65bd843e2281b5966e21603d3
Instruction Fuzzy Hash: 96F05EB18061A09BCB01AF54FD867ED3B60B744B54B1C012AF8116E672EB3C0976FBC1

Function 00C829AA Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 173registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00C82A1D
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00C82A4C
RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 00C82AED

Strings

[regsplt], xrefs: 00C82B85

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]
API String ID: 3554306468-4262303796
Opcode ID: b3dc9ac0ac8377cb18db60b3f8ed9e7549c9cf2ecf6af5b28bc3c8c8474d9f85
Instruction ID: fde154a5b82e6e4f16983eab77f0f1003fd42b04b3ec6a7889b680adf3f73aeb
Opcode Fuzzy Hash: b3dc9ac0ac8377cb18db60b3f8ed9e7549c9cf2ecf6af5b28bc3c8c8474d9f85
Instruction Fuzzy Hash: 2E514E72108344AFD324EB64DC55DAFB7ECEF84704F00492EF99A82151EB70EA09DB62

Function 00CBD459 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00CBD4A8
_free.LIBCMT ref: 00CBD5C5

Part of subcall function 00CAA854: IsProcessorFeaturePresent.KERNEL32(00000017,00CAA826,00C7E5AC,?,?,00CE42F8,00000000,00000000,00000000,?,00CAA846,00000000,00000000,00000000,00000000,00000000), ref: 00CAA856
Part of subcall function 00CAA854: GetCurrentProcess.KERNEL32(C0000417,?,00C7E5AC,00CE42E0), ref: 00CAA878
Part of subcall function 00CAA854: TerminateProcess.KERNEL32(00000000,?,00C7E5AC,00CE42E0), ref: 00CAA87F

Strings

*?, xrefs: 00CBD49C
., xrefs: 00CBD77C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: dbad545dedeb202f26215854c3da024dc0fb99b6c0e3b260b863dc96475f25f4
Instruction ID: dc10ddf761fea25856a6aa9c08001e09f28921847a8a45f29e81a6e8ca655b0e
Opcode Fuzzy Hash: dbad545dedeb202f26215854c3da024dc0fb99b6c0e3b260b863dc96475f25f4
Instruction Fuzzy Hash: 4651C4B1E0020AAFDF24CFA8C881AEDB7F5EF58314F24416AE455E7341E6359E05DB50

Function 00C7A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 00C7A884
Part of subcall function 00C7A876: wsprintfW.USER32 ref: 00C7A905

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 00C7A691
CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 00C7A69D
CreateThread.KERNEL32(00000000,00000000,00C799C1,?,00000000,00000000), ref: 00C7A6A9

Strings

Online Keylogger Started, xrefs: 00C7A626, 00C7A62F, 00C7A659

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: bc5a6b01b6a0eeefe32547aa3a6fe526147f35a02ce84feea13b3d2ae53a4cae
Instruction ID: 68b983317ceb936d467e8c114d7eedd9b77529a29ba646bf9fdf332f6849586a
Opcode Fuzzy Hash: bc5a6b01b6a0eeefe32547aa3a6fe526147f35a02ce84feea13b3d2ae53a4cae
Instruction Fuzzy Hash: 5B01F591B002083EFB2076788CCBD7F7E7DCAC23A8B44442DFA4916182E9605D0593F7

Function 00C74B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00C74B26), ref: 00C74B40
CloseHandle.KERNEL32(?,?,?,?,00C74B26), ref: 00C74B98
SetEvent.KERNEL32(?,?,?,?,00C74B26), ref: 00C74BA7

Strings

Connection Timeout, xrefs: 00C74B66

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: dfacebc4c60771a4e3371641867592d4b64f1466799793b0f4433cc2a6fd8fcf
Instruction ID: 42c9a185ff846ead550920fb1e1952306e37caa734901fb246a588fc463313c5
Opcode Fuzzy Hash: dfacebc4c60771a4e3371641867592d4b64f1466799793b0f4433cc2a6fd8fcf
Instruction Fuzzy Hash: C3012831900F40DF932AAB3ACC4695EBFE5EF05311300462EE5A746A20DB20D800DB52

Function 00C764D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\SHROsQyiAd.exe, xrefs: 00C76927

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\SHROsQyiAd.exe
API String ID: 0-734936187
Opcode ID: b842996836b0e39e865b33cebf2ca774bd3297e39123910d6f4f03ce6148944e
Instruction ID: d8c7b3611745c4f31684b151f7ffed9151c014248bbcaf85ab8b412f51a76782
Opcode Fuzzy Hash: b842996836b0e39e865b33cebf2ca774bd3297e39123910d6f4f03ce6148944e
Instruction Fuzzy Hash: 50F024B0B00650DBCF042B75AC19B3E3609EB80362F048531FA5ADE2A1EB708941DB90

Function 00C82774 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000001,00000000,00CE42E0), ref: 00C8277F
RegSetValueExW.ADVAPI32(00CE42E0,?,00000000,00000001,00000000,00000000,00CE42F8,?,00C7E5CB,pth_unenc,00CE42E0), ref: 00C827AD
RegCloseKey.ADVAPI32(00CE42E0,?,00C7E5CB,pth_unenc,00CE42E0), ref: 00C827B8

Strings

pth_unenc, xrefs: 00C82778

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: 126638cdb909eff2563797b7130845b5736fb8bd4eeb7997374818f3f458aff1
Instruction ID: 8301551cd1143329dc5580fbecb04fd7a61f9ded455589441cdcdb9f09845686
Opcode Fuzzy Hash: 126638cdb909eff2563797b7130845b5736fb8bd4eeb7997374818f3f458aff1
Instruction Fuzzy Hash: BBF06D71500118BBDF10AFA0ED4AFEE376CEB40790F108614FD1696050EB319B04EB60

Function 00C7CDBE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C7CDC9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C7CE08

Part of subcall function 00CA47BD: _Yarn.LIBCPMT ref: 00CA47DC
Part of subcall function 00CA47BD: _Yarn.LIBCPMT ref: 00CA4800

__CxxThrowException@8.LIBVCRUNTIME ref: 00C7CE2C

Strings

bad locale name, xrefs: 00C7CE16

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: fcfee67d9983d232d78a3c79ff9ba9d76688408d4709d3ca85eedb29ba483605
Instruction ID: 9550341c92a8102b75e6aae97ab4b335e2038661574d9390628c9992408000fb
Opcode Fuzzy Hash: fcfee67d9983d232d78a3c79ff9ba9d76688408d4709d3ca85eedb29ba483605
Instruction Fuzzy Hash: 52F04F33400205EAC728FB60E857DDAB7A49F19794B90C5ADF61A524D2EF70AA08D694

Function 00C851B2 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00C851F4

Strings

open, xrefs: 00C851EE
/C , xrefs: 00C851D2
cmd.exe, xrefs: 00C851E9

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: 75749b9b78d4cd86150e36222e7c210fc37272601b1ef93b9c2e2892353bdcc2
Instruction ID: bdd191055b7198b019fcaf7029e32a483fcd2fa99082b1b5ca948cf7727e4a09
Opcode Fuzzy Hash: 75749b9b78d4cd86150e36222e7c210fc37272601b1ef93b9c2e2892353bdcc2
Instruction Fuzzy Hash: 0BE06570104340AEC708F764DCA9C7FB7AD9A90744F04982DB94652191DF309D04AA15

Function 00C7AFBA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(00C799A9,00000000,00CE42F8,pth_unenc,00C7BF26,00CE42E0,00CE42F8,?,pth_unenc), ref: 00C7AFC9
UnhookWindowsHookEx.USER32(00CE40F8), ref: 00C7AFD5
TerminateThread.KERNEL32(00C79993,00000000,?,pth_unenc), ref: 00C7AFE3

Strings

pth_unenc, xrefs: 00C7AFBA

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: TerminateThread$HookUnhookWindows
String ID: pth_unenc
API String ID: 3123878439-4028850238
Opcode ID: b1f61bd632e9fba8bed93198908f2fc8bc5ac3e6b1735e5b159f49852c7a4280
Instruction ID: fe2bc8a10d32ab697f9ddb5fe6721099105ba7970c87a0e0ce187ba5cbea4318
Opcode Fuzzy Hash: b1f61bd632e9fba8bed93198908f2fc8bc5ac3e6b1735e5b159f49852c7a4280
Instruction Fuzzy Hash: 6BE01271209256EFE3201FE0DC88E2DBBAAEA84395314853EF7CA81120C6754C44CF51

Function 00C714D5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 00C714DF
GetProcAddress.KERNEL32(00000000), ref: 00C714E6

Strings

User32.dll, xrefs: 00C714DA
GetLastInputInfo, xrefs: 00C714D5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetLastInputInfo$User32.dll
API String ID: 2574300362-1519888992
Opcode ID: d15e01cbac1f8ad7f7f6d13bbf70d215c5a8ecbfc0521a2d58657e5706b062ca
Instruction ID: d642811249e352b2657312ff8ec4da9c6ee6a422e623d1710509617e21fc0044
Opcode Fuzzy Hash: d15e01cbac1f8ad7f7f6d13bbf70d215c5a8ecbfc0521a2d58657e5706b062ca
Instruction Fuzzy Hash: 78B092B8584381DBCB301BA0EC0DF1D7AA4FA48742701452AF203C12A0CB740400AF20

Function 00CB8D0B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00CB8D96
__alldvrm.LIBCMT ref: 00CB8F97
__alldvrm.LIBCMT ref: 00CB8FB9

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 356596f341ec539a94dfe36e390bc51e19313ec426e60b5603d27ca0cdfe98ae
Instruction ID: cc8c41bd083014f5702a9d75749f57be2f885cd14b8c93159def83a439fde2e1
Opcode Fuzzy Hash: 356596f341ec539a94dfe36e390bc51e19313ec426e60b5603d27ca0cdfe98ae
Instruction Fuzzy Hash: A1A16A769043869FEB21CF98C881BFEBBEAEF15350F18416DE5949B281CA34CE49C750

Function 00CC59CA Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CC5AF9

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 857b94336e3fc5ab441c74f721345463d2e0aabcf9189d2ed3aa07ae9a833777
Instruction ID: 067e49afc177bb64403b9bd0a2c86a98b17ad42e69b14a89521a62ad1b54f7ab
Opcode Fuzzy Hash: 857b94336e3fc5ab441c74f721345463d2e0aabcf9189d2ed3aa07ae9a833777
Instruction Fuzzy Hash: 4641E731A009016BDB25BBBACCC6FFE3AA4DF51360F14035DF428D6291DAB45D85B6A1

Function 00CB1A81 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa848523b99a99fcbba471c348d2a36401b16c37f61d34f4166d735c8635df1c
Instruction ID: ae34be674eb51bc61237044e4414053e0b303ffc4ddf30da79553dbd13a6a0ec
Opcode Fuzzy Hash: aa848523b99a99fcbba471c348d2a36401b16c37f61d34f4166d735c8635df1c
Instruction Fuzzy Hash: 434109B2A00744AFD724AF78CC51BEABBE8EF84710F14452EF511DB281E7B1AA019790

Function 00C7B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00C7B81B
Sleep.KERNEL32(00001388), ref: 00C7B8A3

Strings

[Cleared browsers logins and cookies.], xrefs: 00C7B8DE
Cleared browsers logins and cookies., xrefs: 00C7B8EF

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 088511c0b95140fe3e5338f0ec919569aab18ac2384b399287f562971fb60fde
Instruction ID: 5ffc2edfa5dee2750c6b63deca05cfc9d851e73e1c6085329c4ebad9cf652838
Opcode Fuzzy Hash: 088511c0b95140fe3e5338f0ec919569aab18ac2384b399287f562971fb60fde
Instruction Fuzzy Hash: C8318D1564C3C0AACA156BB858667EE6F964E93754F08C15DF8EC0B3C3DB528E08A363

Function 00C79C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C8B6E6: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C8B6F6
Part of subcall function 00C8B6E6: GetWindowTextLengthW.USER32(00000000), ref: 00C8B6FF
Part of subcall function 00C8B6E6: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C8B729

Sleep.KERNEL32(000001F4), ref: 00C79C95
Sleep.KERNEL32(00000064), ref: 00C79D1F

Strings

[ , xrefs: 00C79CB1
], xrefs: 00C79C9D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: 65b71a631e187366df71d76025e97ff0d26f6f10a912cfef93ef07fc7d5f8645
Instruction ID: 0624a2fafb7c839ecb08f045edeb35bcc0f8547319941a9d0e1e3c1b5840f6b9
Opcode Fuzzy Hash: 65b71a631e187366df71d76025e97ff0d26f6f10a912cfef93ef07fc7d5f8645
Instruction Fuzzy Hash: 1A11B1325042009BC618B738DC17AAEB7A8EF51710F40852EF95A121D3EF21AA19A7D7

Function 00CB2CD2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7259c0685d8de694ffae0225b48cf57b253cb4d66f2e836629dbb694b1ef34f
Instruction ID: ae81b620d263e4d6f0b13eac6f0014693371556045c2976c7d0e2c3582810269
Opcode Fuzzy Hash: e7259c0685d8de694ffae0225b48cf57b253cb4d66f2e836629dbb694b1ef34f
Instruction Fuzzy Hash: 4901D6B22097157EF6202679ACC1FEB671CDF917B8F340725F931A61E5EB608D04A560

Function 00CB2D51 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33e12d3981bd594f28f0d353957ef09132b2a404bc3c011e93e8bc1deb7ca0a
Instruction ID: 5d4a453acc694d276a90a0ec3775e4d066c1fc4132be12574df39b58dce4b6ad
Opcode Fuzzy Hash: c33e12d3981bd594f28f0d353957ef09132b2a404bc3c011e93e8bc1deb7ca0a
Instruction Fuzzy Hash: D501A4B22096167EE72156B8BCD4EEB635DDF817B8B341329F431611D5EF308D11E560

Function 00CA80F5 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00CA810F

Part of subcall function 00CA805C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00CA808B
Part of subcall function 00CA805C: ___AdjustPointer.LIBCMT ref: 00CA80A6

_UnwindNestedFrames.LIBCMT ref: 00CA8124
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00CA8135
CallCatchBlock.LIBVCRUNTIME ref: 00CA815D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
Instruction ID: 6e98330ec95ee4a5b86d614b4de65cd43706b387f3a82177f5b1e988f27b5177
Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
Instruction Fuzzy Hash: 2F014C3250010ABBCF125F95CC46EEF3B69FF4A758F044118FE18A6121DB32E865EBA0

Function 00CB7210 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00CE42F8,00000000,00000000,?,00CB71B7,00CE42F8,00000000,00000000,00000000,?,00CB74E3,00000006,FlsSetValue), ref: 00CB7242
GetLastError.KERNEL32(?,00CB71B7,00CE42F8,00000000,00000000,00000000,?,00CB74E3,00000006,FlsSetValue,00CCD328,FlsSetValue,00000000,00000364,?,00CB6F91), ref: 00CB724E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CB71B7,00CE42F8,00000000,00000000,00000000,?,00CB74E3,00000006,FlsSetValue,00CCD328,FlsSetValue,00000000), ref: 00CB725C

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2a81c1210149c6693820402e63967d0ba520067a8e35647833344102a87a4d2e
Instruction ID: ef46135f62e05f33da7c907d8cec45adfcb1757c15b656f16648f6b0171082f4
Opcode Fuzzy Hash: 2a81c1210149c6693820402e63967d0ba520067a8e35647833344102a87a4d2e
Instruction Fuzzy Hash: 9301D43265D222EBCB214B69EC44F9A7798EF85BA1F210720FD26E7240D620DD00CAE1

Function 00C8B61A Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633
GetFileSize.KERNEL32(00000000,00000000), ref: 00C8B647
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00C8B66C
CloseHandle.KERNEL32(00000000), ref: 00C8B67A

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: 63b9d20d8bcc8b45ad10f88b14c2ff5b348429c57d08e707bbd2c3991a156e55
Instruction ID: ea9217e9c9dd347ac1327a904658ff246579ef408074e255ff789f68a062c9a4
Opcode Fuzzy Hash: 63b9d20d8bcc8b45ad10f88b14c2ff5b348429c57d08e707bbd2c3991a156e55
Instruction Fuzzy Hash: CDF0F6B1205214BFE6142B25EC89FBF375CDB867A8F000329FC0192190DA614D055634

Function 00C8850C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 00C88519
GetSystemMetrics.USER32(0000004D), ref: 00C8851F
GetSystemMetrics.USER32(0000004E), ref: 00C88525
GetSystemMetrics.USER32(0000004F), ref: 00C8852B

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 606eaa01dc3090180b0ac4ad0d8ebc3bc4b75be77ee30ad2c043ad1471c3b109
Instruction ID: 1df99f4332b2e5448de42a234216baaa01209a94a4bd480e4c4e68ac79c0ea24
Opcode Fuzzy Hash: 606eaa01dc3090180b0ac4ad0d8ebc3bc4b75be77ee30ad2c043ad1471c3b109
Instruction Fuzzy Hash: 9BF02B62B043154BDA00FE798C0451FAB969FC02A4F25092AF50597341EE74EC0957D8

Function 00C8B37D Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 00C8B395
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 00C8B3A8
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00C8B3D3
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00C8B3DB

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcess
String ID:
API String ID: 39102293-0
Opcode ID: 57beb9108bc05eb8300389fdc294affa618a6c9fa04cdc7052c1f982e4c04775
Instruction ID: 436fc518e0fd263ff42efd07af180042464629bc830c1845700fdeea533a1d14
Opcode Fuzzy Hash: 57beb9108bc05eb8300389fdc294affa618a6c9fa04cdc7052c1f982e4c04775
Instruction Fuzzy Hash: 76F0F471204616BBD3117359DC5EF6FB26CDB44799F000121FA65D22B0EFB08D414B65

Function 00C73A10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00C73A2A

Part of subcall function 00C8AB38: GetCurrentProcessId.KERNEL32(00000000,76233530,00000000,?,?,?,?,00CD5900,00C7C07B,.vbs,?,?,?,?,?,00CE42F8), ref: 00C8AB5F

Part of subcall function 00C876B6: CloseHandle.KERNEL32(00C73AB9,?,?,00C73AB9,00CD5324), ref: 00C876CC
Part of subcall function 00C876B6: CloseHandle.KERNEL32(00CD5324,?,?,00C73AB9,00CD5324), ref: 00C876D5

Part of subcall function 00C8B61A: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00C79F65), ref: 00C8B633

Sleep.KERNEL32(000000FA,00CD5324), ref: 00C73AFC

Strings

/sort "Visit Time" /stext ", xrefs: 00C73A76

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "
API String ID: 368326130-1573945896
Opcode ID: 04ade3110d11d5d151825a8d19ec91acbcc3da4e255e6bc3889f7882309b12c2
Instruction ID: 86d46f37e2a14d3dc1ab3c68d58aa385f514e285f6f3f1d16eb51f77abdbff0b
Opcode Fuzzy Hash: 04ade3110d11d5d151825a8d19ec91acbcc3da4e255e6bc3889f7882309b12c2
Instruction Fuzzy Hash: 25318431A001545BCB18F7B8DC9ADFE7775AF90310F448169F80EA7192EF305A4AEB91

Function 00CC08DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00CC0B39,?,00000050,?,?,?,?,?), ref: 00CC09B9

Strings

OCP, xrefs: 00CC0932
ACP, xrefs: 00CC08FC

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: a3a0e9cf7f794a8827f35afffe84f8f457369b5f26ca0da143daa83d212e4378
Instruction ID: 4fe5b8aaf3ddbd6182ffdac54672bcf3671bec05087d0e36c20d0a1a77c7bd40
Opcode Fuzzy Hash: a3a0e9cf7f794a8827f35afffe84f8f457369b5f26ca0da143daa83d212e4378
Instruction Fuzzy Hash: 1A21C562A14201E6FB349B55C901F9773AAEB94B20F76452CED5AD7202F732DF40C390

Function 00C7AE58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00CA3519: EnterCriticalSection.KERNEL32(00CE0D18,?,00CE5D2C,?,00C7AE8B,00CE5D2C,?,00000000,00000000), ref: 00CA3524
Part of subcall function 00CA3519: LeaveCriticalSection.KERNEL32(00CE0D18,?,00C7AE8B,00CE5D2C,?,00000000,00000000), ref: 00CA3561

Part of subcall function 00CA38A5: __onexit.LIBCMT ref: 00CA38AB

__Init_thread_footer.LIBCMT ref: 00C7AEA7

Part of subcall function 00CA34CF: EnterCriticalSection.KERNEL32(00CE0D18,00CE5D2C,?,00C7AEAC,00CE5D2C,00CC6D97,?,00000000,00000000), ref: 00CA34D9
Part of subcall function 00CA34CF: LeaveCriticalSection.KERNEL32(00CE0D18,?,00C7AEAC,00CE5D2C,00CC6D97,?,00000000,00000000), ref: 00CA350C

Strings

[End of clipboard], xrefs: 00C7AEE9
[Text copied to clipboard], xrefs: 00C7AEF6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 2974294136-3686566968
Opcode ID: 216a9c665d1147c833650b1e47ff1c5a69d0e5d056bc29f9a9ce9c9b72de6a17
Instruction ID: d4498d04ca6a471b5c338c99968198ef7fba72a7c3ca58683b1bf62be0c5d89d
Opcode Fuzzy Hash: 216a9c665d1147c833650b1e47ff1c5a69d0e5d056bc29f9a9ce9c9b72de6a17
Instruction Fuzzy Hash: A621EA31A001198BCB14FBB8DC96DED7775AF94314F44803AF90A67192EF305E4AD791

Function 00C749BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00CE3EE8,00CE45A8,?,?,?,?,?,?,?,00C84D7D,?,00000001,0000004C,00000000), ref: 00C749F1

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

GetLocalTime.KERNEL32(?,00CE3EE8,00CE45A8,?,?,?,?,?,?,?,00C84D7D,?,00000001,0000004C,00000000), ref: 00C74A4E

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00C749E5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 2ae36602a474470c212424e26a531956efa8227103beb7bfec020bb0b49fe3bb
Instruction ID: a4b869fa8ab3224d5ff8029fb4918f7e09bba54dc7426e8e0bbe69190aa0f77e
Opcode Fuzzy Hash: 2ae36602a474470c212424e26a531956efa8227103beb7bfec020bb0b49fe3bb
Instruction Fuzzy Hash: 0F215B629042C0AFD71DF769CC4A79F7BAC9791325F48800DF80947262EB245609D79B

Function 00C8A686 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

Strings

| , xrefs: 00C8A6D3
%02i:%02i:%02i:%03i , xrefs: 00C8A6B5

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i
API String ID: 481472006-2430845779
Opcode ID: 48f433442fbc0197cef80799fdc45692ab618109eb471c34813e7438e9412deb
Instruction ID: 10ddf7f86958390b4ead5a79221b82199bc2c0ff41b91c4c4e3c38030444f041
Opcode Fuzzy Hash: 48f433442fbc0197cef80799fdc45692ab618109eb471c34813e7438e9412deb
Instruction Fuzzy Hash: DC1182725082449BC704FBA4DC559BF73ECAB98700F54852EFC89821D1EF34DA88E756

Function 00C7A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 00C7A876: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 00C7A884
Part of subcall function 00C7A876: wsprintfW.USER32 ref: 00C7A905

Part of subcall function 00C8A686: GetLocalTime.KERNEL32(00000000), ref: 00C8A6A0

CloseHandle.KERNEL32(?), ref: 00C7A7CA
UnhookWindowsHookEx.USER32 ref: 00C7A7DD

Strings

Online Keylogger Stopped, xrefs: 00C7A777, 00C7A77F, 00C7A7A6

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: af5985539f4eb53a4609f496c1de391967be49638644849b912d1af6eb519289
Instruction ID: 5a3fdbe894f807c057958ece7ed0b9d8eeaf51f68013300e061e5437d0fb179d
Opcode Fuzzy Hash: af5985539f4eb53a4609f496c1de391967be49638644849b912d1af6eb519289
Instruction Fuzzy Hash: B7019E31A082009BDB297778CC0B7BD7FB99F81310F84805DF84602192DB615945E7D3

Function 00C7AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 00C7AD5B

Part of subcall function 00C79B10: GetForegroundWindow.USER32(?,?,00CE40F8), ref: 00C79B3F
Part of subcall function 00C79B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00C79B4B
Part of subcall function 00C79B10: GetKeyboardLayout.USER32(00000000), ref: 00C79B52
Part of subcall function 00C79B10: GetKeyState.USER32(00000010), ref: 00C79B5C
Part of subcall function 00C79B10: GetKeyboardState.USER32(?,?,00CE40F8), ref: 00C79B67
Part of subcall function 00C79B10: ToUnicodeEx.USER32(00CE414C,?,?,?,00000010,00000000,00000000), ref: 00C79B8A
Part of subcall function 00C79B10: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00C79BE3

Part of subcall function 00C79D58: SetEvent.KERNEL32(?,?,00000000,00C7A91C,00000000), ref: 00C79D84

Strings

[AltR], xrefs: 00C7AD91
[AltL], xrefs: 00C7AD9D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: bbfec1d35a9532878cac9e48b02f692de33ae09fba9c93929b8bc588f145231d
Instruction ID: 3f192343b7aa8ec87413f8bf0026dcba885922252b8f2e356fdcc7cb89a9dfd5
Opcode Fuzzy Hash: bbfec1d35a9532878cac9e48b02f692de33ae09fba9c93929b8bc588f145231d
Instruction Fuzzy Hash: DFE09221740621178A78323EAA2F7FD3D32DB92F61B80814DF88E5BA95DD954E4093D3

Function 00C7ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 00C7ADB5

Strings

[CtrlR], xrefs: 00C7ADD2
[CtrlL], xrefs: 00C7ADE3

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: 4cd768b406c4a06fe51590e0bf78fbedec0e7541ae23c520db00f343811f40b4
Instruction ID: 6f24d42799fd66da97971f2685ae3a37d1211660740dd0838b8214debacc17c2
Opcode Fuzzy Hash: 4cd768b406c4a06fe51590e0bf78fbedec0e7541ae23c520db00f343811f40b4
Instruction Fuzzy Hash: EDE08621700711178634363DD71FA7D2921CBA5762F804119F96A4BAC5D9554A4023D3

Function 00C8297A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,00C7BFB2,00000000,00CE42E0,00CE42F8,?,pth_unenc), ref: 00C82988
RegDeleteValueW.ADVAPI32(?,?,?,pth_unenc), ref: 00C82998

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00C82986

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: b6d80b60a0a3d35d3904c84c1678781043fc5a3345eb2f147f7777e3e18d3908
Instruction ID: d49311c9d55d8e08f5ac79f0a5547f8dfbea933cd616f4768a23f64cd1a6854d
Opcode Fuzzy Hash: b6d80b60a0a3d35d3904c84c1678781043fc5a3345eb2f147f7777e3e18d3908
Instruction Fuzzy Hash: 9EE01270200304BBEF106F61DC0AF9A3BACFB40B88F004164F516E5090E275DE04AB54

Function 00C7AF77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 00C7AF84
RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 00C7AFAF

Strings

pth_unenc, xrefs: 00C7AF77

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: DeleteDirectoryFileRemove
String ID: pth_unenc
API String ID: 3325800564-4028850238
Opcode ID: 10cc9c38c4c9bb4c47a2813af1c37b9a2225bced38c24c9be1d0d3c861eb4e69
Instruction ID: 3b9a8f530b9e787e4c8f8f0f105c126b64a4fe7d0a856fc8e8b7164b1d195023
Opcode Fuzzy Hash: 10cc9c38c4c9bb4c47a2813af1c37b9a2225bced38c24c9be1d0d3c861eb4e69
Instruction Fuzzy Hash: 80E08C714006108FCB14AB74DC58BEBB3ACFF05312F04892AF8E793221DF249A49EA90

Function 00C81699 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(00000000,pth_unenc,00C7E670), ref: 00C816A9
WaitForSingleObject.KERNEL32(000000FF), ref: 00C816BC

Strings

pth_unenc, xrefs: 00C81699

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ObjectProcessSingleTerminateWait
String ID: pth_unenc
API String ID: 1872346434-4028850238
Opcode ID: 3f54f4c0accddfac991bb326eb8a5bb6bd3855398d4c83ea4aebad107d531189
Instruction ID: 47dca5648315fad8130d383e2cb37c706bbb6c7f4d8c6f00653ffd3897803064
Opcode Fuzzy Hash: 3f54f4c0accddfac991bb326eb8a5bb6bd3855398d4c83ea4aebad107d531189
Instruction Fuzzy Hash: A3D0C9385491919FE7424B61AC88B4D3AA9E705A22F588306FC21852F0C7354574AA14

Function 00CBE0EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00CBE0EB
GetCommandLineW.KERNEL32 ref: 00CBE0F6

Strings

5, xrefs: 00CBE0F1

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: 5
API String ID: 3253501508-3632891597
Opcode ID: b4aedc8b4e0c0deff884830f8abf4814af07dadb05f85e8939ed96f8850cc226
Instruction ID: 4cab73c0111fc65b96594a2054436e0e477597475744b9fcc3fa38fc6f0913b2
Opcode Fuzzy Hash: b4aedc8b4e0c0deff884830f8abf4814af07dadb05f85e8939ed96f8850cc226
Instruction Fuzzy Hash: 36B008798052408B8B419F66EE9C75C3AA0E66861239855A5DC1986A24DA394096AF10

Function 00CAFA5E Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00C71AD8), ref: 00CAFAF4
GetLastError.KERNEL32 ref: 00CAFB02
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CAFB5D

Memory Dump Source

Source File: 00000006.00000002.4641788822.0000000000C70000.00000040.00000400.00020000.00000000.sdmp, Offset: 00C70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c70000_SHROsQyiAd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: b40cedfd14257f3643217aa4d19c1a90b10c34bca184623578cf7255e8ef046c
Instruction ID: 70c082746407627f864ef1c9e98f957ac3be3d07a5c6315e4009cbc0dda2c025
Opcode Fuzzy Hash: b40cedfd14257f3643217aa4d19c1a90b10c34bca184623578cf7255e8ef046c
Instruction Fuzzy Hash: F041C631604257AFCF218FA5D854BBABBB5EF02358F1441BDF869972A5DB308E02D760

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SHROsQyiAd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\data\registros.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

C:\Users\user\Favorites\VS Code\user-data\Code.exe

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
SHROsQyiAd.exe

Function 00C8BCE3 Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140
libraryloaderCOMMON

Function 00C799E4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65
windowCOMMON

Function 00C79B10 Relevance: 12.1, APIs: 8, Instructions: 108
keyboardthreadCOMMON

Function 00C7E54F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88
sleepCOMMON

Function 00C7D767 Relevance: 46.3, APIs: 13, Strings: 13, Instructions: 799
COMMON

Function 00C83FD4 Relevance: 32.3, APIs: 5, Strings: 13, Instructions: 813
sleepnetworkCOMMON

Function 00C7428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147
networkCOMMON

Function 00C7A3F4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 158
sleepCOMMON

Function 00C7C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Function 00C8A51B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
networkfileCOMMON

Function 00C8A463 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Function 00C79E48 Relevance: 9.2, APIs: 6, Instructions: 163
sleepCOMMON

Function 00C798A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
threadCOMMON

Function 00C74915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
timethreadCOMMON

Function 00C826D2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
registryCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre