Edit tour

Windows Analysis Report
stealcy11.exe

Overview

General Information

Sample name:	stealcy11.exe
Analysis ID:	1579700
MD5:	004431fc72fc1228abf10e298efa0271
SHA1:	05195b1a70f078c9116998d7486e672d90e93218
SHA256:	082796fccb8ffb566a99ba188cae572eac30f1bf6e11a7bf4e5ebe757bc66c88
Tags:	exeStealCuser-lontze7
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

stealcy11.exe (PID: 7784 cmdline: "C:\Users\user\Desktop\stealcy11.exe" MD5: 004431FC72FC1228ABF10E298EFA0271)

WerFault.exe (PID: 8164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1384 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "https:/135.181.65.216/ee45b7c5e4cb75cb.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
stealcy11.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.1341588473.000000000090B000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: stealcy11.exe PID: 7784	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: stealcy11.exe PID: 7784	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.stealcy11.exe.8e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.stealcy11.exe.8e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:58:48.693601+0100	2028765	3	Unknown Traffic	192.168.2.9	49712	135.181.65.216	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: stealcy11.exe

Avira: detected

Found malware configuration

Source: stealcy11.exe.7784.0.memstrmin

Malware Configuration Extractor: StealC {"C2 url": "https:/135.181.65.216/ee45b7c5e4cb75cb.php"}

Multi AV Scanner detection for submitted file

Source: stealcy11.exe	ReversingLabs: Detection: 60%
Source: stealcy11.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: stealcy11.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 01
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 03
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 20
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 25
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Sleep
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: user32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sscanf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: https://135.181.65.216
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: /ee45b7c5e4cb75cb.php
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: /4a21a126be249f0d/
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: default
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HeapFree
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Process32Next
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Process32First
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: LocalFree
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: FindClose
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ReadFile
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: WriteFile
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetLastError
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SelectObject
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BitBlt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GdipFree
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetDC
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: StrStrA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RmGetList
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PATH
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: browser:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: profile:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: url:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: login:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: password:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Opera
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: OperaGX
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Network
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: cookies
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: .txt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: TRUE
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: FALSE
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: autofill
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: history
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: cc
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: name:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: month:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: year:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: card:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Cookies
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Login Data
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Web Data
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: History
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: logins.json
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: usernameField
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: guid
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: plugins
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: CURRENT
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Local State
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: chrome
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: opera
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: firefox
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: wallets
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ProductName
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: x32
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: x64
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DisplayName
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Network Info:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: System Summary:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - HWID:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - OS:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - UserName:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - UTC:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Language:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - CPU:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Threads:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Cores:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - RAM:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: - GPU:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: User Agents:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: All Users:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Current User:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Process List:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Temp\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: .exe
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: runas
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: open
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: /c start
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: *.lnk
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: files
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \discord\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: key_datas
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: map*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Telegram
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Tox
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: *.tox
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: *.ini
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Password
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 00000001
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 00000002
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 00000003
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: 00000004
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Pidgin
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \.purple\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: token:
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: SteamPath
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \config\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ssfn*
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: config.vdf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Steam\
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: done
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: soft
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: https
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: POST
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: hwid
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: build
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: token
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: file_name
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: file
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: message
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.stealcy11.exe.8e0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_008E4B80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_008E4B80
Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_00904090 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00904090
Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_008E7690 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_008E7690
Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_008E6000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_008E6000
Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_008E9B80 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_008E9B80
Source: C:\Users\user\Desktop\stealcy11.exe	Code function: 0_2_008E9BE0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_008E9BE0

Source: stealcy11.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: stealcy11.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https:/135.181.65.216/ee45b7c5e4cb75cb.php

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Network traffic

Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49712 -> 135.181.65.216:443

Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_008E56C0 lstrcpy,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,memcpy,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_008E56C0

Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216
Source: stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/
Source: stealcy11.exe, 00000000.00000002.1847814103.000000000110F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/W
Source: stealcy11.exe, 00000000.00000002.1847814103.000000000110F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/z

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_008E97A0 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_008E97A0

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: String function: 008E4980 appears 316 times

Source: C:\Users\user\Desktop\stealcy11.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1384

Source: stealcy11.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009046C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_009046C0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7784

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\0c254e9b-4ef5-48a0-bc2a-e3c304dc47dc

Jump to behavior

Source: stealcy11.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\stealcy11.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: stealcy11.exe	ReversingLabs: Detection: 60%
Source: stealcy11.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\stealcy11.exe "C:\Users\user\Desktop\stealcy11.exe"
Source: C:\Users\user\Desktop\stealcy11.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1384

Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: stealcy11.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009063C0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009063C0

Source: C:\Users\user\Desktop\stealcy11.exe

0_2_009063C0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5657

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: stealcy11.exe, 00000000.00000002.1847814103.0000000001123000.00000004.00000020.00020000.00000000.sdmp, stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\stealcy11.exe

API call chain: ExitProcess graph end node

graph_0-5436

Source: C:\Users\user\Desktop\stealcy11.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_008E5570 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,memcpy,InternetReadFile,LdrInitializeThunk,InternetCloseHandle,InternetCloseHandle,

0_2_008E5570

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_008E4980 VirtualProtect 00000000,00000004,00000100,?

0_2_008E4980

Source: C:\Users\user\Desktop\stealcy11.exe

0_2_009063C0

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009063C0 mov eax, dword ptr fs:[00000030h]

0_2_009063C0

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009028B0 GetProcessHeap,HeapAlloc,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,

0_2_009028B0

Source: C:\Users\user\Desktop\stealcy11.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: stealcy11.exe PID: 7784, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009046C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_009046C0

Source: C:\Users\user\Desktop\stealcy11.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\stealcy11.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_00903E10 lstrcpy,lstrcpy,GetSystemTime,

0_2_00903E10

Source: C:\Users\user\Desktop\stealcy11.exe

Code function: 0_2_009029E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_009029E0

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: stealcy11.exe, type: SAMPLE
Source: Yara match	File source: 0.2.stealcy11.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.stealcy11.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1341588473.000000000090B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealcy11.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: stealcy11.exe, type: SAMPLE
Source: Yara match	File source: 0.2.stealcy11.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.stealcy11.exe.8e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1341588473.000000000090B000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealcy11.exe PID: 7784, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 Create Account	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
stealcy11.exe	61%	ReversingLabs	Win32.Trojan.StealC
stealcy11.exe	57%	Virustotal		Browse
stealcy11.exe	100%	Avira	TR/Crypt.ZPACK.Gen
stealcy11.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https:/135.181.65.216/ee45b7c5e4cb75cb.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://135.181.65.216/W	stealcy11.exe, 00000000.00000002.1847814103.000000000110F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	high
https://135.181.65.216/	stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://135.181.65.216	stealcy11.exe, 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://135.181.65.216/z	stealcy11.exe, 00000000.00000002.1847814103.000000000110F000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
135.181.65.216	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579700
Start date and time:	2024-12-23 07:57:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	stealcy11.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 17 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 13.107.246.63, 20.12.23.50, 20.190.147.2, 20.109.210.53
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:59:32	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	skIYOAOzvU.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	fiFdIrd.txt.js	Get hash	malicious	Unknown	Browse	13.107.246.63
	mPQW1NB2Px.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	uw7vXaPNPF.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	HOEcO4nqCT.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	D7M4c24p9T.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	gjEtERlBSv.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.63
	clip64.dll	Get hash	malicious	Amadey	Browse	13.107.246.63
	https://staging.effimate.toyo.ai-powered-services.com/	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	213.239.239.164
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	135.181.58.223
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57
	https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvV	Get hash	malicious	Unknown	Browse	136.243.5.53
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stealcy11.exe_ee10818b3e9e17f62f4aac373bb9c253d7b698c_5b291f0b_eab3bab9-b6ef-436b-b0de-580fab6d54df\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9522942431940097
Encrypted:	false
SSDEEP:	192:JnrcLw0BU/Hn2nbjvYZrRtozuiFUZ24IO8CnV:Zr4LBU/HMbjeazuiFUY4IO8wV
MD5:	FC278DED03D45B0F3166CDF831807D81
SHA1:	73989FEC61CB40D947690AF1CB7DEA21704F1326
SHA-256:	E0E206B4B216A008490DB87454F6BDAEAA92D55FCB518372A555B373FA36C6CD
SHA-512:	1975668AB83A326DDE504195F13BDE7B70DBC4DA17F8F546B7E725D2139E00D26B3075EF24C53EF8E596C1EFA7284D2141C02ACBEC1482E40298D30DC08D6DC4
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.1.0.7.4.5.4.3.7.5.2.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.1.0.7.4.6.4.2.1.8.9.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.b.3.b.a.b.9.-.b.6.e.f.-.4.3.6.b.-.b.0.d.e.-.5.8.0.f.a.b.6.d.5.4.d.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.4.6.f.f.7.d.-.c.3.7.1.-.4.6.8.b.-.9.2.2.3.-.4.f.a.7.b.9.9.a.5.4.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.t.e.a.l.c.y.1.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.6.8.-.0.0.0.1.-.0.0.1.4.-.c.8.9.5.-.0.0.1.a.0.8.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.9.f.2.1.d.6.6.5.1.9.0.e.a.9.e.3.4.b.8.d.a.d.0.c.d.e.a.d.8.f.0.0.0.0.f.f.f.f.!.0.0.0.0.0.5.1.9.5.b.1.a.7.0.f.0.7.8.c.9.1.1.6.9.9.8.d.7.4.8.6.e.6.7.2.d.9.0.e.9.3.2.1.8.!.s.t.e.a.l.c.y.1.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD69.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Dec 23 06:59:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	120282
Entropy (8bit):	1.6038957628368737
Encrypted:	false
SSDEEP:	384:klwQmieeEPYKkrZdoJbLz1QGtIfFYA7b/cTtyiu8VD:4wleEPkdodLhMfvoToE
MD5:	4E91700F1BCB5AC3150E27E2870114B6
SHA1:	8D1A390953EF4BD6253CE983881A410E90D121CA
SHA-256:	C73E3AC38CBD587E8ECF027755D01F58358F9AE95375A5DCC2CB23D13427774C
SHA-512:	737A4730416ED8B700A5F3E44151440A48B186D09111EAA9F548930C6DE0BAFEA569A17C28803142ABF77E6A438B81AC7F5909D09FB5D4861E744B9F98B46A3D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......:.ig.........................................B..........T.......8...........T...........p6..j.......................................................................................................eJ......\ ......GenuineIntel............T.......h...".ig.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE048.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.692819113543501
Encrypted:	false
SSDEEP:	192:R6l7wVeJgw6PEKqKz6YcDOSUpGdgmfgYpr+89bgAsf2Am:R6lXJP6XqKz6YZSUpGdgmfgqgTfo
MD5:	6C49D1032EBDFE2751AC4111511D1C9F
SHA1:	8FA64CB4BCE619B641F8A4A71B4582C6D0819140
SHA-256:	5D5441F2510D7C0CE75BCB2302707FA264E9309D30F1A11DFE67AFE27ACDF106
SHA-512:	328DC89BDC4CD1C381470DA6B3A1172673160EA0D51E5EDF4305C1D1E87EE365F82D05F56EA1B13F6263D13DADC692B599A141FAE0851F066F23317279EAE5FB
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE078.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4578
Entropy (8bit):	4.438496723589363
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnxJg77aI9roWpW8VYqp/Ym8M4J2LeFlXj+q88sT29sSZWd:uIjfnDI71B7V7kJ2i/OgdZWd
MD5:	A13386F06A5BA0721149014849899F92
SHA1:	D619030400BB147AA4A58D0A86AFEFF9794CFEE7
SHA-256:	75AE618624295B2C6F131BE64BAF6B022B442FC4C86AC923CE5BC937BA713E83
SHA-512:	1E0D2EC83497F3865AAB5D3AD3AD44E5BDFFCD8DF63FFF1EFF0D08F8B01A3FEB61253F1FBA578FCFB671589D0FC8B2C1C711EC7E0AB288627B563D31F123B361
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643561" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393732706427489
Encrypted:	false
SSDEEP:	6144:Dl4fiJoH0ncNXiUjt10qYG/gaocYGBoaUMMhA2NX4WABlBuNAsOBSqa:B4vFYMYQUMM6VFYSsU
MD5:	108C36402BFEF432D901AECE821EC476
SHA1:	C74DBFAE6366A8D8A0A2785B827AA4D4647EE1F3
SHA-256:	A2E5C1E213D3272840718B1530353E5AC90D8EEDD24DDBD65D8DDBA3B3C7A44B
SHA-512:	684983DCADD2BDAB8C5F942FE62FD38D6AE90336D5B4E292F01F1580FB635E669C81C87F2F73750FB568EC959AE2AF0DE61B217E3712E52033CB1E070E6A8478
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...'.U..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.573123644643754
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	stealcy11.exe
File size:	245'760 bytes
MD5:	004431fc72fc1228abf10e298efa0271
SHA1:	05195b1a70f078c9116998d7486e672d90e93218
SHA256:	082796fccb8ffb566a99ba188cae572eac30f1bf6e11a7bf4e5ebe757bc66c88
SHA512:	8e1c87b177cd3cd687760f002fea6851ae34b2543df434ed1db4146a33a684f5a386e4e6d9d76bd14e064dd29fe6cc1cb0407cac10abf0c9cd4513eefcac8335
SSDEEP:	3072:sCFW6ZRlcV3K+gqCClq/oPk1U894z1tJS7pmLUMOmjoRWwhSeUReHeP3KqX+n:j1J7+go0U8evIFmLu6kKeot+
TLSH:	6D341925DF41403FEE12867CD6F963D1B22669A46322D8D733CC25198DF40E32D7E6AA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L...!.gg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x421bd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6767E521 [Sun Dec 22 10:08:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d071ac95ea1d6b0ed6ec53017449901f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 34h
push ebx
push esi
push edi
call 00007F2A20F0A257h
call 00007F2A20F2DC72h
xor ebx, ebx
cmp byte ptr [0042D014h], bl
je 00007F2A20F2949Fh
lea ecx, dword ptr [ecx+00h]
inc ebx
cmp byte ptr [ebx+0042D014h], 00000000h
jne 00007F2A20F29488h
lea eax, dword ptr [ebx+01h]
call 00007F2A20F0A0D3h
mov dword ptr [ebp-10h], eax
test eax, eax
je 00007F2A20F2949Eh
push 0042D014h
push eax
call dword ptr [00639134h]
call dword ptr [006390E4h]
movzx eax, ax
add eax, FFFFFBE7h
cmp eax, 2Ah
jnbe 00007F2A20F294A8h
movzx eax, byte ptr [eax+00421E54h]
jmp dword ptr [00421E4Ch+eax*4]
push 00000000h
call dword ptr [0063901Ch]
call 00007F2A20F2A2C2h
mov ecx, dword ptr [00638D40h]
call 00007F2A20F2B5F7h
test eax, eax
jne 00007F2A20F294ADh
call 00007F2A20F2A21Eh
mov ecx, dword ptr [00638E1Ch]
call 00007F2A20F2B5E3h
test eax, eax
jne 00007F2A20F29499h
push eax
call dword ptr [0063901Ch]
mov edi, dword ptr [00638D40h]
push edi
call dword ptr [00638FACh]
lea esi, dword ptr [ebx+eax]
lea eax, dword ptr [esi+01h]
call 00007F2A20F0A050h
mov ebx, eax
mov dword ptr [ebp-34h], ebx
test ebx, ebx
je 00007F2A20F294ADh
mov eax, dword ptr [ebp-10h]
test eax, eax
je 00007F2A20F294A6h
test edi, edi

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36644	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24a000	0x3c7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2951a	0x29600	df2d115e7c4d351090d551d0efaa4319	False	0.40288071185800606	data	6.375878850752631	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xbba4	0xbc00	0842159b30b0a5e7723012d6bde04732	False	0.5963056848404256	data	6.667148204014933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x212bec	0xc00	f7d82f3649bd5266c892c8c1b457e92b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x24a000	0x5d00	0x5e00	62b76e5280e9e60573614263fb763b9c	False	0.5253075132978723	data	5.2508129632036535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

msvcrt.dll

rand, strncpy, ??_V@YAXPAX@Z, strtok, memchr, strtok_s, ??_U@YAPAXI@Z, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3, _except_handler3

KERNEL32.dll

InitializeCriticalSectionAndSpinCount, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, GetOEMCP, GetACP, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetCPInfo, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, RaiseException

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T07:58:48.693601+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49712	135.181.65.216	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:58:43.838241100 CET	49712	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:43.838290930 CET	443	49712	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:43.838567019 CET	49712	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:43.854825020 CET	49712	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:43.854850054 CET	443	49712	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:48.693377018 CET	443	49712	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:48.693600893 CET	49712	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:48.693717957 CET	49712	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:48.693751097 CET	443	49712	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:48.694417000 CET	49723	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:48.694458008 CET	443	49723	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:48.694540024 CET	49723	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:48.694829941 CET	49723	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:48.694843054 CET	443	49723	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:53.397090912 CET	443	49723	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:53.397186995 CET	49723	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:53.397301912 CET	49723	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:53.397345066 CET	443	49723	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:53.398099899 CET	49734	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:53.398169041 CET	443	49734	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:53.398283958 CET	49734	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:53.398360014 CET	49734	443	192.168.2.9	135.181.65.216
Dec 23, 2024 07:58:53.398406029 CET	443	49734	135.181.65.216	192.168.2.9
Dec 23, 2024 07:58:53.398503065 CET	49734	443	192.168.2.9	135.181.65.216

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:58:39.600608110 CET	1.1.1.1	192.168.2.9	0x6ebf	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 07:58:39.600608110 CET	1.1.1.1	192.168.2.9	0x6ebf	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	01:58:42
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\stealcy11.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\stealcy11.exe"
Imagebase:	0x8e0000
File size:	245'760 bytes
MD5 hash:	004431FC72FC1228ABF10E298EFA0271
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.1341588473.000000000090B000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1847814103.00000000010BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:59:05
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1384
Imagebase:	0x650000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.2%
Total number of Nodes:	1290
Total number of Limit Nodes:	33

Executed Functions

Function 008E4B80 Relevance: 111.1, APIs: 61, Strings: 2, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008E4BAF
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E4C02
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E4C35
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E4C65
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E4CA3
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E4CD6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008E4CE6

Strings

", xrefs: 008E5154, 008E5242
------, xrefs: 008E4E0C, 008E4E39, 008E50BB, 008E51AC

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: ae8dcca9af472f32055079f92bb68bc62b5b787b907d158f2cde49efe1371428
Instruction ID: f5f5f25b3c8dd4bf35211fb52bc38923f7d9979922704d9cd902c57807a63d88
Opcode Fuzzy Hash: ae8dcca9af472f32055079f92bb68bc62b5b787b907d158f2cde49efe1371428
Instruction Fuzzy Hash: 54527D31D016969FCB20ABB9CC49B9EBBB9FF46310F155024F909E7251DB70ED428BA1

Function 008E56C0 Relevance: 97.0, APIs: 51, Strings: 4, Instructions: 734
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008E56EF
lstrlenA.KERNEL32(?), ref: 008E5742
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E5784
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E57C3
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E57F3
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E5828

Strings

--, xrefs: 008E598F, 008E59B7
", xrefs: 008E5BA4, 008E5C92, 008E5D80
------, xrefs: 008E5B0B, 008E5BFC, 008E5CEA
------, xrefs: 008E5929, 008E5956

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ------$"$--$------
API String ID: 367037083-1406108388
Opcode ID: 37f2801e25dee3c4c1f79befccc628394c0ecd4c01d16ef96ba0ba8b28a42e02
Instruction ID: c996238f9c8e91e364bc124ee015fd3e031eb263dfbdf2029869d2797499723f
Opcode Fuzzy Hash: 37f2801e25dee3c4c1f79befccc628394c0ecd4c01d16ef96ba0ba8b28a42e02
Instruction Fuzzy Hash: 28426A31E006999FCB10EBB9CC45AAFBBB9FF49314F054424BA05E7252DE74AD028BD1

Function 008E4980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4994
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E499B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49A2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49A9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49B0
GetProcessHeap.KERNEL32(00000000,?), ref: 008E49BB
RtlAllocateHeap.NTDLL(00000000), ref: 008E49C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49D9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49E0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49E7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49EE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E49F9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A00
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A07
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A0E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A15
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A2B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A32
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A39
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A40
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A47
strlen.MSVCRT ref: 008E4A4F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A73
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A7A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A81
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A88
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A8F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4A9F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4AA6
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4AAD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4AB4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 008E4ABB
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 008E4AD0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008E498F, 008E4996, 008E499D, 008E49A4, 008E49AB, 008E49CA, 008E49D4, 008E49DB, 008E49E2, 008E49E9, 008E49F0, 008E49FB, 008E4A02, 008E4A09, 008E4A10, 008E4A26, 008E4A2D, 008E4A34, 008E4A3B, 008E4A42, 008E4A63, 008E4A75, 008E4A7C, 008E4A83, 008E4A8A, 008E4A9A, 008E4AA1, 008E4AA8, 008E4AAF, 008E4AB6

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: 8e69d7020359eff6a88df4a5702e101eb965f10de65de9616fab4be6f77c8d33
Instruction ID: d5ca50208b36be819637ef61c29e0985d89a19d9e88b3ce8597fea8b5034395a
Opcode Fuzzy Hash: 8e69d7020359eff6a88df4a5702e101eb965f10de65de9616fab4be6f77c8d33
Instruction Fuzzy Hash: 0131F6A0F8432C7ED6206FA67C8A9DF7E54DFCC768B704052F51856388C9A06486CEE2

Function 009063C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,010C37F8), ref: 00906419
GetProcAddress.KERNEL32(76F70000,010C3828), ref: 00906432
GetProcAddress.KERNEL32(76F70000,010C38D0), ref: 0090644A
GetProcAddress.KERNEL32(76F70000,010C3900), ref: 00906462
GetProcAddress.KERNEL32(76F70000,010C1450), ref: 0090647B
GetProcAddress.KERNEL32(76F70000,010BABD0), ref: 00906493
GetProcAddress.KERNEL32(76F70000,010BAD10), ref: 009064AB
GetProcAddress.KERNEL32(76F70000,010C3978), ref: 009064C4
GetProcAddress.KERNEL32(76F70000,010C3918), ref: 009064DC
GetProcAddress.KERNEL32(76F70000,010C3A50), ref: 009064F4
GetProcAddress.KERNEL32(76F70000,010C3930), ref: 0090650D
GetProcAddress.KERNEL32(76F70000,010BAD30), ref: 00906525
GetProcAddress.KERNEL32(76F70000,010C39D8), ref: 0090653D
GetProcAddress.KERNEL32(76F70000,010C39F0), ref: 00906556
GetProcAddress.KERNEL32(76F70000,010BADB0), ref: 0090656E
GetProcAddress.KERNEL32(76F70000,010C3A20), ref: 00906586
GetProcAddress.KERNEL32(76F70000,010C3A38), ref: 0090659F
GetProcAddress.KERNEL32(76F70000,010BAB50), ref: 009065B7
GetProcAddress.KERNEL32(76F70000,010C3B28), ref: 009065CF
GetProcAddress.KERNEL32(76F70000,010BAEB0), ref: 009065E8
LoadLibraryA.KERNEL32(010C3B40,?,?,?,00901BE3), ref: 009065F9
LoadLibraryA.KERNEL32(010C3AE0,?,?,?,00901BE3), ref: 0090660B
LoadLibraryA.KERNEL32(010C3AF8,?,?,?,00901BE3), ref: 0090661D
LoadLibraryA.KERNEL32(010C3B10,?,?,?,00901BE3), ref: 0090662E
LoadLibraryA.KERNEL32(010C3BA0,?,?,?,00901BE3), ref: 00906640
GetProcAddress.KERNEL32(76DA0000,010C3B70), ref: 0090665D
GetProcAddress.KERNEL32(75840000,010C3B88), ref: 00906679
GetProcAddress.KERNEL32(75840000,010C3B58), ref: 00906691
GetProcAddress.KERNEL32(753A0000,010C2840), ref: 009066AD
GetProcAddress.KERNEL32(77300000,010BAD50), ref: 009066C9
GetProcAddress.KERNEL32(774D0000,010C28A0), ref: 009066E5
GetProcAddress.KERNEL32(774D0000,NtQueryInformationProcess), ref: 009066FC

Strings

NtQueryInformationProcess, xrefs: 009066F1

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 32d553d284626162254c2f0560797e0ba34624c81e69564bbd0fb9f724df2364
Instruction ID: 4ba1106f571d152a7ab1dc837b46ca606242ccffbdb3b3b9aa2656d52b95e4c1
Opcode Fuzzy Hash: 32d553d284626162254c2f0560797e0ba34624c81e69564bbd0fb9f724df2364
Instruction Fuzzy Hash: 32A14FB5A11280EFD754DF64EDACAA63BB9F78C641380C929E916C3364DF34A901DF60

Function 008E5570 Relevance: 12.1, APIs: 8, Instructions: 112
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008E5589
RtlAllocateHeap.NTDLL(00000000), ref: 008E5590
InternetOpenA.WININET(0090D014,00000000,00000000,00000000,00000000), ref: 008E55A6
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,04000100,00000000), ref: 008E55C1
InternetReadFile.WININET(?,?,00000400,00000001), ref: 008E55EC
LdrInitializeThunk.NTDLL(00000000,?,00000001), ref: 008E5611
InternetCloseHandle.WININET(?), ref: 008E562B
InternetCloseHandle.WININET(00000000), ref: 008E5632

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileInitializeProcessReadThunk
String ID:
API String ID: 1621142662-0
Opcode ID: 7d924ab8ad9f8eab5da018a747ee4137469d2a88cb09ed65d6f0ac97a8f94886
Instruction ID: 8f5d54bf73bb7a451029e1a8ead6c4382750dab205e9a9033a5498e0345c1fe2
Opcode Fuzzy Hash: 7d924ab8ad9f8eab5da018a747ee4137469d2a88cb09ed65d6f0ac97a8f94886
Instruction Fuzzy Hash: E2417C70A00244AFDB14CF56CC48F9AB7B4FF49708F54C0A9E908DB2A1DB719941CF94

Function 009028B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 009028C5
HeapAlloc.KERNEL32(00000000), ref: 009028CC
RegOpenKeyExA.KERNEL32(80000002,010CA508,00000000,00020119,00902849), ref: 009028EB
RegQueryValueExA.KERNEL32(00902849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00902905
RegCloseKey.ADVAPI32(00902849), ref: 0090290F

Strings

CurrentBuildNumber, xrefs: 009028FF

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 9f8254e22826c392b06236dcbeba432fca54317f7ae4742e768aeb62f382e8d5
Instruction ID: b5d6ba2c4ae5df99a1de64cf97f8f43ff7b5bdf2453c783d0b289b292ac6d498
Opcode Fuzzy Hash: 9f8254e22826c392b06236dcbeba432fca54317f7ae4742e768aeb62f382e8d5
Instruction Fuzzy Hash: 7B01D475A00258AFE310CBA0DC5DFFB7BBCEB49745F604058FE45D7280EA315A058790

Function 009029E0 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00902A0F
HeapAlloc.KERNEL32(00000000), ref: 00902A16
GetUserNameA.ADVAPI32(00000000,00000104), ref: 00902A2A

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: f441c4103f55a8cc60a48f4db23ef6ffe0e65b6b9150c46087f6289059f7cad6
Instruction ID: 6e84f151364245c204a84120840d23ba4f97f6c1778d01ac3ace354f7dc506d6
Opcode Fuzzy Hash: f441c4103f55a8cc60a48f4db23ef6ffe0e65b6b9150c46087f6289059f7cad6
Instruction Fuzzy Hash: 3BF0B4B1A40244AFC700DF88DD49F9ABBBCF748B21F500226F914E3280D7B4190487E1

Function 00906710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76F70000,010C8720), ref: 00906725
GetProcAddress.KERNEL32(76F70000,010C8520), ref: 0090673D
GetProcAddress.KERNEL32(76F70000,010C26F0), ref: 00906756
GetProcAddress.KERNEL32(76F70000,010C27B0), ref: 0090676E
GetProcAddress.KERNEL32(76F70000,010C2780), ref: 00906786
GetProcAddress.KERNEL32(76F70000,010C2630), ref: 0090679F
GetProcAddress.KERNEL32(76F70000,010CBC98), ref: 009067B7
GetProcAddress.KERNEL32(76F70000,010C26C0), ref: 009067CF
GetProcAddress.KERNEL32(76F70000,010C26D8), ref: 009067E8
GetProcAddress.KERNEL32(76F70000,010C2558), ref: 00906800
GetProcAddress.KERNEL32(76F70000,010C2708), ref: 00906818
GetProcAddress.KERNEL32(76F70000,010C86E0), ref: 00906831
GetProcAddress.KERNEL32(76F70000,010C8440), ref: 00906849
GetProcAddress.KERNEL32(76F70000,010C84C0), ref: 00906861
GetProcAddress.KERNEL32(76F70000,010C87C0), ref: 0090687A
GetProcAddress.KERNEL32(76F70000,010C24E0), ref: 00906892
GetProcAddress.KERNEL32(76F70000,010C24F8), ref: 009068AA
GetProcAddress.KERNEL32(76F70000,010CBD10), ref: 009068C3
GetProcAddress.KERNEL32(76F70000,010C8540), ref: 009068DB
GetProcAddress.KERNEL32(76F70000,010C2528), ref: 009068F3
GetProcAddress.KERNEL32(76F70000,010C2750), ref: 0090690C
GetProcAddress.KERNEL32(76F70000,010C2540), ref: 00906924
GetProcAddress.KERNEL32(76F70000,010C2828), ref: 0090693C
GetProcAddress.KERNEL32(76F70000,010C8700), ref: 00906955
GetProcAddress.KERNEL32(76F70000,010CFB50), ref: 0090696D
GetProcAddress.KERNEL32(76F70000,010CFBC8), ref: 00906985
GetProcAddress.KERNEL32(76F70000,010CFB08), ref: 0090699E
GetProcAddress.KERNEL32(76F70000,010CFBE0), ref: 009069B6
GetProcAddress.KERNEL32(76F70000,010CF9D0), ref: 009069CE
GetProcAddress.KERNEL32(76F70000,010CFA30), ref: 009069E7
GetProcAddress.KERNEL32(76F70000,010CFA48), ref: 009069FF
GetProcAddress.KERNEL32(76F70000,010CF958), ref: 00906A17
GetProcAddress.KERNEL32(76F70000,010CFBF8), ref: 00906A30
GetProcAddress.KERNEL32(76F70000,010C4A20), ref: 00906A48
GetProcAddress.KERNEL32(76F70000,010CFAD8), ref: 00906A60
GetProcAddress.KERNEL32(76F70000,010CFC28), ref: 00906A79
GetProcAddress.KERNEL32(76F70000,010C8560), ref: 00906A91
GetProcAddress.KERNEL32(76F70000,010CFC10), ref: 00906AA9
GetProcAddress.KERNEL32(76F70000,010C8580), ref: 00906AC2
GetProcAddress.KERNEL32(76F70000,010CFA60), ref: 00906ADA
GetProcAddress.KERNEL32(76F70000,010CF970), ref: 00906AF2
GetProcAddress.KERNEL32(76F70000,010C8360), ref: 00906B0B
GetProcAddress.KERNEL32(76F70000,010C8120), ref: 00906B23
LoadLibraryA.KERNEL32(010CFAC0,0090067A), ref: 00906B35
LoadLibraryA.KERNEL32(010CF988), ref: 00906B46
LoadLibraryA.KERNEL32(010CFAF0), ref: 00906B58
LoadLibraryA.KERNEL32(010CF9A0), ref: 00906B6A
LoadLibraryA.KERNEL32(010CF940), ref: 00906B7B
LoadLibraryA.KERNEL32(010CFA00), ref: 00906B8D
LoadLibraryA.KERNEL32(010CFA18), ref: 00906B9F
LoadLibraryA.KERNEL32(010CFB68), ref: 00906BB0
GetProcAddress.KERNEL32(75840000,010C8240), ref: 00906BCC
GetProcAddress.KERNEL32(75840000,010CF9B8), ref: 00906BE4
GetProcAddress.KERNEL32(75840000,010CD7A8), ref: 00906BFD
GetProcAddress.KERNEL32(75840000,010CFB20), ref: 00906C15
GetProcAddress.KERNEL32(75840000,010C8300), ref: 00906C2D
GetProcAddress.KERNEL32(73AC0000,010CB7C0), ref: 00906C4D
GetProcAddress.KERNEL32(73AC0000,010C82E0), ref: 00906C65
GetProcAddress.KERNEL32(73AC0000,010CBB30), ref: 00906C7E
GetProcAddress.KERNEL32(73AC0000,010CF9E8), ref: 00906C96
GetProcAddress.KERNEL32(73AC0000,010CFB38), ref: 00906CAE
GetProcAddress.KERNEL32(73AC0000,010C82A0), ref: 00906CC7
GetProcAddress.KERNEL32(73AC0000,010C83A0), ref: 00906CDF
GetProcAddress.KERNEL32(73AC0000,010CFB80), ref: 00906CF7
GetProcAddress.KERNEL32(760B0000,010C8380), ref: 00906D13
GetProcAddress.KERNEL32(760B0000,010C80E0), ref: 00906D2B
GetProcAddress.KERNEL32(760B0000,010CFAA8), ref: 00906D44
GetProcAddress.KERNEL32(760B0000,010CFA78), ref: 00906D5C
GetProcAddress.KERNEL32(760B0000,010C83C0), ref: 00906D74
GetProcAddress.KERNEL32(75D30000,010CBAE0), ref: 00906D94
GetProcAddress.KERNEL32(75D30000,010CB900), ref: 00906DAC
GetProcAddress.KERNEL32(75D30000,010CFB98), ref: 00906DC5
GetProcAddress.KERNEL32(75D30000,010C8140), ref: 00906DDD
GetProcAddress.KERNEL32(75D30000,010C81C0), ref: 00906DF5
GetProcAddress.KERNEL32(75D30000,010CB8D8), ref: 00906E0E
GetProcAddress.KERNEL32(753A0000,010CFA90), ref: 00906E2E
GetProcAddress.KERNEL32(753A0000,010C8320), ref: 00906E46
GetProcAddress.KERNEL32(753A0000,010CD818), ref: 00906E5F
GetProcAddress.KERNEL32(753A0000,010CFBB0), ref: 00906E77
GetProcAddress.KERNEL32(753A0000,010CFD00), ref: 00906E8F
GetProcAddress.KERNEL32(753A0000,010C8340), ref: 00906EA8
GetProcAddress.KERNEL32(753A0000,010C8100), ref: 00906EC0
GetProcAddress.KERNEL32(753A0000,010CFC58), ref: 00906ED8
GetProcAddress.KERNEL32(753A0000,010CFC70), ref: 00906EF1
GetProcAddress.KERNEL32(753A0000,CreateDesktopA), ref: 00906F07
GetProcAddress.KERNEL32(753A0000,OpenDesktopA), ref: 00906F1E
GetProcAddress.KERNEL32(753A0000,CloseDesktop), ref: 00906F35
GetProcAddress.KERNEL32(76DA0000,010C8060), ref: 00906F51
GetProcAddress.KERNEL32(76DA0000,010CFC88), ref: 00906F69
GetProcAddress.KERNEL32(76DA0000,010CFCD0), ref: 00906F82
GetProcAddress.KERNEL32(76DA0000,010CFCA0), ref: 00906F9A
GetProcAddress.KERNEL32(76DA0000,010CFCB8), ref: 00906FB2
GetProcAddress.KERNEL32(77300000,010C83E0), ref: 00906FCE
GetProcAddress.KERNEL32(77300000,010C8400), ref: 00906FE6
GetProcAddress.KERNEL32(767E0000,010C8220), ref: 00907002
GetProcAddress.KERNEL32(767E0000,010CFCE8), ref: 0090701A
GetProcAddress.KERNEL32(6F6A0000,010C8080), ref: 0090703A
GetProcAddress.KERNEL32(6F6A0000,010C8160), ref: 00907052
GetProcAddress.KERNEL32(6F6A0000,010C8280), ref: 0090706B
GetProcAddress.KERNEL32(6F6A0000,010CFC40), ref: 00907083
GetProcAddress.KERNEL32(6F6A0000,010C8020), ref: 0090709B
GetProcAddress.KERNEL32(6F6A0000,010C8260), ref: 009070B4
GetProcAddress.KERNEL32(6F6A0000,010C80A0), ref: 009070CC
GetProcAddress.KERNEL32(6F6A0000,010C8040), ref: 009070E4
GetProcAddress.KERNEL32(6F6A0000,InternetSetOptionA), ref: 009070FB
GetProcAddress.KERNEL32(6F6A0000,HttpQueryInfoA), ref: 00907112
GetProcAddress.KERNEL32(75760000,010D0468), ref: 0090712E
GetProcAddress.KERNEL32(75760000,010CD798), ref: 00907146
GetProcAddress.KERNEL32(75760000,010D0378), ref: 0090715F
GetProcAddress.KERNEL32(75760000,010D0390), ref: 00907177
GetProcAddress.KERNEL32(762C0000,010C80C0), ref: 00907193
GetProcAddress.KERNEL32(6E970000,010D0438), ref: 009071AF
GetProcAddress.KERNEL32(6E970000,010C82C0), ref: 009071C7
GetProcAddress.KERNEL32(6E970000,010D0408), ref: 009071E0
GetProcAddress.KERNEL32(6E970000,010D0360), ref: 009071F8

Strings

CreateDesktopA, xrefs: 00906F01
OpenDesktopA, xrefs: 00906F13
HttpQueryInfoA, xrefs: 00907107
InternetSetOptionA, xrefs: 009070F0
CloseDesktop, xrefs: 00906F2A

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: 4449d67393b3fde9ea2cfefc17b72c275dfd85b5bc3e8f15492f9d96918c46dc
Instruction ID: 90f980248ab42137f00ce7fa5c91668f8e1ec48d0c000a53a90716440d6dd179
Opcode Fuzzy Hash: 4449d67393b3fde9ea2cfefc17b72c275dfd85b5bc3e8f15492f9d96918c46dc
Instruction Fuzzy Hash: D3623EB5A10280EFD754DF64ECACAE637BAF78C641390C929E956C3364DF34A841DB60

Function 008FF300 Relevance: 102.7, APIs: 57, Strings: 1, Instructions: 1164stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0090D014,00000001,00000000,00000000), ref: 008FF32E
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF34C
lstrlenA.KERNEL32(0090D014), ref: 008FF357
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF371
lstrlenA.KERNEL32(0090D014), ref: 008FF37C
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF396
lstrcpy.KERNEL32(00000000,00915558), ref: 008FF3BE
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF3EC
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF422
lstrcpy.KERNEL32(00000000,0090D014), ref: 008FF454
lstrlenA.KERNEL32(010C8460), ref: 008FF476
lstrcpy.KERNEL32(00000000,?), ref: 008FF506
lstrcpy.KERNEL32(00000000,00000000), ref: 008FF52B
lstrcpy.KERNEL32(00000000,00000000), ref: 008FF5E2
StrCmpCA.SHLWAPI(?,ERROR), ref: 008FF894
lstrlenA.KERNEL32(010CD8D8), ref: 008FF8C2
lstrcpy.KERNEL32(00000000,010CD8D8), ref: 008FF8EF
lstrcpy.KERNEL32(00000000,00000000), ref: 008FF912
lstrcpy.KERNEL32(00000000,?), ref: 008FF966
lstrcpy.KERNEL32(00000000,010CD8D8), ref: 008FFA28
lstrcpy.KERNEL32(00000000,010CD7E8), ref: 008FFA58
lstrcpy.KERNEL32(00000000,?), ref: 008FFAB7
StrCmpCA.SHLWAPI(?,ERROR), ref: 008FFBD5
lstrlenA.KERNEL32(010CD808), ref: 008FFC03
lstrcpy.KERNEL32(00000000,010CD808), ref: 008FFC30
lstrcpy.KERNEL32(00000000,00000000), ref: 008FFC53
lstrcpy.KERNEL32(00000000,?), ref: 008FFCA7

Strings

ERROR, xrefs: 008FF788, 008FF88E, 008FFB30, 008FFBCF, 008FFE70, 008FFF0F

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 8ec94abf2cb9464e88a49bb7c7e465fe13034809f01de14de82acdcab645db0e
Instruction ID: c4694487afe43269e88044f9ba16159ad5ccd3552a5b75b185e7e7b6edb49739
Opcode Fuzzy Hash: 8ec94abf2cb9464e88a49bb7c7e465fe13034809f01de14de82acdcab645db0e
Instruction Fuzzy Hash: 0FA239309012469FC724DF39C848A6ABBE8FF85714F588579EA49DB3A2DB31DC41CB91

Function 008E6B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008E6BAF
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E6C02
InternetOpenA.WININET(0090D014,00000001,00000000,00000000,00000000), ref: 008E6C15
StrCmpCA.SHLWAPI(?,010CD6E8), ref: 008E6C2D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008E6C55
HttpOpenRequestA.WININET(00000000,GET,?,010D1620,00000000,00000000,-00400100,00000000), ref: 008E6C90
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 008E6CB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008E6CC6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 008E6CE5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 008E6D3F
lstrcpy.KERNEL32(00000000,?), ref: 008E6D9B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 008E6DBD
InternetCloseHandle.WININET(00000000), ref: 008E6DCE
InternetCloseHandle.WININET(?), ref: 008E6DD8
InternetCloseHandle.WININET(00000000), ref: 008E6DE2
lstrcpy.KERNEL32(00000000,00000000), ref: 008E6E03

Strings

GET, xrefs: 008E6C8A
ERROR, xrefs: 008E6CF2

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: 79ed8f97994a7a12346e2863fbf670f9f554d2d1669704fbdf7f57b9d3e89010
Instruction ID: 671cf7931a1ba3d5b428832f330d11f40e01eb81b9ac2a0c45107d31740e2713
Opcode Fuzzy Hash: 79ed8f97994a7a12346e2863fbf670f9f554d2d1669704fbdf7f57b9d3e89010
Instruction Fuzzy Hash: CF819C71A41259ABEB20DFA5CC49BEE77B8FF45750F144068F904E7280EB70AE418B91

Function 009026E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,010CD728), ref: 0090271B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,0090A470,00000000,00000000,00000000,00000000,?,010CD728), ref: 0090274C
GetProcessHeap.KERNEL32(00000000,00000104,?,010CD728), ref: 009027AF
HeapAlloc.KERNEL32(00000000,?,010CD728), ref: 009027B6
wsprintfA.USER32 ref: 009027DB

Strings

C, xrefs: 00902725
:\, xrefs: 00902735

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: :\$C
API String ID: 1325379522-3309953409
Opcode ID: 08b8030ffece6fd6b41c8ca882f6bbd7feb0cabc65cb2c779eaeec9d2df60198
Instruction ID: a0827ecf4ae38c2c33fdd33bf5484baa062ab9bfe400a915f82d6bbce5e750c2
Opcode Fuzzy Hash: 08b8030ffece6fd6b41c8ca882f6bbd7feb0cabc65cb2c779eaeec9d2df60198
Instruction Fuzzy Hash: DE316FB1D482499FCB14CFB89989AEEBFBCFF5C710F10416AE505E7650E6349A408BA1

Function 00901BD0 Relevance: 12.1, APIs: 8, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 688e6d35e2a07d63d7563ec6ef8ec09139a5276153d4ba185559e42ce65944c1
Instruction ID: faa2bb45cfff8c8a066dcfdb7f03aa7be5bda38bcdc7b397fbb0a142ea15229e
Opcode Fuzzy Hash: 688e6d35e2a07d63d7563ec6ef8ec09139a5276153d4ba185559e42ce65944c1
Instruction Fuzzy Hash: 74315031A006569FCB21BBB9CC85B9E7BAEBF41740B444435F405D72A2DF70EC058791

Function 008E4AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800,010CD718), ref: 008E4B17
??2@YAPAXI@Z.MSVCRT(00000800), ref: 008E4B21
??2@YAPAXI@Z.MSVCRT(00000800), ref: 008E4B2B
lstrlenA.KERNEL32(?,00000000,?), ref: 008E4B3F
InternetCrackUrlA.WININET(?,00000000), ref: 008E4B47

Strings

<, xrefs: 008E4B07

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 6e29a0424f56f74ad5810ed898c2151ba07639bc9528fa2fdcf7dd4eba95b151
Instruction ID: 672731011e5ba6fe4ee7f8bc3b3d8256b970b69860237ccf83d2e61bb1d22f9f
Opcode Fuzzy Hash: 6e29a0424f56f74ad5810ed898c2151ba07639bc9528fa2fdcf7dd4eba95b151
Instruction Fuzzy Hash: 1C011B71D00218ABDB00DFA9E845B9EBBB8FB09320F008126F914E7290DF7459058BD4

Function 00902820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00902835
HeapAlloc.KERNEL32(00000000), ref: 0090283C

Part of subcall function 009028B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 009028C5
Part of subcall function 009028B0: HeapAlloc.KERNEL32(00000000), ref: 009028CC
Part of subcall function 009028B0: RegOpenKeyExA.KERNEL32(80000002,010CA508,00000000,00020119,00902849), ref: 009028EB
Part of subcall function 009028B0: RegQueryValueExA.KERNEL32(00902849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00902905
Part of subcall function 009028B0: RegCloseKey.ADVAPI32(00902849), ref: 0090290F

RegOpenKeyExA.KERNEL32(80000002,010CA508,00000000,00020119,?), ref: 00902871
RegQueryValueExA.KERNEL32(?,010D0000,00000000,00000000,00000000,000000FF), ref: 0090288C
RegCloseKey.ADVAPI32(?), ref: 00902896

Strings

Windows 11, xrefs: 00902850

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 6d415f6875a57dec013cbfa0960e28346b3b37ec5593d9f892844b68ee711b58
Instruction ID: 65932b5bab53ae03f38a4e442f2ac826374430e486206c4cba9f565935032394
Opcode Fuzzy Hash: 6d415f6875a57dec013cbfa0960e28346b3b37ec5593d9f892844b68ee711b58
Instruction Fuzzy Hash: 2401A275A00218BFD7109BA4AC4DFEA777DEB44711F408158FE08D7290DE705A4187A0

Function 008FEFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008FF013
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,008FF54D), ref: 008FF02E
lstrcpy.KERNEL32(00000000,ERROR), ref: 008FF08F

Strings

ERROR, xrefs: 008FF028, 008FF089

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: 4284024aeb017d750c8084cb21c793da4cfe40004dbfef3a070a94744f56fca7
Instruction ID: 6e97a66df578073941a23c1c8c194b1b6f5e21bb1bd8a5f66cdc3f12801478a0
Opcode Fuzzy Hash: 4284024aeb017d750c8084cb21c793da4cfe40004dbfef3a070a94744f56fca7
Instruction Fuzzy Hash: FF213030A1068A9BCB20BF7ECC46AAA3BA8FF45704F404524B989DB213DF70DD618791

Function 00902A70 Relevance: 4.5, APIs: 3, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00902A9F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00902AA6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 00902ABA

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 081886a7eccee13d8c6bee23bd2a81c1b2c946a2dfff4ffa0bca8b9c6cb914c7
Instruction ID: 58930bfb2e50d999faf8ba8cfcd90069424a2c12e8f754613bc944d387d59974
Opcode Fuzzy Hash: 081886a7eccee13d8c6bee23bd2a81c1b2c946a2dfff4ffa0bca8b9c6cb914c7
Instruction Fuzzy Hash: 0D01AD72B44648ABDB10CF99EC49BAAB7ACF748B21F00426AE919D3780DB74590486A1

Function 008FEF30 Relevance: 1.3, APIs: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008FEF62

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 9ea47589f373369ee23705cf7b159f7e5bcd47020d5e0dbd7d498a930f58a3f5
Instruction ID: 36d8138684dd761eee0d2746b50b54b85171e41229491f6e801c8dd0fc39267b
Opcode Fuzzy Hash: 9ea47589f373369ee23705cf7b159f7e5bcd47020d5e0dbd7d498a930f58a3f5
Instruction Fuzzy Hash: 31119C706201895BDB24FF7ED846E9E3BA8FF42340F805124B988DB252DA74ED658792

Non-executed Functions

Function 008E6000 Relevance: 123.3, APIs: 68, Strings: 2, Instructions: 817stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008E602F
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E6082
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E60B5
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E60E5
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E6120
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E6153
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008E6163

Strings

", xrefs: 008E65C7, 008E66B5
------, xrefs: 008E6289, 008E62B6, 008E652E, 008E661F

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: bac2ee151e31d41d21cfbdab59ef7db24c0af15fbd81a25be5c6e99c54151ab3
Instruction ID: 8bc058fdadc22c4428ee5ab5cd83fed9e17cd343059bd07bc022d0fc2b8a200b
Opcode Fuzzy Hash: bac2ee151e31d41d21cfbdab59ef7db24c0af15fbd81a25be5c6e99c54151ab3
Instruction Fuzzy Hash: A4526D31D00296AFCB21ABB9CC49BAE7BB9FF45350F058024F905E7252DB74ED128B91

Function 008E97A0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 235stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008E97C4
lstrcatA.KERNEL32(?,?), ref: 008E97D8
lstrcatA.KERNEL32(?,?), ref: 008E97ED
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 008E9800
memset.MSVCRT ref: 008E9815

Part of subcall function 00903E10: lstrcpy.KERNEL32(00000000,0090D014), ref: 00903E45
Part of subcall function 00903E10: lstrcpy.KERNEL32(00000000,010C4B10), ref: 00903E6F
Part of subcall function 00903E10: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,008E4D2A,?,00000014), ref: 00903E79

wsprintfA.USER32 ref: 008E9846
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 008E9869
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 008E9888
memset.MSVCRT ref: 008E98A6
lstrcatA.KERNEL32(?,?,?,00000000,00000103), ref: 008E98BB
lstrcatA.KERNEL32(?,?), ref: 008E98CD
lstrcatA.KERNEL32(?,00915118), ref: 008E98DD
memset.MSVCRT ref: 008E98F2
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 008E991A
lstrcpy.KERNEL32(00000000,?), ref: 008E9950
StrStrA.SHLWAPI(?,010D0060), ref: 008E9965
lstrcpyn.KERNEL32(00B193D0,?,00000000), ref: 008E9982
lstrlenA.KERNEL32(?), ref: 008E9996
wsprintfA.USER32 ref: 008E99A6
lstrcpy.KERNEL32(?,?), ref: 008E99BD
memset.MSVCRT ref: 008E99D3

Strings

%s%s, xrefs: 008E99A0
D, xrefs: 008E99EA
--remote-debugging-port=9229 --profile-directory=", xrefs: 008E97F3

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrcpy$Desktopwsprintf$CreateFolderOpenPathSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$D
API String ID: 3051782728-1862457068
Opcode ID: 01a6bee18ed5dfbe803fba54a4b10557431d3d6a93272016381d304e02cc42ca
Instruction ID: 4ae631d0d62599e0d69f2ca8b6bc1a20604aa6dc43fac716a152ee9845e418e7
Opcode Fuzzy Hash: 01a6bee18ed5dfbe803fba54a4b10557431d3d6a93272016381d304e02cc42ca
Instruction Fuzzy Hash: 47913D71614384AFD720EB74DC49FDB77E8FF89700F508919B689C7291DBB0A9048BA6

Function 009046C0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 009046D9
Process32First.KERNEL32(00000000,00000128), ref: 009046E9
Process32Next.KERNEL32(00000000,00000128), ref: 009046FB
StrCmpCA.SHLWAPI(?,?), ref: 0090470D
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00904722
TerminateProcess.KERNEL32(00000000,00000000), ref: 00904731
CloseHandle.KERNEL32(00000000), ref: 00904738
Process32Next.KERNEL32(00000000,00000128), ref: 00904746
CloseHandle.KERNEL32(00000000), ref: 00904751

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 7063f054a6346edcb6037536fe39ead26a3027397865510cbe5afad45a125100
Instruction ID: 15547ca7071f2b05cb1562a23e79ac38dfaa3b1f7f93a593b3f1086be0c0fb6f
Opcode Fuzzy Hash: 7063f054a6346edcb6037536fe39ead26a3027397865510cbe5afad45a125100
Instruction Fuzzy Hash: EA019271601114AFE7215B60DC8DFFE377CEB49B51F404198FA09D6180EF749A858B65

Function 008E7690 Relevance: 7.6, APIs: 5, Instructions: 52memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 008E769E
HeapAlloc.KERNEL32(00000000), ref: 008E76A5
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 008E76CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 008E76ED
LocalFree.KERNEL32(?), ref: 008E76F7

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 24bc84c863ddb5b52a20cf5d6ef28f09906ad3651200a65591821374d947fd4c
Instruction ID: 305b32e876273bad769567f3f7bba0f85618233b05b0c08c6e3f5e1ea39979c9
Opcode Fuzzy Hash: 24bc84c863ddb5b52a20cf5d6ef28f09906ad3651200a65591821374d947fd4c
Instruction Fuzzy Hash: DB011275B403087BEB10DB949C4AFEA7778EB48B11F108155FB09EB2C0DAB099018790

Function 00904090 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,?,?,?,?,?), ref: 009040AD
GetProcessHeap.KERNEL32(00000000,?,?,?), ref: 009040BC
HeapAlloc.KERNEL32(00000000,?,?,?), ref: 009040C3
CryptBinaryToStringA.CRYPT32(?,?,40000001,?,?,?,?,?,?), ref: 009040F3

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: BinaryCryptHeapString$AllocProcess
String ID:
API String ID: 3939037734-0
Opcode ID: b129bbc59590e4d42b1f31a3ebc1ec8d4388273607cd057aa459b34f8d8d6a8c
Instruction ID: 7bb8799787808161f2fb0e2399d865e865114bf07f7af2868feb0c6afe65e4ee
Opcode Fuzzy Hash: b129bbc59590e4d42b1f31a3ebc1ec8d4388273607cd057aa459b34f8d8d6a8c
Instruction Fuzzy Hash: 2E011AB1600209AFDB109FA5EC99BAABBBDEF89311F108059BE0997240DE719D508B60

Function 008E9BE0 Relevance: 6.0, APIs: 4, Instructions: 43memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 008E9BFF
LocalAlloc.KERNEL32(00000040,?), ref: 008E9C13
memcpy.MSVCRT(00000000,?), ref: 008E9C2A
LocalFree.KERNEL32(?), ref: 008E9C37

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: bd855a7db995371d3106b25d7b8c3c46f2ead6b7f7b0d6b643b28bbc72fd77b3
Instruction ID: 47000536db9928f7e65003046376bd0d0366d1a1e1ee39305cb8779e591b32e1
Opcode Fuzzy Hash: bd855a7db995371d3106b25d7b8c3c46f2ead6b7f7b0d6b643b28bbc72fd77b3
Instruction Fuzzy Hash: F401FB75A4130AABD710DBA4DC59BAAB778EB44B00F504554EE04EB284DBB09A118BE0

Function 008E9B80 Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 008E9B9B
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 008E9BAA
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 008E9BC1
LocalFree.KERNEL32(?,?,00000000,00000001,00000000,?,00000000,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 008E9BD0

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 231fa092b15c90731990db574c29c511ac2e793a7e6a6bc79ca48988a0423a6f
Instruction ID: b7c39484cf82fabdfabbf5b41b8ae846fdfebc768bb6c3deb09e1a931c9596e8
Opcode Fuzzy Hash: 231fa092b15c90731990db574c29c511ac2e793a7e6a6bc79ca48988a0423a6f
Instruction Fuzzy Hash: 61F0BDB03443627BF7305F65AC59F967BACEB45B61F240414FA49EA2C0DBB49840CAA4

Function 00903E10 Relevance: 4.6, APIs: 3, Instructions: 124stringtimeCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0090D014), ref: 00903E45
lstrcpy.KERNEL32(00000000,010C4B10), ref: 00903E6F
GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,008E4D2A,?,00000014), ref: 00903E79

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$SystemTime
String ID:
API String ID: 684065273-0
Opcode ID: f3b81195efbfda54dc9249140bf9cc918f091f485a44b655ed427cb5ebed3d56
Instruction ID: f24a9e7d4b1d28e11c9578b3a8becfc6c4d7f4b8829fcd9c3db62f2b4fe0f6f3
Opcode Fuzzy Hash: f3b81195efbfda54dc9249140bf9cc918f091f485a44b655ed427cb5ebed3d56
Instruction Fuzzy Hash: 9A416C75A112469FDB14CF29C8846A6BBF8FF09710B09C0A9E949DB3A2C771ED42CB40

Function 008E1070 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008E108A

Part of subcall function 008E1000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008E1015
Part of subcall function 008E1000: HeapAlloc.KERNEL32(00000000), ref: 008E101C
Part of subcall function 008E1000: RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 008E1039
Part of subcall function 008E1000: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 008E1053
Part of subcall function 008E1000: RegCloseKey.ADVAPI32(?), ref: 008E105D

lstrcatA.KERNEL32(?,00000000), ref: 008E10A0
lstrlenA.KERNEL32(?), ref: 008E10AD
lstrcatA.KERNEL32(?,.keys), ref: 008E10C8
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E10FF
lstrlenA.KERNEL32(010CD598), ref: 008E110D
lstrcpy.KERNEL32(00000000,?), ref: 008E1131
lstrcatA.KERNEL32(00000000,010CD598), ref: 008E1139
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 008E1144
lstrcpy.KERNEL32(00000000,00000000), ref: 008E1168
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 008E1174
lstrcpy.KERNEL32(00000000,00000000), ref: 008E119A
lstrcpy.KERNEL32(00000000,0090D014), ref: 008E11DF
lstrlenA.KERNEL32(010D04B0), ref: 008E11EE
lstrcpy.KERNEL32(00000000,?), ref: 008E1215
lstrcatA.KERNEL32(00000000,?), ref: 008E121D
lstrcpy.KERNEL32(00000000,00000000), ref: 008E1258
lstrcatA.KERNEL32(00000000), ref: 008E1265
lstrcpy.KERNEL32(00000000,00000000), ref: 008E128C
CopyFileA.KERNEL32(?,?,00000001), ref: 008E12B5
lstrcpy.KERNEL32(00000000,?), ref: 008E12E1
lstrcpy.KERNEL32(00000000,?), ref: 008E131D

Part of subcall function 008FEF30: lstrcpy.KERNEL32(00000000,?), ref: 008FEF62

DeleteFileA.KERNEL32(?), ref: 008E1351
memset.MSVCRT ref: 008E136E

Strings

.keys, xrefs: 008E10BC
\Monero\wallet.keys, xrefs: 008E113F, 008E116E

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 5fff0b46314d9827f52375c7e5c06c8aa9792009a20ce57636cd4ad36eaf8382
Instruction ID: 4deb289298fe2d9dc9ff274c2225ef2dbf7863a1005eedd715d237f279d896c9
Opcode Fuzzy Hash: 5fff0b46314d9827f52375c7e5c06c8aa9792009a20ce57636cd4ad36eaf8382
Instruction Fuzzy Hash: B3A17E71A01296ABCB10EFBADC49A9E7BB8FF46700F444024FA05E7251DF70DE518BA1

Function 008E92E0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008E90F0: InternetOpenA.WININET(0090D014,00000001,00000000,00000000,00000000), ref: 008E910F
Part of subcall function 008E90F0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 008E912C
Part of subcall function 008E90F0: InternetCloseHandle.WININET(00000000), ref: 008E9139
Part of subcall function 008E90F0: strlen.MSVCRT ref: 008E9155

strlen.MSVCRT ref: 008E9311
strlen.MSVCRT ref: 008E932A

Part of subcall function 008F7EB0: memchr.MSVCRT ref: 008F7EEF
Part of subcall function 008F7EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 008F7F09
Part of subcall function 008F7EB0: memchr.MSVCRT ref: 008F7F28

Part of subcall function 008E89B0: std::_Xinvalid_argument.LIBCPMT ref: 008E89C6

memset.MSVCRT ref: 008E9371
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 008E938C
lstrcatA.KERNEL32(?,00000000), ref: 008E93A2
strlen.MSVCRT ref: 008E93C9
strlen.MSVCRT ref: 008E9416
memcmp.MSVCRT(?,0090D014,?), ref: 008E943B
memset.MSVCRT ref: 008E9562
lstrcatA.KERNEL32(?,cookies), ref: 008E9577
lstrcatA.KERNEL32(?,00911D5C), ref: 008E9589
lstrcatA.KERNEL32(?,?), ref: 008E959A
lstrcatA.KERNEL32(?,00915150), ref: 008E95AC
lstrcatA.KERNEL32(?,?), ref: 008E95BD
lstrcatA.KERNEL32(?,.txt), ref: 008E95CF
lstrlenA.KERNEL32(?), ref: 008E95E6
lstrlenA.KERNEL32(?), ref: 008E960B
lstrcpy.KERNEL32(00000000,?), ref: 008E9644
memset.MSVCRT ref: 008E968C

Strings

ws://localhost:9229, xrefs: 008E9380
/devtools, xrefs: 008E9325, 008E9330
localhost, xrefs: 008E92FA, 008E9318
.txt, xrefs: 008E95C3
cookies, xrefs: 008E956B

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: 426fde87631ff846a7b79cdd9e980636d071d9ef92361c7210673f912da97010
Instruction ID: d4fe9b99117c378ce1175b4bf4d3bbf1f3756f3c90e7f5dfeede47d9c4a76b84
Opcode Fuzzy Hash: 426fde87631ff846a7b79cdd9e980636d071d9ef92361c7210673f912da97010
Instruction Fuzzy Hash: 77E11470E10258EFDF10EFA9C884ADDBBB5FF49304F5044A9E549E7281DB709A45CB91

Function 00901800 Relevance: 37.8, APIs: 25, Instructions: 269stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0090D014), ref: 0090182F
lstrlenA.KERNEL32(010BFA80,00000000,00000000,?,?,00901B61), ref: 00901840
lstrcpy.KERNEL32(00000000,00000000), ref: 00901867
lstrcatA.KERNEL32(00000000,00000000), ref: 00901872
lstrcpy.KERNEL32(00000000,00000000), ref: 009018A1
lstrlenA.KERNEL32(00915558,?,?,00901B61), ref: 009018B3
lstrcpy.KERNEL32(00000000,00000000), ref: 009018D4
lstrcatA.KERNEL32(00000000,00915558,?,?,00901B61), ref: 009018E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0090190F
lstrlenA.KERNEL32(010B65F0,?,?,00901B61), ref: 00901925
lstrcpy.KERNEL32(00000000,00000000), ref: 0090194C
lstrcatA.KERNEL32(00000000,00000000), ref: 00901957
lstrcpy.KERNEL32(00000000,00000000), ref: 00901986
lstrlenA.KERNEL32(00915558,?,?,00901B61), ref: 00901998
lstrcpy.KERNEL32(00000000,00000000), ref: 009019B9
lstrcatA.KERNEL32(00000000,00915558,?,?,00901B61), ref: 009019C5
lstrcpy.KERNEL32(00000000,00000000), ref: 009019F4
lstrlenA.KERNEL32(010C1430,?,?,00901B61), ref: 00901A0A
lstrcpy.KERNEL32(00000000,00000000), ref: 00901A31
lstrcatA.KERNEL32(00000000,00000000), ref: 00901A3C
lstrcpy.KERNEL32(00000000,00000000), ref: 00901A6B
lstrlenA.KERNEL32(010C1440,?,?,00901B61), ref: 00901A81
lstrcpy.KERNEL32(00000000,00000000), ref: 00901AA8
lstrcatA.KERNEL32(00000000,00000000), ref: 00901AB3
lstrcpy.KERNEL32(00000000,00000000), ref: 00901AE2

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 3ac3cdd684c42d1c41ace23f5f212c99c661a60367fcdeb77a9d1becf36c2515
Instruction ID: c590f5ee3a6437ba81a3ea97204a15c9a386bb518324570625e62c6b1f466b73
Opcode Fuzzy Hash: 3ac3cdd684c42d1c41ace23f5f212c99c661a60367fcdeb77a9d1becf36c2515
Instruction Fuzzy Hash: 4E913DB5601743AFD720AFB9DC98A57B7EDFF05300B148829A895D32A1DF74DD818B60

Function 008F8D00 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 174stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,?,?,0090081F), ref: 008F8D1A
ExitProcess.KERNEL32 ref: 008F8D27
strtok_s.MSVCRT ref: 008F8D39

Strings

block, xrefs: 008F8D0B

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 443177c69bdca474e0295399a07a2f19cf62508cb4138c650ee7af5022da01d5
Instruction ID: a93dbd44f2dab7f24af1fdd057d254bf339b88a6dec8fd5f4c94538224cb5d6e
Opcode Fuzzy Hash: 443177c69bdca474e0295399a07a2f19cf62508cb4138c650ee7af5022da01d5
Instruction Fuzzy Hash: 495170B0A08749EFC7209F75EC88A7A77F5FB48708B40486EE652D7620DFB4E4418B21

Function 008E90F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0090D014,00000001,00000000,00000000,00000000), ref: 008E910F
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 008E912C
InternetCloseHandle.WININET(00000000), ref: 008E9139
strlen.MSVCRT ref: 008E9155
InternetReadFile.WININET(?,?,?,00000000), ref: 008E9196
InternetReadFile.WININET(00000000,?,00001000,?), ref: 008E91C7
InternetCloseHandle.WININET(00000000), ref: 008E91D2
InternetCloseHandle.WININET(00000000), ref: 008E91D9
strlen.MSVCRT ref: 008E91EA
strlen.MSVCRT ref: 008E921D
strlen.MSVCRT ref: 008E925E

Part of subcall function 008F7EB0: memchr.MSVCRT ref: 008F7EEF
Part of subcall function 008F7EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 008F7F09
Part of subcall function 008F7EB0: memchr.MSVCRT ref: 008F7F28

strlen.MSVCRT ref: 008E927C

Part of subcall function 008E89B0: std::_Xinvalid_argument.LIBCPMT ref: 008E89C6

Strings

"ws://, xrefs: 008E9259, 008E9264
"webSocketDebuggerUrl":, xrefs: 008E91E5, 008E91F0
http://localhost:9229/json, xrefs: 008E9126

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: 870323bf26d6577b900d51502743052fadff30c10a90205105f3e2f1d14ebb04
Instruction ID: 227fd886baa6fb9687f12138ca60ba11f8326e7cfdce3493ab185a2aeefdff2e
Opcode Fuzzy Hash: 870323bf26d6577b900d51502743052fadff30c10a90205105f3e2f1d14ebb04
Instruction Fuzzy Hash: 5151DC71700249ABDB20DFA8DC45BEEB7F9EF84710F144465FA05E3290DBB4DA458761

Function 008E7710 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringregistrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008E7745
RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 008E778A
strlen.MSVCRT ref: 008E77BE
StrStrA.SHLWAPI(?,Password), ref: 008E77F8
strlen.MSVCRT ref: 008E788D

Part of subcall function 008E7690: GetProcessHeap.KERNEL32(00000008,00000400), ref: 008E769E
Part of subcall function 008E7690: HeapAlloc.KERNEL32(00000000), ref: 008E76A5
Part of subcall function 008E7690: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 008E76CD
Part of subcall function 008E7690: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 008E76ED
Part of subcall function 008E7690: LocalFree.KERNEL32(?), ref: 008E76F7

strcpy_s.MSVCRT ref: 008E7821
GetProcessHeap.KERNEL32(00000000,00000000), ref: 008E782C
HeapFree.KERNEL32(00000000), ref: 008E7833
strlen.MSVCRT ref: 008E7840
strcpy_s.MSVCRT ref: 008E786A
strlen.MSVCRT ref: 008E78B4
RegEnumValueA.ADVAPI32(80000001,00000000,?,000000FF,00000000,00000003,?,?,80000001), ref: 008E7975

Strings

Password, xrefs: 008E77EC

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heapstrlen$EnumFreeProcessValuestrcpy_s$AllocByteCharCryptDataLocalMultiOpenUnprotectWide
String ID: Password
API String ID: 3893107980-3434357891
Opcode ID: 106c8f607cb034a4fa94768edcf461030e0b7fe2d23e22cb030d6d757811e595
Instruction ID: ceb7bc630537270a3380240c2452bb9eab029a0df9281c3db564f9619aaeef4e
Opcode Fuzzy Hash: 106c8f607cb034a4fa94768edcf461030e0b7fe2d23e22cb030d6d757811e595
Instruction Fuzzy Hash: B9810CB1D0025DAFDB10DF95DC84ADEBBB9FF49300F10816AE509E7250EB359A85CBA1

Function 008FF100 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008FF134
lstrcpy.KERNEL32(00000000,?), ref: 008FF162
StrCmpCA.SHLWAPI(00000000,ERROR,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF176
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF185
LocalAlloc.KERNEL32(00000040,00000001,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF1A3
StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF1D1
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF1E4
strtok.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF1F6
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008FF67A), ref: 008FF202
lstrcpy.KERNEL32(00000000,ERROR), ref: 008FF24F
lstrcpy.KERNEL32(00000000,ERROR), ref: 008FF28F

Strings

ERROR, xrefs: 008FF170, 008FF20F, 008FF249, 008FF289

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$AllocLocalstrtok
String ID: ERROR
API String ID: 2137491262-2861137601
Opcode ID: 0ccb198f16557ad731565c158123a5b1a920426cce087d492a64593b97b820d3
Instruction ID: eeaea77859745d1e0d77873dd87a69061edbc88c2fdd969200f011df2ab6df6e
Opcode Fuzzy Hash: 0ccb198f16557ad731565c158123a5b1a920426cce087d492a64593b97b820d3
Instruction Fuzzy Hash: 4051BE35A102899FCB21AF79CC49ABE7BA8FF85710F054564FA49DB222DB70DC428791

Function 008EA070 Relevance: 18.3, APIs: 12, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(010CD738,00B19BD8,0000FFFF), ref: 008EA086
lstrcpy.KERNEL32(00000000,0090D014), ref: 008EA0B3
lstrlenA.KERNEL32(00B19BD8), ref: 008EA0C0
lstrcpy.KERNEL32(00000000,00B19BD8), ref: 008EA0EA
lstrlenA.KERNEL32(00915204), ref: 008EA0F5
lstrcpy.KERNEL32(00000000,00000000), ref: 008EA112
lstrcatA.KERNEL32(00000000,00915204), ref: 008EA11E
lstrcpy.KERNEL32(00000000,00000000), ref: 008EA144
lstrcatA.KERNEL32(00000000,00000000), ref: 008EA14F
lstrcpy.KERNEL32(00000000,00000000), ref: 008EA174
SetEnvironmentVariableA.KERNEL32(010CD738,00000000), ref: 008EA18F
LoadLibraryA.KERNEL32(010D0AD0), ref: 008EA1A3

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID:
API String ID: 2929475105-0
Opcode ID: a3273726c6a914127deaf9bd78df3fb213a825522ea82374cead74b4ba295570
Instruction ID: 1211a363534f8593f23fdd25d93abc767daa5756835588dabefbb3f5425416e0
Opcode Fuzzy Hash: a3273726c6a914127deaf9bd78df3fb213a825522ea82374cead74b4ba295570
Instruction Fuzzy Hash: 9E91D535600A80DFD7249FBADC44AA637B5FB46B04F818528F505D7361EFB1ED818B92

Function 008EBCE9 Relevance: 18.2, APIs: 12, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0090D014), ref: 008EBD0F
lstrlenA.KERNEL32(00000000), ref: 008EBD42
lstrcpy.KERNEL32(00000000,00000000), ref: 008EBD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 008EBD74
lstrcpy.KERNEL32(00000000,00000000), ref: 008EBD9C
lstrlenA.KERNEL32(0091508C), ref: 008EBE13

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4c8f0d060030977f2c6b74f16ecad6092dbccfdeda1b71ad1aacdb4b41be40cb
Instruction ID: a3c604eead77efa309a0489e2ad1266e97a7b35ad5bad74904234da8a9340881
Opcode Fuzzy Hash: 4c8f0d060030977f2c6b74f16ecad6092dbccfdeda1b71ad1aacdb4b41be40cb
Instruction Fuzzy Hash: F4A18030A012859FCB24EF6ADD49A9FBBB4FF46304F548069E409DB262DB71DC52CB91

Function 008F8240 Relevance: 18.2, APIs: 12, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 008F8263
lstrlenA.KERNEL32(00000000), ref: 008F829C
lstrcpy.KERNEL32(00000000,00000000), ref: 008F82D3
lstrlenA.KERNEL32(00000000), ref: 008F82F0
lstrcpy.KERNEL32(00000000,00000000), ref: 008F8327
lstrlenA.KERNEL32(00000000), ref: 008F8344
lstrcpy.KERNEL32(00000000,00000000), ref: 008F837B
lstrlenA.KERNEL32(00000000), ref: 008F8398
lstrcpy.KERNEL32(00000000,00000000), ref: 008F83C7
lstrlenA.KERNEL32(00000000), ref: 008F83E1
lstrcpy.KERNEL32(00000000,00000000), ref: 008F8410
strtok_s.MSVCRT ref: 008F842A

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$strtok_s
String ID:
API String ID: 2211830134-0
Opcode ID: 61217740d8f483c0e1cc30f0b65226990c3bbd6f3151f6f85dbcd68ebcb9b7fb
Instruction ID: 0c2987d22da63240c06a29f9eca87f6c29fe0a6e1ddb9efdec38291f707067b4
Opcode Fuzzy Hash: 61217740d8f483c0e1cc30f0b65226990c3bbd6f3151f6f85dbcd68ebcb9b7fb
Instruction Fuzzy Hash: 83513971900617EBDB14AF79D848AAABBA8FF04310F108524ED06EB245DF30ED61CBE0

Function 008E6A10 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 008E6A3F
InternetOpenA.WININET(0090D014,00000001,00000000,00000000,00000000), ref: 008E6A6C
StrCmpCA.SHLWAPI(?,010CD6E8), ref: 008E6A8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 008E6AAA
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 008E6AC8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 008E6AE1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 008E6B06
InternetReadFile.WININET(00000000,?,00000400,?), ref: 008E6B30
CloseHandle.KERNEL32(00000000), ref: 008E6B50
InternetCloseHandle.WININET(00000000), ref: 008E6B57
InternetCloseHandle.WININET(?), ref: 008E6B61

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: 82bfd2224a31389ba1ac50aaaf2333501e19005cd6a7e964c530ef727796db4a
Instruction ID: 84586076f56e2583c8b0296a1fd1248a030e54cf47bc9442c712f9bf3e4f31c7
Opcode Fuzzy Hash: 82bfd2224a31389ba1ac50aaaf2333501e19005cd6a7e964c530ef727796db4a
Instruction Fuzzy Hash: C4419071A40255ABDB20DF65DC89FEE77B8FB44740F508464FA05E7180EF70AE418BA4

Function 008E79A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008E7710: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008E7745
Part of subcall function 008E7710: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 008E778A
Part of subcall function 008E7710: strlen.MSVCRT ref: 008E77BE
Part of subcall function 008E7710: StrStrA.SHLWAPI(?,Password), ref: 008E77F8
Part of subcall function 008E7710: strcpy_s.MSVCRT ref: 008E7821
Part of subcall function 008E7710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 008E782C
Part of subcall function 008E7710: HeapFree.KERNEL32(00000000), ref: 008E7833
Part of subcall function 008E7710: strlen.MSVCRT ref: 008E7840

lstrcatA.KERNEL32(00000000,0091508C), ref: 008E79D0
lstrcatA.KERNEL32(00000000,?), ref: 008E79FD
lstrcatA.KERNEL32(00000000, : ), ref: 008E7A0F
lstrcatA.KERNEL32(00000000,?), ref: 008E7A30
wsprintfA.USER32 ref: 008E7A50
lstrcpy.KERNEL32(00000000,?), ref: 008E7A79
lstrcatA.KERNEL32(00000000,00000000), ref: 008E7A87
lstrcatA.KERNEL32(00000000,0091508C), ref: 008E7AA0

Strings

: , xrefs: 008E7A09

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: 44704b0974c1dfe3952237ea6f9db651ad47a4603b178d48c1e84d9c9acb9e9d
Instruction ID: 9c076f9971ab6e66dfc9dd64e313ad35002e6cdcd8467aa2a7ca4722b7ef8262
Opcode Fuzzy Hash: 44704b0974c1dfe3952237ea6f9db651ad47a4603b178d48c1e84d9c9acb9e9d
Instruction Fuzzy Hash: DB317576A04298EFCB10DBA9DC44DEFBB79FB89714F658529E50AD3200DF70AA41C790

Function 008F80E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 008F8105
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0090093B), ref: 008F814B
lstrcpy.KERNEL32(00000000,00000000), ref: 008F817A
StrCmpCA.SHLWAPI(00000000,009151F4,?,?,?,?,?,0090093B), ref: 008F8192
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0090093B), ref: 008F81D0
lstrcpy.KERNEL32(00000000,00000000), ref: 008F81FF
strtok_s.MSVCRT ref: 008F820F

Strings

fplugins, xrefs: 008F80E6

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlenstrtok_s
String ID: fplugins
API String ID: 3280532728-38756186
Opcode ID: a15a173cdf3535585c30a90689e3c6ca8e9ba81371e49b840409ea5990037004
Instruction ID: 4a521c59cce4bb138f6d869237bd709f369478ac24bfd6152f0b5c20dca00265
Opcode Fuzzy Hash: a15a173cdf3535585c30a90689e3c6ca8e9ba81371e49b840409ea5990037004
Instruction Fuzzy Hash: 50417B75A0020AEFCB21DF78D948BAABBB8FF44700F118119E959D7244EF34E981CB90

Function 008E9E40 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 182memorystringCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 008E9E64
memcmp.MSVCRT(?,v10,00000003), ref: 008E9EA2
memset.MSVCRT ref: 008E9ECF
LocalAlloc.KERNEL32(00000040), ref: 008E9F07

Part of subcall function 00907210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0090722E

lstrcpy.KERNEL32(00000000,00915200), ref: 008EA012

Strings

v10, xrefs: 008E9E9C
@, xrefs: 008E9EE8
v20, xrefs: 008E9E5E

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpymemcmp$AllocLocalmemset
String ID: @$v10$v20
API String ID: 3420379846-278772428
Opcode ID: 7c738111478b917c8716728451f9065b185eb39fbe3503af6903f6f023707fd1
Instruction ID: bb042877c84d61143b4819b174c65b384bc8f24a776e995bee68ee905c375374
Opcode Fuzzy Hash: 7c738111478b917c8716728451f9065b185eb39fbe3503af6903f6f023707fd1
Instruction Fuzzy Hash: 3351B431A00289ABDB10EFAACC45BDE7BA8FF42314F054425F959EB252DBB0ED4587D1

Function 008E1000 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008E1015
HeapAlloc.KERNEL32(00000000), ref: 008E101C
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 008E1039
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 008E1053
RegCloseKey.ADVAPI32(?), ref: 008E105D

Strings

SOFTWARE\monero-project\monero-core, xrefs: 008E102F
wallet_path, xrefs: 008E104D

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 228372d5a65e615134154039c25abbf4d8cfd345560fd596ec461e94df0dce32
Instruction ID: ef8592f86f7e24456024dec34d9a4b9566374b6b0adac07c1f03dc0dfe18ac2f
Opcode Fuzzy Hash: 228372d5a65e615134154039c25abbf4d8cfd345560fd596ec461e94df0dce32
Instruction Fuzzy Hash: 92F03079B40349BBD7109BA1AC4DFEB7B7CEB44715F104154FE09E3281DAB05A4487A1

Function 00904760 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00904779
Process32First.KERNEL32(00000000,00000128), ref: 00904789
Process32Next.KERNEL32(00000000,00000128), ref: 0090479B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 009047BC
TerminateProcess.KERNEL32(00000000,00000000), ref: 009047CB
CloseHandle.KERNEL32(00000000), ref: 009047D2
Process32Next.KERNEL32(00000000,00000128), ref: 009047E0
CloseHandle.KERNEL32(00000000), ref: 009047EB

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 2183aeae932bdc213550c95d485e9e52394ed17e3f8d3fb5d2a3cab5b67261f3
Instruction ID: 22a65c44429c8edbf498f895e436321e0ae4369ef98bac4d7b8785a310be91d8
Opcode Fuzzy Hash: 2183aeae932bdc213550c95d485e9e52394ed17e3f8d3fb5d2a3cab5b67261f3
Instruction Fuzzy Hash: 6301B1B1601214AFE7205B209C8DFEA77BCEB08751F404590FA09D20C0EF708E908BA1

Function 008E7130 Relevance: 10.6, APIs: 7, Instructions: 141memorylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 008E717E
GetProcessHeap.KERNEL32(00000008,00000010), ref: 008E71B9
HeapAlloc.KERNEL32(00000000), ref: 008E71C0
memcpy.MSVCRT(00000000,?), ref: 008E71ED
GetProcessHeap.KERNEL32(00000000,?), ref: 008E7203
HeapFree.KERNEL32(00000000), ref: 008E720A
GetProcAddress.KERNEL32(00000000,?), ref: 008E7269

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeLibraryLoadProcmemcpy
String ID:
API String ID: 1745114167-0
Opcode ID: 0d97a1a1f8005e1f783ed1eb7cd4b3bc9ff20220ceb89c338efc1ac797cf3e2c
Instruction ID: 542fbda80988cac5323abba91a706afa93f78d1dbfe4594cce06161d98a3fb88
Opcode Fuzzy Hash: 0d97a1a1f8005e1f783ed1eb7cd4b3bc9ff20220ceb89c338efc1ac797cf3e2c
Instruction Fuzzy Hash: 5B415D717047469BEB20CFAADC84BAAB3E8FF89315F144569ED5EC7300E631E9108B50

Function 008E9CD0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 008E9D08
LocalAlloc.KERNEL32(00000040,?), ref: 008E9D3A
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 008E9D63
memcmp.MSVCRT(?,DPAPI,00000005), ref: 008E9D9C

Strings

"encrypted_key":", xrefs: 008E9D5D
DPAPI, xrefs: 008E9D96
, xrefs: 008E9DC5

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: cf714cba7f1881cb3ced06acaf857bd85199f2c99d071d06020312c083f1c661
Instruction ID: 931d5c082ed6783e604003bb51bc7ca161c71a1a008eed8bbccbd1cab87827b8
Opcode Fuzzy Hash: cf714cba7f1881cb3ced06acaf857bd85199f2c99d071d06020312c083f1c661
Instruction Fuzzy Hash: 85419C71E002A99BDB11EF6ACC81AAE7BB8FF42300F044065E994E7352DAB0ED05C791

Function 008F7F60 Relevance: 10.6, APIs: 7, Instructions: 118stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 008F7F84
lstrlenA.KERNEL32(00000000), ref: 008F7FB1
lstrcpy.KERNEL32(00000000,00000000), ref: 008F7FE0
strtok_s.MSVCRT ref: 008F7FF1
StrCmpCA.SHLWAPI(00000000,009151F4), ref: 008F8025
StrCmpCA.SHLWAPI(00000000,009151F4), ref: 008F8053
StrCmpCA.SHLWAPI(00000000,009151F4), ref: 008F8087

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 05afbb27e1ac7e54b3eefe07839a16dc890b98e4ad4b3f4096fa70e26fe2e470
Instruction ID: 87508a65de20b5c0d45111201199651acac6aea0bd33c0f25576f147e4831e54
Opcode Fuzzy Hash: 05afbb27e1ac7e54b3eefe07839a16dc890b98e4ad4b3f4096fa70e26fe2e470
Instruction Fuzzy Hash: C2418D34A0451EDFDB20DF28D884EAE77B4FF85304B114099E905DB251EF71EA66CB91

Function 008F7DC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008F7DD8

Part of subcall function 0090A1F0: std::exception::exception.LIBCMT ref: 0090A205
Part of subcall function 0090A1F0: __CxxThrowException@8.LIBCMT ref: 0090A21A

std::_Xinvalid_argument.LIBCPMT ref: 008F7DF6
std::_Xinvalid_argument.LIBCPMT ref: 008F7E11
memcpy.MSVCRT(?,?,?,00000000,?,?,008F7CFA,00000000,?,?,00000000,?,008E91B6,?), ref: 008F7E74

Strings

invalid string position, xrefs: 008F7DD3
string too long, xrefs: 008F7DF1, 008F7E0C

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwmemcpystd::exception::exception
String ID: invalid string position$string too long
API String ID: 702443124-4289949731
Opcode ID: b3728a79a2337007b848087e94f17e98cadd0fc80f971aecd4ae7ec68bf1926a
Instruction ID: 889cf57c3270e6de45b6064e87d8a5bd6a6bea97825ff34fac18a7548845e585
Opcode Fuzzy Hash: b3728a79a2337007b848087e94f17e98cadd0fc80f971aecd4ae7ec68bf1926a
Instruction Fuzzy Hash: C02184323087088FE724DE7CD880A3AB7A5FF95B14B604A6EE556CB641D7619C4087A1

Function 008E9AE0 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,008E12EE), ref: 008E9AFA
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,008E12EE), ref: 008E9B10
LocalAlloc.KERNEL32(00000040,?,?,?,?,008E12EE), ref: 008E9B27
ReadFile.KERNEL32(00000000,00000000,?,008E12EE,00000000,?,?,?,008E12EE), ref: 008E9B40
LocalFree.KERNEL32(?,?,?,?,008E12EE), ref: 008E9B60
CloseHandle.KERNEL32(00000000,?,?,?,008E12EE), ref: 008E9B67

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 958b8bc536ecb37bef67ea639ae3e70dc6619fd3380a9725c06bb30acfeee7cb
Instruction ID: d67bd1e9946b03749aa18229e3f17c3ec1e06e5af2878af3357aaa30540f02a6
Opcode Fuzzy Hash: 958b8bc536ecb37bef67ea639ae3e70dc6619fd3380a9725c06bb30acfeee7cb
Instruction Fuzzy Hash: 96118EB0600259AFE710DFA6EC88EBA736CFB45710F104119F914D7280EB70AD00CB64

Function 008E89B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E89C6

Part of subcall function 0090A1F0: std::exception::exception.LIBCMT ref: 0090A205
Part of subcall function 0090A1F0: __CxxThrowException@8.LIBCMT ref: 0090A21A

std::_Xinvalid_argument.LIBCPMT ref: 008E89FD

Part of subcall function 0090A1A3: std::exception::exception.LIBCMT ref: 0090A1B8
Part of subcall function 0090A1A3: __CxxThrowException@8.LIBCMT ref: 0090A1CD

memcpy.MSVCRT(?,00000000,?,00000000,?,?,008E8800,?,00000000,008E77D7), ref: 008E8A5B

Strings

invalid string position, xrefs: 008E89C1
string too long, xrefs: 008E89F8

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception$memcpy
String ID: invalid string position$string too long
API String ID: 2202983795-4289949731
Opcode ID: e31aa8246c6b38babc596043fd64b10a5c1377622b9aa3788f2c5cc189756a0b
Instruction ID: d2def972218f6033161da0b3dcd2b588833ae16d0c989b7e189b12342c82f8b6
Opcode Fuzzy Hash: e31aa8246c6b38babc596043fd64b10a5c1377622b9aa3788f2c5cc189756a0b
Instruction Fuzzy Hash: B321D872300694CBC720DA5DE840A6EF795FBA2761B11093FF159CB291DA71D841C3E6

Function 00901B00 Relevance: 7.6, APIs: 5, Instructions: 66timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00901E28), ref: 00901B52

Part of subcall function 00901800: lstrcpy.KERNEL32(00000000,0090D014), ref: 0090182F
Part of subcall function 00901800: lstrlenA.KERNEL32(010BFA80,00000000,00000000,?,?,00901B61), ref: 00901840
Part of subcall function 00901800: lstrcpy.KERNEL32(00000000,00000000), ref: 00901867
Part of subcall function 00901800: lstrcatA.KERNEL32(00000000,00000000), ref: 00901872
Part of subcall function 00901800: lstrcpy.KERNEL32(00000000,00000000), ref: 009018A1
Part of subcall function 00901800: lstrlenA.KERNEL32(00915558,?,?,00901B61), ref: 009018B3
Part of subcall function 00901800: lstrcpy.KERNEL32(00000000,00000000), ref: 009018D4
Part of subcall function 00901800: lstrcatA.KERNEL32(00000000,00915558,?,?,00901B61), ref: 009018E0
Part of subcall function 00901800: lstrcpy.KERNEL32(00000000,00000000), ref: 0090190F

sscanf.NTDLL ref: 00901B7A
SystemTimeToFileTime.KERNEL32(?,?), ref: 00901B96
SystemTimeToFileTime.KERNEL32(?,?), ref: 00901BA6
ExitProcess.KERNEL32 ref: 00901BC3

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Timelstrcpy$System$Filelstrcatlstrlen$ExitProcesssscanf
String ID:
API String ID: 3040284667-0
Opcode ID: 615fb037f5ec2a98e993e1c9532df58908440b03ef6fc55366767f12f186adb5
Instruction ID: 5ef840614413e6ca68e4e608549bb8a15d19570fc3da7345c1f54ede05aa4221
Opcode Fuzzy Hash: 615fb037f5ec2a98e993e1c9532df58908440b03ef6fc55366767f12f186adb5
Instruction Fuzzy Hash: 0721E4B1518341AF8340DF69D88489BBBF8EFC8314F408A1EF599C3264EB70D5048BA2

Function 008E6E30 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 008E6E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 008E6E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 008E6EB4
HeapAlloc.KERNEL32(00000000), ref: 008E6EBB

Strings

@, xrefs: 008E6E30

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID: @
API String ID: 1643994569-2766056989
Opcode ID: c35dcf59946e3184cef6cadcc4a420f7086280c27e6533f70ac7de3c930cad9d
Instruction ID: fdcf7a4e4bab5ac3a8cc7c27c7a3f80c28fa4abc9538933481b1a917e29d0abc
Opcode Fuzzy Hash: c35dcf59946e3184cef6cadcc4a420f7086280c27e6533f70ac7de3c930cad9d
Instruction Fuzzy Hash: 6C11AD706006428BDB208B62DC88BBA73F5FB52740F044428EA46CB684FF74E990CB51

Function 008F7CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008F7D14
std::_Xinvalid_argument.LIBCPMT ref: 008F7D2F
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,008E91B6,?,?,?,?,00000000,?,00001000,?), ref: 008F7D84

Part of subcall function 008F7DC0: std::_Xinvalid_argument.LIBCPMT ref: 008F7DD8
Part of subcall function 008F7DC0: std::_Xinvalid_argument.LIBCPMT ref: 008F7DF6
Part of subcall function 008F7DC0: std::_Xinvalid_argument.LIBCPMT ref: 008F7E11
Part of subcall function 008F7DC0: memcpy.MSVCRT(?,?,?,00000000,?,?,008F7CFA,00000000,?,?,00000000,?,008E91B6,?), ref: 008F7E74

Strings

string too long, xrefs: 008F7D0F, 008F7D2A

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: cd8cd1b588c219db70b17c33b3c68e0e20302f8806420b2122dd362fb5524816
Instruction ID: 3b679e78c7e705395875c2cbff37856d39f5a21f724a0adc13ba883b7865410a
Opcode Fuzzy Hash: cd8cd1b588c219db70b17c33b3c68e0e20302f8806420b2122dd362fb5524816
Instruction Fuzzy Hash: F33107723086088FF724AE7CE880A7AF3E9FF91350760462AF251CB649C771984083A4

Function 008E8880 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E88B3

Part of subcall function 0090A1A3: std::exception::exception.LIBCMT ref: 0090A1B8
Part of subcall function 0090A1A3: __CxxThrowException@8.LIBCMT ref: 0090A1CD

Strings

yxxx, xrefs: 008E890A
yxxx, xrefs: 008E88BD
vector<T> too long, xrefs: 008E88AE

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long$yxxx$yxxx
API String ID: 2884196479-1517697755
Opcode ID: 9287a0546124a9652bddb680b09e8223dfe589f57e5793cb1edc305591813d3c
Instruction ID: a544a8605d085cf1d3aac22f6b1593ce8f1687299cd43b8a1ef862a9888420b1
Opcode Fuzzy Hash: 9287a0546124a9652bddb680b09e8223dfe589f57e5793cb1edc305591813d3c
Instruction Fuzzy Hash: EA3154B5E00519DFCB08DF59C8916ADBBB6FB89310F148269E919EB385DB30A901CBD1

Function 008E8740 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E8767

Part of subcall function 0090A1A3: std::exception::exception.LIBCMT ref: 0090A1B8
Part of subcall function 0090A1A3: __CxxThrowException@8.LIBCMT ref: 0090A1CD

Strings

vector<T> too long, xrefs: 008E8762
yxxx, xrefs: 008E8749
yxxx, xrefs: 008E8771

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long$yxxx$yxxx
API String ID: 2884196479-1517697755
Opcode ID: 3be2ee9f2c9566c0d1137303d8e3f702098eabf53ba854240679ef9a97210af7
Instruction ID: e342961e85ecfe41a305b9662c9d568b9c9fe36350c59de23a8e5cc7942d9f1f
Opcode Fuzzy Hash: 3be2ee9f2c9566c0d1137303d8e3f702098eabf53ba854240679ef9a97210af7
Instruction Fuzzy Hash: 4EF09A27B140258F8354A43E8D8409EA946A6E639037AC761E95EEF288EC30EC8291D0

Function 008E87B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E880C
memcpy.MSVCRT(?,?,00000000,00000000,008E77D7), ref: 008E8852

Part of subcall function 008E89B0: std::_Xinvalid_argument.LIBCPMT ref: 008E89C6

Strings

string too long, xrefs: 008E8807

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 64c947340368bd299a7307a451a5d0ef1eef5c3e8bba2ab1fc9d65e632fdac92
Instruction ID: 5f94df38691920d32fe45c4fd5d98bb0656a3697a581e8d368cf59256fe9a161
Opcode Fuzzy Hash: 64c947340368bd299a7307a451a5d0ef1eef5c3e8bba2ab1fc9d65e632fdac92
Instruction Fuzzy Hash: 7F21C1207006A0CFDB358A6E8880A2EA7E5FB87700B640929F89AC7781DFA1DC408795

Function 008E8A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E8AA5

Part of subcall function 0090A1A3: std::exception::exception.LIBCMT ref: 0090A1B8
Part of subcall function 0090A1A3: __CxxThrowException@8.LIBCMT ref: 0090A1CD

memcpy.MSVCRT(?,?,?), ref: 008E8AEF

Strings

string too long, xrefs: 008E8AA0

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentmemcpystd::_std::exception::exception
String ID: string too long
API String ID: 2475949303-2556327735
Opcode ID: 4efbe0a59a551f516f02a6480c39d35b493fd8c8f559b1aed14f3b7c76df3dd5
Instruction ID: 6deb5b06841c996e82fbdfb60028ea2dc4aa6e61ee93fd53507a203f45a01541
Opcode Fuzzy Hash: 4efbe0a59a551f516f02a6480c39d35b493fd8c8f559b1aed14f3b7c76df3dd5
Instruction Fuzzy Hash: 4C212972B046589FE720CE6EDC4066EB7E6FBD6320F148A6AEC59C3380DF7099458791

Function 008E8BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008E8BBF

Part of subcall function 0090A1F0: std::exception::exception.LIBCMT ref: 0090A205
Part of subcall function 0090A1F0: __CxxThrowException@8.LIBCMT ref: 0090A21A

memmove.MSVCRT(?,?,?,?,?,008E89E2,00000000,?,?,008E8800,?,00000000,008E77D7), ref: 008E8BF5

Strings

invalid string position, xrefs: 008E8BBA

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentmemmovestd::_std::exception::exception
String ID: invalid string position
API String ID: 655285616-1799206989
Opcode ID: f294f66b89a01fa97e651694c6cb98d5129823f84cf0e401f8a591c8a0c74af3
Instruction ID: c08970f72463a688a34aaaa752934ab23e70fc2875b47d66d2a28bc00e71e40d
Opcode Fuzzy Hash: f294f66b89a01fa97e651694c6cb98d5129823f84cf0e401f8a591c8a0c74af3
Instruction Fuzzy Hash: 7B018470304785DFD3258A6CEC9461EB2A6EBC6718B294918D099C7789DB70DC818790

Function 008E1410 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008E1510: lstrcpy.KERNEL32(00000000), ref: 008E152D
Part of subcall function 008E1510: lstrcpy.KERNEL32(00000000,?), ref: 008E154F
Part of subcall function 008E1510: lstrcpy.KERNEL32(00000000,?), ref: 008E1571
Part of subcall function 008E1510: lstrcpy.KERNEL32(00000000,?), ref: 008E1593

lstrcpy.KERNEL32(00000000,?), ref: 008E1437
lstrcpy.KERNEL32(00000000,?), ref: 008E1459
lstrcpy.KERNEL32(00000000,?), ref: 008E147B
lstrcpy.KERNEL32(00000000,?), ref: 008E14DF

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1cf5f43708d938ff76eadeedebc2c99c057c4898bcb19c036d9d2c93d049e78f
Instruction ID: f3eff46f005f2d0ee113b29f2bcf3f2432250295023234c05b4076f1e448ec45
Opcode Fuzzy Hash: 1cf5f43708d938ff76eadeedebc2c99c057c4898bcb19c036d9d2c93d049e78f
Instruction Fuzzy Hash: F131E8B4A01B82AFCB28DF3AC558956BBE5FF49704700492DA856C3B50DB70F850CB80

Function 00901550 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00901581
lstrcpy.KERNEL32(00000000,?), ref: 009015B9
lstrcpy.KERNEL32(00000000,?), ref: 009015F1
lstrcpy.KERNEL32(00000000,?), ref: 00901629

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1107cdf193ed9d13202bb45de3d3507e833618c820c6b5cb588c6a7c726d98d6
Instruction ID: 7e39fbc78407c0d11a948dba4ad1388046fa401fd27496cd1e71f308d66e6967
Opcode Fuzzy Hash: 1107cdf193ed9d13202bb45de3d3507e833618c820c6b5cb588c6a7c726d98d6
Instruction Fuzzy Hash: 2B21D7B4601B429FD724DF2AC858A17B7F9FF49700B044A2DA886CBB81DB70E851CB91

Function 008E6E32 Relevance: 5.1, APIs: 4, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 008E6E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 008E6E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 008E6EB4
HeapAlloc.KERNEL32(00000000), ref: 008E6EBB

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID:
API String ID: 1643994569-0
Opcode ID: 84cdf451b47ba9daa7e2eb6f2155cf7befd66f9ea58d2af040d245b22f8d9d59
Instruction ID: bd354ec3ce237cefb85ad15bde008e50a9bddee7cc72ae370ef9499197a985e6
Opcode Fuzzy Hash: 84cdf451b47ba9daa7e2eb6f2155cf7befd66f9ea58d2af040d245b22f8d9d59
Instruction Fuzzy Hash: D9219DB06006429BEB208B26DC84BBB73E9FB56744F444468FA46CB684FB78E951CB51

Function 008E1510 Relevance: 5.1, APIs: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 008E152D
lstrcpy.KERNEL32(00000000,?), ref: 008E154F
lstrcpy.KERNEL32(00000000,?), ref: 008E1571
lstrcpy.KERNEL32(00000000,?), ref: 008E1593

Memory Dump Source

Source File: 00000000.00000002.1846899554.00000000008E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 008E0000, based on PE: true

Associated: 00000000.00000002.1846876474.00000000008E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846931588.000000000090B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846954653.0000000000917000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000918000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000923000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000092B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000951000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000960000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000973000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.00000000009E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A3D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000A60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846976400.0000000000B18000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1847465653.0000000000B2A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8e0000_stealcy11.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 2e3476918b2859d40cd95c878039dc0efcf5d544674ffa065a508f29db8d1770
Instruction ID: 6ffd3353cf0f5cff34eb7e7a1b344c080d961430545b9939dfa88a175abff52a
Opcode Fuzzy Hash: 2e3476918b2859d40cd95c878039dc0efcf5d544674ffa065a508f29db8d1770
Instruction Fuzzy Hash: 3211ECB4A01B82ABDB249F7AD45C927B7F8FF8A711304452DA857C7B50EB30E950CB90

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report stealcy11.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Protection of GUI

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stealcy11.exe_ee10818b3e9e17f62f4aac373bb9c253d7b698c_5b291f0b_eab3bab9-b6ef-436b-b0de-580fab6d54df\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD69.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE048.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE078.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
stealcy11.exe

Function 008E56C0 Relevance: 97.0, APIs: 51, Strings: 4, Instructions: 734
stringCOMMON

Function 008E4980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Function 009063C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Function 008E5570 Relevance: 12.1, APIs: 8, Instructions: 112
networkmemoryfileCOMMON

Function 009028B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
registrymemoryCOMMON

Function 00906710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Function 008E6B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
networkstringfileCOMMON

Function 009026E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
memoryCOMMON

Function 00901BD0 Relevance: 12.1, APIs: 8, Instructions: 106
COMMON

Function 008E4AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
stringnetworkCOMMON

Function 00902820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registrymemoryCOMMON

Function 008FEFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Function 00902A70 Relevance: 4.5, APIs: 3, Instructions: 44
memoryCOMMON